ADA vs. Section 508 vs. WCAG: What Each One Actually Requires (and Which Applies to Your Online Store)

If you run an e-commerce store, you’ve probably seen all three of these terms — ADA, Section 508, WCAG — used as if they’re interchangeable synonyms for “accessible enough.” They aren’t. One is a civil-rights law that can apply to your business. One is a federal procurement rule that almost certainly doesn’t. And one isn’t a law at all — it’s a technical standard the other two both lean on, in different versions, for different reasons. Mixing them up is how a store owner ends up either ignoring a real legal question or chasing a compliance requirement that was never actually theirs.

Quick answer: the Americans with Disabilities Act (ADA) Title III is a federal civil-rights law that courts have increasingly applied to private business websites, including e-commerce stores — this is the one that creates real legal exposure for an SMB. Section 508 is a separate law that binds federal agencies’ own procurement, development, and use of technology; it doesn’t apply to a private business unless that business is directly delivering technology under a federal contract, and even then the legal obligation sits with the agency, not automatically with the vendor. The Web Content Accessibility Guidelines (WCAG) aren’t a law at all — they’re a technical standard published by the W3C that both ADA-related guidance and Section 508 point to as the way to measure “accessible,” but each references a different WCAG version.

This article is educational content about how these three things relate, not legal advice. If you’ve received a demand letter or a government contract with accessibility terms attached, talk to an attorney before responding to either.

ADA Title III: the one that actually applies to your store

Title III of the ADA prohibits disability discrimination in “places of public accommodation.” The statute predates the web and doesn’t mention websites, but courts — most notably the Ninth Circuit in Robles v. Domino’s Pizza (2019) — have held it applies to business websites connected to goods and services, and the Department of Justice has taken the same public position since at least March 2022. This is the law with real teeth for a private e-commerce SMB: it’s the source of demand letters and Title III lawsuits, and it’s covered in full in our overview of ADA compliance risk for e-commerce SMBs, including who typically gets targeted and what to do about it. It doesn’t name a single mandatory technical standard for private businesses, but WCAG 2.1 Level AA is the benchmark DOJ guidance and most courts point to.

Section 508: a federal procurement rule, not a law for your store

Section 508 (29 U.S.C. §794d, part of the Rehabilitation Act) is a different statute entirely, and it’s scoped much more narrowly than most secondary sources suggest. The U.S. Access Board’s Revised 508 Standards — the actual regulatory text — define exactly who it binds. Per E201.1: “ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.” E103.4 defines “Agency” as “any agency or department of the United States as defined in 44 U.S.C. 3502, and the United States Postal Service.” That’s the whole scope: the legal obligation to conform sits with federal agencies’ own procurement, development, and use of information technology — not with private businesses, and not automatically with the vendors those agencies buy from. The standard is explicit about that second point too: E202.4 states “ICT acquired by a contractor incidental to a contract shall not be required to conform to the Revised 508 Standards.” Section508.gov puts the same scope in plain language: “The law applies to all federal agencies when they develop, procure, maintain, or use electronic and information technology.”

In practice, federal agencies do push accessibility expectations onto their vendors — through contract terms and requests for a Voluntary Product Accessibility Template (VPAT) describing a product’s conformance — but that’s a procurement mechanism the agency chooses to use, not Section 508 itself directly regulating the vendor. If your store has never sold anything to, or built anything for, a federal agency, Section 508 has no legal claim on your website at all.

One more distinction worth knowing if you ever do get asked about it: Section 508’s current binding technical standard is WCAG 2.0 Level A and AA, not 2.1 or 2.2. The Access Board’s own ICT page confirms the standard “incorporates WCAG 2.0 by reference” and that while WCAG 2.2 exists and its Understanding documents are used informationally, “Section 508 does not incorporate WCAG 2.2” into the binding regulation. The rule setting this dates to January 18, 2017. So a federal agency asking a vendor for “Section 508 compliance” is, technically, asking about a 2017-era standard — a full WCAG version behind what DOJ now requires of state and local governments (below), and behind the version most private-sector legal guidance and this site’s own audits target.

ADA Title II: a third track, for government websites specifically

There’s a third, separate rule worth knowing about only because it’s easy to confuse with the other two: in April 2024, DOJ issued a final rule under Title II of the ADA — a different title than the Title III that applies to private businesses — requiring state and local government websites and mobile apps to conform to WCAG 2.1 Level AA. Per DOJ’s own fact sheet, this “applies to all state and local governments… as well as special purpose districts, Amtrak, and other commuter authorities.” It doesn’t touch private e-commerce businesses at all. Its original compliance deadlines have also moved: an Interim Final Rule DOJ published in April 2026 pushed the deadline for entities with a population of 50,000 or more from April 2026 to April 26, 2027, and the deadline for smaller entities and special districts from April 2027 to April 26, 2028. The substantive WCAG 2.1 AA requirement itself didn’t change — only the timeline did.

The one thing all three actually share

None of the three legal/regulatory tracks above is identical to another, but they all point back to the same underlying technical standard — WCAG — just at different versions and levels:

	Who it binds	Technical standard referenced	Applies to a private e-commerce store?
ADA Title III	Private businesses (“places of public accommodation”)	No single mandated version; WCAG 2.1 AA is the widely cited benchmark	Yes — this is your actual exposure
Section 508	Federal agencies’ own ICT procurement/use	WCAG 2.0 Level A/AA (2017 rule)	No, unless you’re directly delivering ICT under a federal contract
ADA Title II	State and local governments	WCAG 2.1 Level AA	No — governments only

That convergence is exactly why building to WCAG 2.1 AA is the practical move regardless of which acronym someone throws at you: it satisfies the benchmark DOJ points to for Title III, it exceeds Section 508’s 2017-era WCAG 2.0 floor if a federal buyer ever does ask, and it matches what governments themselves are now required to meet.

FAQ

A government agency or enterprise buyer asked for our VPAT. Do we need one? Only if you’re selling technology (software, a website, an app) to that entity as part of a contract — a VPAT is a procurement document, not a general legal requirement. If you’re a standard consumer-facing e-commerce store with no federal or government sales relationship, you’re very unlikely to ever legitimately need one, though a vendor’s procurement team may not always explain why they’re asking.

If we meet Section 508 (WCAG 2.0 AA), does that protect us from an ADA Title III claim? Meeting WCAG 2.0 AA is a real, meaningful baseline, but it’s the older, narrower version — WCAG 2.1 added criteria (like reflow at 400% zoom and several mobile-relevant rules) that 2.0 doesn’t cover at all, and that’s the version DOJ and most courts reference now. Treat 2.0 AA conformance as a floor to build past, not a finish line.

Is “WCAG compliant” the same as “ADA compliant” or “Section 508 compliant”? No — WCAG is a technical standard with conformance levels (A, AA, AAA); it isn’t itself a law, and there’s no official government certification for any of these terms. “ADA compliant” and “Section 508 compliant” are shorthand people use loosely; what actually exists is a website that does or doesn’t conform to a specific WCAG version and level, evaluated against a specific legal framework’s requirements.

Build to the standard that covers the most ground

Since WCAG 2.1 AA is the benchmark that satisfies the broadest set of these tracks at once, it’s the standard worth targeting even if you never sell to a government buyer. Quietramp’s $890 one-time audit is a human-verified WCAG 2.1 AA review — not a legal opinion, not a compliance certificate, just documented, developer-actionable findings, with $99/month optional re-monitoring after fixes ship. See a real sample report or check pricing.

---

This is provided for general educational purposes and does not constitute legal advice. Regulatory text and guidance described here reflect the sources cited as of this article’s publish date and may change; consult a qualified attorney for guidance specific to your business and any contracts you hold.