Accessibility and privacy compliance deadlines, 2025–2028
Every date here is checked against a cited source, usually the Federal Register or the statute itself. Some have passed, two federal timelines moved in 2026, and the rest are close enough to plan for now.
The dates, in order
Dates marked in effect have already passed. Countdowns show the days remaining until each of the others.
June 28, 2025Businesses selling covered products and services to EU consumers
European Accessibility Act applies
EU member states must apply the European Accessibility Act from June 28, 2025. It covers e-commerce and other consumer services; microenterprises that provide services are exempt from the service requirements.
In effectsince June 28, 2025
January 1, 2026Businesses meeting the KCDPA thresholds
Kentucky Consumer Data Protection Act takes effect
Kentucky's privacy law took effect January 1, 2026. The Attorney General enforces it and must allow a cure period of 30 days after written notice.
In effectsince January 1, 2026
April 20, 2026State and local governments
Title II extension published
The Justice Department published an interim final rule on April 20, 2026, extending both Title II web and mobile app compliance dates by one year. The technical standard did not change.
In effectsince April 20, 2026
May 11, 2026Recipients of HHS federal financial assistance
Section 504 extension published
HHS published its own interim final rule on May 11, 2026, extending its Section 504 web and mobile app compliance dates by one year. The standard remains WCAG 2.1 Level AA.
In effectsince May 11, 2026
January 1, 2027Websites and apps with California visitors
California ends private pen-register suits over tracking
Under SB 690, signed September 30, 2026, private lawsuits under CIPA's pen-register provision over website and app tracking end on January 1, 2027, leaving those claims to the Attorney General. Private wiretapping claims remain available.
61days away
April 26, 2027State and local governments, 50,000+ residents
Title II compliance date for larger public entities
Public entities with a total population of 50,000 or more must meet WCAG 2.1 Level AA for web content and mobile apps by April 26, 2027.
176days away
May 11, 2027HHS-funded recipients with 15 or more employees
Section 504 compliance date for larger recipients
Recipients of HHS federal financial assistance with 15 or more employees must meet WCAG 2.1 Level AA for web content and mobile apps by May 11, 2027.
191days away
April 26, 2028Public entities under 50,000, and special districts
Title II compliance date for smaller public entities
Public entities with a total population under 50,000, and all special district governments, must meet the standard by April 26, 2028.
542days away
May 10, 2028HHS-funded recipients with fewer than 15 employees
Section 504 compliance date for smaller recipients
Recipients with fewer than 15 employees must meet the standard by May 10, 2028.
556days away
Day counts were verified on November 1, 2026 and refresh when the page loads. They are planning aids, not legal advice.
A deadline is not a starting line
The Title II and Section 504 dates have already moved once, and it is tempting to read the extra year as permission to wait. The work doesn't fit that plan. A public website typically needs an inventory, an audit, fixes across templates and documents, follow-up with vendors, and training for the people who publish, all before the date. Vendor fixes in particular run on someone else's release schedule, and you can't speed them up by asking louder.
Starting late doesn't just compress the schedule. It removes the time to fix what the audit finds in systems you don't control, and it leaves no room to verify that the fixes work with real assistive technology.
The date is not a finish line, either. Content changes every week, and a site that conforms in April can drift by June. The organizations in the best position on the day will be the ones with trained editors and monitoring in place, not the ones holding a clean report from last year.
Working backward from your date
A realistic plan for a mid-sized public website, counted back from the compliance date. Larger estates need more lead time, not less.
Eighteen to twelve months out: inventory and audit
Map every domain, subdomain, document library, and vendor system, then audit the templates and journeys that matter most.
Twelve to nine months out: fix shared templates and components
Template and component fixes clear the most pages per change, so they go first, with vendor issues logged and raised in parallel.
Nine to six months out: documents and vendors
Remediate, convert, or retire documents, and follow up on vendor commitments with dates attached.
Six to three months out: verify and train
Retest fixes with assistive technology, train editors and content owners, and publish an accessibility statement with a way to report barriers.
From the date on: monitor
Weekly scans and periodic manual checks catch regressions before residents, patients, or customers do.
Which rule applies to you
| Organization | Rule | Standard | Date |
|---|---|---|---|
| State and local governments, 50,000 or more | ADA Title II web and mobile app rule (DOJ) | WCAG 2.1 Level AA | April 26, 2027 |
| Public entities under 50,000; special district governments | ADA Title II web and mobile app rule (DOJ) | WCAG 2.1 Level AA | April 26, 2028 |
| HHS-funded recipients, 15 or more employees | Section 504 web and mobile app rule (HHS) | WCAG 2.1 Level AA | May 11, 2027 |
| HHS-funded recipients, fewer than 15 employees | Section 504 web and mobile app rule (HHS) | WCAG 2.1 Level AA | May 10, 2028 |
| Federal agencies and the technology they buy | Section 508 | WCAG 2.0 Level AA | Already in force |
| Businesses selling to EU consumers | European Accessibility Act | National laws based on the act; EN 301 549 maps to WCAG for web content | June 28, 2025 |
| Businesses meeting Kentucky's privacy thresholds | Kentucky Consumer Data Protection Act | Privacy notice, consumer rights requests, and opt-outs | January 1, 2026 |
| Private businesses open to the public | ADA Title III | No web regulation; settlements usually reference WCAG AA | No set date |
The sources behind the biggest dates
is the ADA Title II web and mobile app compliance date for state and local governments with a total population of 50,000 or more
U.S. Department of Justice, Interim Final Rule, 91 FR 20902 (FR Doc. 2026-07663)is the Section 504 web and mobile app compliance date for HHS-funded recipients with 15 or more employees
U.S. Department of Health and Human Services, Interim Final Rule, 91 FR 25496 (FR Doc. 2026-09266)is the date from which EU member states must apply the European Accessibility Act (Directive (EU) 2019/882), which covers products and services, including e-commerce, on the EU market
Directive (EU) 2019/882 of 17 April 2019 (European Accessibility Act), Article 31(2), EUR-Lexis when the Kentucky Consumer Data Protection Act (KRS 367.3611 to 367.3629, enacted as 2024 HB 15) took effect
Kentucky General Assembly, 2024 Ky. Acts ch. 72 (HB 15), Section 12These dates have moved before
The Title II and Section 504 compliance dates were each extended by one year in 2026 through interim final rules, and further changes are possible. We check every date against its primary source and update this page when a rule changes. It is a planning aid, not legal advice; confirm what applies to your organization with your attorney.
Questions about the dates
Did the 2026 extensions change the technical standard?
No. Both interim final rules changed only the compliance dates. The Title II rule still requires WCAG 2.1 Level AA, and the HHS Section 504 rule still requires WCAG 2.1 Level AA.
We're a private company. Do any of these dates apply to us?
Possibly. Private businesses aren't covered by the Title II rule, but they may be covered by Section 504 if they receive HHS funding, by the European Accessibility Act if they sell to EU consumers, or by Kentucky's privacy law if they meet its thresholds. ADA Title III has no deadline because it already applies, so claims can be filed at any time.
How do we know which Title II date applies to us?
The rule uses Census Bureau population estimates to set each public entity's total population, with specific provisions for independent school districts. Special district governments get the later date regardless of size. Check your entity's population against the rule's definition with counsel.
Why is a California law on this page?
Because it changes the risk around tracking pixels for any website with California visitors. SB 690 ends private pen-register claims under CIPA but leaves wiretapping claims available, so knowing what your tags send and when still matters. Our article on pixels that fire too early explains how to check.
Keep reading
Tell us what your website needs to do.
Send a link and a sentence about your deadline. You will hear back from a person within one business day, usually with a short list of questions and a proposed scope.