Accessibility and the law, and visitors from other countries

An accessibility statement is a page that says honestly what has been checked on a site and what has not. Most accessibility laws point to WCAG.

A caveat

This is the topic where the law changes fastest and where precision matters. So at once: this lesson is a guide, dated 30 October 2026, and it doesn’t replace a lawyer. The facts about the laws of different countries are gathered so that you understand what to ask, not so that you decide what applies to your site. The sources are listed at the bottom.

Accessibility law, country by country

In this part you learned the WCAG 2.2 criteria and checked your site. Here is what the law says in the places an English-speaking site is most likely to meet.

United States.

• The Americans with Disabilities Act (ADA) bars discrimination against people with disabilities. Title III covers “public accommodations,” that is, businesses open to the public. The Department of Justice has long taken the position that the ADA applies to the web offerings of such businesses, but it has no regulation setting detailed technical standards for private sites; it points to WCAG and the Section 508 standards as helpful guidance. Courts disagree on how far Title III reaches a website, in particular whether it must be tied to a physical place, yet accessibility lawsuits and demand letters are filed in large numbers every year, and several states, such as California, have their own civil rights laws used in these claims.
• Title II covers state and local governments. A Justice Department rule of 2024 requires their web content and mobile apps to meet WCAG 2.1 level AA. An interim final rule published in April 2026 pushed its compliance dates back by a year (to April 2027 for larger entities and April 2028 for smaller ones), according to reports; check the current dates.
• Section 508 of the Rehabilitation Act requires federal agencies to make their electronic and information technology accessible, and the Revised 508 Standards build on WCAG 2.0. Section 504 covers recipients of federal money.
• For a private small site, the practical rule: there’s no federal checklist, but WCAG 2.2 AA is what a plaintiff, a settlement or a court will measure you against.

United Kingdom.

• The Equality Act 2010 bars discrimination by those who provide services to the public. A service provider must make reasonable adjustments for disabled people (sections 20 and 29), and this duty is “anticipatory”: it applies before a particular person complains. The Act sets no technical standard, but WCAG is the practical benchmark.
• Public sector bodies have to meet WCAG 2.2 AA under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018, and to publish an accessibility statement.

European Union.

• The European Accessibility Act (Directive 2019/882) has applied since 28 June 2025. Among the products and services it covers for consumers are e-commerce services, consumer banking services, e-books and electronic communications. Microenterprises providing services (fewer than ten people and a turnover or balance sheet of up to €2 million) are exempt from the service requirements. It reaches businesses outside the EU that sell to EU consumers. The technical benchmark is the European standard EN 301 549, which for web content points to WCAG 2.1 AA (a newer version based on WCAG 2.2 is in preparation). The penalties are set by each member state.
• The Web Accessibility Directive (2016/2102) covers public sector sites, with an accessibility statement.

Russia, for comparison. GOST R 52872-2019 is a national standard on the accessibility of internet resources, approved by Rosstandart order No. 589-st of 29 August 2019 and in force since 1 April 2020. It’s based on WCAG 2.1 and defines levels A, AA and AAA. National standards are voluntary in general, but become binding where an act or a contract refers to them. Reports say that a 2026 Government decree (No. 102) sets accessibility requirements for the websites of public authorities. For an ordinary commercial site we found no direct general duty in the Russian text, and lawyers differ. These details come from the Russian edition, so check the current text.

The conclusion for a small project is simple: take WCAG 2.2 AA as the yardstick, check the site in three passes, fix the main things and say honestly what has been done.

The accessibility statement

An accessibility statement is a page where you speak honestly about the accessibility of the site. It’s needed by a person who wants to know whether the site will suit them and where to report a problem, and it shows that you take the matter seriously. For UK and EU public sector bodies it’s a legal requirement; for a private site it’s good practice and a sign of good faith. What it contains.

1. The target: for example “WCAG 2.2, level AA.”
2. The status: what was checked and when (a tool, a keyboard, a screen reader, which pages), and what wasn’t checked.
3. Known limitations and, where possible, when they will be fixed.
4. How to report a problem: an email or a form, and the time in which you’ll answer.
5. The date and who did the checking.

The main rule: don’t say “fully conforms” until a full check (by the criteria, with real people) has been done. It’s the same as in the lesson on advertising law: a claim without substantiation, and in the US an inaccurate claim can itself be treated as deceptive. An honest “partly checked, here is what and here is what not” is worth more than a loud and untrue one.

Check yourself: what may you write in the statement if only one page has been checked?

The target (WCAG 2.2 AA), exactly what was checked and when, what wasn’t checked, the known limitations and an email for reports. You must not write “fully conforms.”

If your visitors are not only from your own country

An English-language site can be read by anyone, and an expert’s service may be wanted abroad. The rules of another country apply to you not because the page opens there, but because you target the people there. The ones met most often follow.

GDPR (the General Data Protection Regulation, EU Regulation 2016/679, applying since 25 May 2018; see the lesson on personal data law). It protects the personal data of people in the EU. It reaches you wherever you are if you offer them goods or services or monitor their behavior (Article 3(2)). Signs of targeting: the languages of EU countries, prices in euros, delivery to the EU, mentions of customers in the EU; English alone and chance visits prove nothing. What matters in it: lawful bases, people’s rights (access, correction, erasure, portability, objection), a breach notice to the regulator within 72 hours, and fines of up to €20 million or 4 percent of worldwide annual turnover (Article 83). The UK GDPR is its UK counterpart. You know the principles from the lesson on personal data law.

ePrivacy (Directive 2002/58/EC, Article 5(3), as amended in 2009) and its UK counterpart PECR. The cookie rule: consent before non-essential cookies and similar technologies are set (see the lesson on cookies and an honest banner; you built a banner in the lesson on heatmaps and consent). It’s implemented by the laws of member states, which differ.

The European Accessibility Act, described above. It touches those who sell to consumers in the EU.

The ADA in the US, described above. If you have customers in the US, ask an American lawyer.

US privacy laws. There’s no single federal law, but there are state laws (California’s CCPA is the best known) with thresholds on the size of the business, and the consumer’s right to opt out of the sale or sharing of data, including by Global Privacy Control.

Consumer and advertising rules follow the buyer. A consumer in the EU or UK generally keeps the protections of their own country’s consumer law even if your terms say another law governs, when your business is aimed at them (see the lesson on consumer protection).

Open the diagram, check where your visitors come from and what the site does, and see which rules are worth asking about.

Check where your visitors come from and what the site does. The map suggests which rules to ask a lawyer about. This is a guide as of 30 October 2026, not a ruling on what applies.

Where visitors come from

United States United Kingdom European Union countries Russia (for comparison)

What the site does

Collects data through a form Sets analytics and advertising cookies Sells online to people (goods or services) A commercial site open to everyone

Check what the site does.

Text alternative: from two sets of checks (where visitors come from and what the site does) the diagram shows the rules to ask a lawyer about: for the United States, state privacy laws, the FTC Act and the ADA; for the United Kingdom, the UK GDPR, PECR, the Consumer Contracts Regulations and the Equality Act; for the European Union, the GDPR, the ePrivacy Directive, the Consumer Rights Directive and the European Accessibility Act; and for Russia, 152-FZ, the advertising law and the consumer law.

Check yourself: the site is in English and its services are provided only in Riverbend. Does the GDPR reach it because of the English?

English on its own and chance visits from Europe don’t prove targeting: you must offer services or goods to people in the EU, or monitor their behavior. But if you really are attracting clients from the EU, the GDPR does reach you.

One high bar or different regimes

A small project has two possible strategies. Different regimes: show Europeans one banner, Britons another and Americans a third. That is complicated and brittle: you must work out who is from where, and maintain three sets of rules. One high bar: do for everyone what is strictest: separate consent, an equal choice in the banner, analytics after consent, WCAG AA, a clear notice. For a small site the second path is usually simpler and more honest: it covers most requirements at once, and the special cases (payment data, children, health) are added as they arise.

Practice

You’re in the era of the future, where a site is built from a brief and at once visible to people in many countries. Make an audience map for each language of your project and an accessibility statement with an honest status.

The check reads structure: that there’s a row for each language, that rules are named (for English, GDPR), that the statement has a target, a date, a status, two limitations and an email, and that the words “fully conforms” are absent. A lawyer decides whether the right rules are named for you in particular; and whether the statement is true is shown by the passes: do them first.

What used to be different

In the 2000s accessibility meant a version “for the visually impaired,” and data law was thought to be a matter for banks. Today one page falls under several regimes at once, and accessibility has become a legal requirement in the EU and the US, in the UK and in Russia for public sites. At the same time the laws of different countries increasingly look at the same things: what you collect, why, and whether a person can use it. So the best preparation is not to study each country’s rules but to build the site so that you wouldn’t be ashamed to show it to any inspector.