ADA Compliance Audits in 2026: What Auditors Actually Check First

Last updated: September 26, 2026. This guide is general information based on public records and TestParty's observations across real matters — it is not legal advice. Consult a licensed attorney about your specific situation.

An ADA compliance audit tests a website the way a plaintiff's expert will: it prioritizes the barriers that actually show up in complaints, on the pages where a damages theory lives. That is what separates it from a pure WCAG conformance evaluation, which grades all 55 Level A and AA criteria evenly. This page covers what an ADA-focused auditor checks first, why the sequence differs, and what the report has to prove.

Key numbers: Plaintiffs filed 3,117 federal website accessibility lawsuits in 2025 — a 27% jump from 2,452 in 2024, and 36% of all ADA Title III federal filings (Seyfarth Shaw). Ecommerce accounts for 69–77% of digital accessibility suits (Seyfarth Shaw). In 2026, 95.9% of the top one million home pages had detectable WCAG 2 failures, averaging 56.1 errors per page (WebAIM Million 2026). California's Unruh Civil Rights Act attaches statutory damages of no less than $4,000 per violation (Cal. Civ. Code § 52). As of August 2026, TestParty has remediated 35 million+ accessibility issues across customer stores, and in the history of the company fewer than 1% of customers have been named in accessibility-related lawsuits while on the platform.

What makes an audit "ADA-focused" instead of just a WCAG check?

An ADA-focused audit is a legal-risk assessment that happens to use WCAG as its yardstick. It asks a different question than a conformance audit: not "how does this site score?" but "what would a plaintiff's expert screenshot, and how bad does it look?"

Both audits test against WCAG 2.2 and both should find the same defects eventually. The difference is ranking and framing. A conformance audit weights criteria by the standard's own structure and reports a clean pass/fail per criterion — the right deliverable for a procurement reviewer or an ACR signature, and the tier our WCAG audit methodology guide covers in detail. An ADA audit weights findings by litigation exposure: how often the barrier appears in filed complaints, whether it blocks a transaction, and how easily a non-technical reader — a judge, an insurer, opposing counsel — can be shown that it blocks one. A missing `alt` attribute on a decorative footer icon and an unlabeled checkout submit button are both 1.1.1 or 4.1.2 failures. Only one of them ends a purchase.

The plaintiff's-eye checklist: what complaints allege and where experts test

Website accessibility complaints are remarkably repetitive. Seyfarth Shaw characterizes the core allegation as sites that "were not designed to be accessible and/or work with assistive technologies," and the specific barriers recycled through public complaint language cluster into six or seven families.

+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
|          What complaints typically allege          |              Where an expert tests it              |              WCAG criteria behind it               |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
|    The site cannot be used with a screen reader    |   Home, search results, product detail, checkout   | 1.1.1 Non-text Content; 1.3.1 Info and Relationships; 4.1.2 Name, Role, Value |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
| Menus and controls cannot be operated by keyboard alone |   Global nav, mega-menu, search, filters, modals   | 2.1.1 Keyboard; 2.4.3 Focus Order; 2.4.7 Focus Visible |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
| Focus gets trapped in a promotional or email-capture popup | Home page on first load, size-guide and quick-view modals |     2.1.2 No Keyboard Trap; 2.4.3 Focus Order      |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
|      Images lack meaningful alternative text       | Hero banners, collection grids, product galleries  |               1.1.1 Non-text Content               |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
| Form fields are unlabeled and errors are never announced | Cart, checkout, account creation, contact and returns forms | 1.3.1; 3.3.1 Error Identification; 3.3.2 Labels or Instructions; 4.1.3 Status Messages |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
|   Prices, badges, and disclaimers are illegible    | Product detail pricing, sale badges, shipping notices | 1.4.3 Contrast (Minimum); 1.4.11 Non-text Contrast |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+
|           Video content has no captions            |     Home page brand video, product demo video      | 1.2.2 Captions (Prerecorded); 1.2.3 Audio Description or Media Alternative |
+----------------------------------------------------+----------------------------------------------------+----------------------------------------------------+

Read the middle column carefully — it is the part most audits get wrong. Experts do not test a random sample of blog posts. They walk the path a shopper walks: land, search, view a product, add to cart, check out. In TestParty's monthly expert audits of ecommerce stores, the single most damaging finding automation never flags sits at the end of that path: a checkout error that renders visually but is never announced, so a screen-reader user hears silence after a declined card. That is a 4.1.3 failure on paper and a completed-transaction blocker in a complaint.

How does an ADA audit sequence differently?

An ADA audit runs the revenue path first and the marketing pages last, inverting the alphabetical or template-order sweep that conformance audits often default to.

Three sequencing rules follow from the legal lens. Transaction paths lead. Cart and checkout get tested before the blog, because a barrier that prevents purchase supports both the "denied access to goods and services" allegation and the damages theory attached to it. States count as pages. An empty cart, a cart with items, a validation-error state, an open modal, and the 200%-zoom view of each are separate tests; complaints frequently describe error states, and error states are where automated scanners have the least coverage. The highest-frequency defect classes get swept sitewide, not sampled. Missing alt text and unlabeled inputs appear in nearly every complaint, so an ADA auditor counts them across every crawlable page rather than extrapolating from a sample — a plaintiff's scanner will.

What does "documentation orientation" mean in practice?

Every finding in an ADA audit is written as though it may become evidence: dated, located in code, described in plain language, and tied to a named success criterion.

That discipline changes how findings read. A conformance note saying "contrast insufficient on PDP pricing" becomes a record with a date, a URL, a CSS selector, measured values (#9B9B9B on #FFFFFF, approximately 2.8:1), the criterion and level, the user impact in one sentence, and the fix. It also changes what gets kept: the dated report itself, the scan outputs behind it, and the remediation log that follows. In one public TestParty matter, documented remediation supported settling a $74,999 demand for $2,000 (Dorai Home); in another, a matter was dismissed at $0 (Joanna Vargas). The audit did not produce those outcomes on its own — the paper trail did. Our guide to what accessibility records to keep on file covers retention, ownership, and what counsel asks for first.

What legal standard is the audit measuring against in 2026?

There is still no ADA Title III regulation specifying a technical standard for private-sector websites. Courts, DOJ settlements, and DOJ guidance point to WCAG anyway — most often 2.1 Level AA, increasingly 2.2 AA.

The Department of Justice's web accessibility guidance takes the position that Title III applies to the websites of public accommodations without prescribing a single conformance level, and the Title II rule for state and local government codified WCAG 2.1 AA — a benchmark private defendants now see cited by analogy. Practically, auditing to WCAG 2.2 AA covers 2.1 AA plus nine newer criteria, so the safer scope is also the simpler one. State law is the bigger variable. California's Unruh Act carries a $4,000 statutory minimum per violation, while New York's State and City human rights laws add compensatory damages the federal ADA — which provides injunctive relief and fees, not damages — does not. Venue, not standard, is usually what determines the size of the number in the letter.

What do you get, and what does it cost?

An ADA audit deliverable is a dated report with a scope statement, a findings register mapped to WCAG, severity and legal-risk rankings, evidence, and a prioritized remediation plan — plus a re-test after fixes ship.

Ask to see a sample before you sign; our annotated audit report walkthrough shows what each section should contain and what a thin report leaves out. On price, published agency rates as of August 2026 put hybrid audits (automated pass plus expert testing on key templates) at roughly $1,000–$5,000, and full manual expert audits at roughly $3,000–$15,000 or more for a mid-size ecommerce site. Timelines run about one to three weeks for hybrid work and two to six weeks for full manual audits; a focused post-letter triage — revenue path only, findings first, formatting later — is normally scoped at the low end and delivered in days. Note what the price does not buy: automated tooling detects roughly 60–70% of issues in TestParty's audit work, so any quote built purely on scan output is pricing a third of the job. Audit types, sampling method, and deliverables are covered in full in our accessibility audit reference.

When should you commission one?

Four situations justify the spend, and each one changes the scope.

• Pre-emptively. The cheapest version. Full WCAG 2.2 AA scope, normal timeline, and the resulting dated report becomes your baseline record — the thing that proves what you knew and when.
• After a demand letter. Scope narrows to the pages the letter names plus the entire transaction path, and speed beats completeness. Coordinate with counsel first; the sequencing and negotiation dynamics are covered in our ADA demand letter guide.
• Before a redesign or replatform. Audit the current site to build the accessibility requirements into the brief. Retrofitting a new theme costs more than specifying it.
• After a settlement. Settlements usually commit you to a remediation timeline. A dated audit at each milestone is what demonstrates compliance with the agreement, and missing a milestone can reopen the matter.

What happens after the audit?

An audit is a diagnosis, not a treatment — and undisputed proof you knew about the barriers. Remediation, monitoring, and documentation are what convert a findings list into a defensible position.

Three things follow a good audit. Remediation, fixed in source code and ordered by legal risk rather than ticket count. Monitoring, because sites regress: a new app, a theme update, or a seasonal banner reintroduces failures within weeks. And documentation — dated reports, remediation logs, and re-test evidence filed where counsel can reach them in an afternoon. In TestParty's work across 100+ brands, the pattern that holds is unglamorous: continuous fixing plus dated records beats a thicker report every time. An audit that sits unactioned for a year is the worst of both worlds — it establishes notice without establishing progress.

Frequently Asked Questions

Is there such a thing as ADA certification for a website? No. No government agency certifies websites as ADA compliant, and any vendor selling a certificate or badge is selling something that has no legal standing. What exists is evidence: a dated audit against WCAG 2.2 AA, a remediation record, and re-test results. That file is what counsel uses; a badge is not.

Will an ADA audit stop lawsuits? No. An audit finds barriers; it does not remove them, and plaintiff firms scan live sites, not reports. What changes outcomes is documented remediation. In one public TestParty matter, a $74,999 demand resolved at $2,000 with a remediation record in hand (Dorai Home). An unactioned audit can arguably make things worse by establishing that you knew.

Should the audit target WCAG 2.1 AA or 2.2 AA? Audit to 2.2 AA. It is a superset of 2.1 AA, so you satisfy the standard most often cited in settlements and DOJ guidance while covering nine newer criteria on focus appearance, dragging movements, target size, and redundant entry. There is no scenario where conforming to 2.2 AA weakens your position under 2.1 AA.

Can an automated scan serve as my ADA audit? Not on its own. Automated tooling detects roughly 60–70% of issues in TestParty's audit work, and the blockers that anchor complaints — keyboard traps, unannounced checkout errors, meaningless alt text like `alt="IMG_4471"` — sit in the other 30%. Scans are excellent for triage, budgeting, and continuous monitoring between deeper audits.

Should my attorney commission the audit? Ask counsel before you order one, especially if a letter has already arrived. In some circumstances, work performed at an attorney's direction is treated differently than a report you commissioned yourself, and that call belongs to your lawyer. It is a five-minute conversation that can change how the report is scoped and shared.

Does my site need an audit if it is on Shopify? Platform does not confer compliance. Shopify's theme requirements cover roughly 16–22% of WCAG criteria, and based on TestParty's analysis, the Dawn theme ships with 30–100 detectable violations out of the box while premium themes carry 100–350. Third-party apps are not reviewed for accessibility, and app-injected markup is a recurring source of blockers.

This article was produced using TestParty's cyborg approach — AI-assisted research and drafting, validated and refined by our accessibility team. The analysis above represents TestParty's editorial opinions based on publicly available data. As a competitor in the accessibility market, we have a point of view — but we've cited our sources so you can verify every claim independently.