Say “digital accessibility law” and most people picture the Americans with Disabilities Act (ADA) or Section 508. Both are federal, and for most teams that is where the conversation stops.
Underneath the federal layer sits a growing set of state laws that far fewer companies track. Some of it carries consequences the federal statutes don’t.
Federal priorities also shift. Enforcement emphasis changes from one administration to the next, and the Title II web deadlines have already been pushed back once.
State obligations don’t move on that schedule. The laws that carry money damages against private sites run through state courts, past the reach of any federal enforcement choice.
Those state laws split along one line that decides whether they matter to you at all. One set reaches only government and the companies that sell into it. The other reaches ordinary commercial websites, and that is where the money claims come from.
Laws Aimed at Government
Most states have something requiring their own agencies to build and buy accessible technology. A few are real statutes, most are IT policies or standards, and nearly all of them now point at the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA as the target. The federal government keeps a running list of state policies, and it grows every year. They bind state agencies, and often local government and the vendors selling into them.
Colorado is the one with real teeth. House Bill 21-1110 requires state and local government sites to meet WCAG 2.1 AA, and unlike almost every other government mandate it carries a private right of action and a $3,500 fine per violation. The grace period ended July 1, 2025, so it is live now. If you sell software to a Colorado agency or district, their obligation becomes your problem through procurement.
Florida shows the opposite pattern. The state has an accessibility statute, Chapter 282, that tells agencies to procure and maintain accessible technology, but it runs through procurement and administrative review with no private right of action. That is why Florida sits near the top of the lawsuit charts on federal claims while its own state law almost never shows up in a complaint.
So a state having an accessibility law tells you very little about your private exposure there. It tells you what the government has to do, and what its vendors have to prove.
Laws That Reach Private Business
The lawsuits that cost private businesses money mostly don’t run on accessibility laws at all. They run on old civil rights statutes that predate the web, because those laws let a plaintiff collect damages the Americans with Disabilities Act (ADA) does not.
California is the clearest case. The Unruh Civil Rights Act dates to 1959 and says nothing about websites, but California courts treat an ADA violation as an automatic Unruh violation, and Unruh carries statutory damages of at least $4,000 per violation. That single link between the two laws is why so much filing activity has moved into California state court.
New York runs on the same idea with different statutes. Plaintiffs stack the New York State Human Rights Law, the New York City Human Rights Law, and the state Civil Rights Law, all of which allow money damages and attorney fees that federal ADA claims do not. Your business does not have to sit in New York. If a New Yorker can reach your site, the state’s courts can reach you.
Minnesota is the one to watch. In early 2025 a federal court let a case proceed against an online-only retailer under the Minnesota Human Rights Act, and the state strengthened its damages provisions the year before. Not California-level volume yet, but the pieces are in place.
What Having a Law Doesn’t Tell You
None of this maps cleanly onto a list of safe and unsafe states. A state with a strong government accessibility statute can be a low-risk place for a private ecommerce site. A state with no accessibility law of its own can be one of the riskiest places you operate, because a federal ADA claim and a resident plaintiff are enough on their own.
The federal floor sits under all of it. The 2024 Department of Justice rule under Title II of the ADA set WCAG 2.1 AA for state and local government sites, and the compliance dates were later pushed back about a year. For private businesses, Title III of the ADA still applies whether or not your state has said a word about the web.
Where Teams Get This Wrong
The mistake we see most is geographic. A team headquartered in a quiet state assumes it is fine, without checking that its customers sit in California or New York, where the money laws bite. Web exposure follows your users, not your office.
Then there’s the tooling assumption. A clean automated scan or an overlay widget does not answer a WCAG-based complaint, because those complaints cite the exact failures scanners can’t see and overlays don’t fix. Plaintiffs’ firms understand that better than most vendors do.
Vendors selling into government and education have their own version. Treat accessibility as a checkbox and you lose a Colorado deal or stall in procurement when you can’t produce a credible Voluntary Product Accessibility Template, or VPAT.
What This Means for How You Test
The practical answer is simpler than the legal map. WCAG 2.1 AA is the working standard almost everywhere that matters, from the federal Title II rule to the settlements that resolve most Unruh and New York claims. Build to that and you have covered most of the surface.
Where you test hardest should follow where the damages are. If real customers sit in California or New York, that is where an inaccessible checkout or a broken form turns into a filing. Manual auditing earns its keep here, because the claims are built on the keyboard traps and unlabeled dynamic components that automated tools score as passing.
For teams selling into the public sector, the work is documentation as much as remediation. A VPAT that survives procurement review is a different artifact from one written to look good, and buyers under Colorado’s rule or the federal standard can tell them apart.
One more practical note. Keep a dated record of the accessibility work you do. A good-faith history doesn’t make a claim disappear, but it changes the conversation when a demand letter shows up.
Wrap-Up
The state-by-state picture will keep moving. More states are copying Colorado, and plaintiffs keep shifting from federal court into state court to reach the damages that live there. The laws being bent to cover websites were never designed for it, so the case law stays unsettled.
The move that holds up regardless of which state law is in play is knowing where your own site actually stands against WCAG 2.1 AA, tested by hand and not just scanned. That is what a real audit gives you. See how our manual WCAG audits work.
Frequently Asked Questions
It depends on the law. Most state digital accessibility laws are written for the public sector and bind state agencies and the vendors selling into them. Private businesses face state exposure mainly through older civil rights statutes, like California’s Unruh Civil Rights Act and New York’s Human Rights Laws, which courts have applied to websites.
California and New York are the main two. California’s Unruh Civil Rights Act carries statutory damages of at least $4,000 per violation, and New York’s state and city Human Rights Laws allow damages and attorney fees that federal Americans with Disabilities Act (ADA) claims do not. Colorado allows a $3,500 fine per violation, but only against government entities.
Yes. California and New York courts can assert jurisdiction when their residents use your website, no matter where your company is based. Web exposure follows your users, not your headquarters.
Yes. Florida Chapter 282 requires state agencies to procure and maintain accessible technology, but it runs through procurement and administrative review with no private right of action. Florida’s high lawsuit volume comes from federal ADA Title III claims, not its state statute.
Almost all of them point to the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, the same standard the 2024 Department of Justice rule set for state and local government under Title II of the ADA. Building to WCAG 2.1 AA covers most state and federal requirements at once.
Yes. The compliance grace period ended July 1, 2025. Colorado requires state and local government sites to meet WCAG 2.1 Level AA and allows a $3,500 fine per violation, which makes it the only state government accessibility mandate currently paired with a private right of action and statutory damages.