Accessibility laws · Colorado, US

Colorado HB21-1110

Colorado was the first US state to back a digital accessibility standard with statutory damages a private person can collect, which is why other states keep pointing at it. The figure everybody quotes is $3,500. The one nobody quotes is the sentence sitting next to it, because the statute counts a single digital product as a single violation. One website is one violation, not one per barrier. And compliance itself is more forgiving than either number suggests. A public entity that publishes a technology accessibility statement and can show real progress on a plan counts as compliant, even where its technology does not yet fully conform.

Per violation, per person: $3,500
WCAG in state standards: 2.1 AA
Enacted: 2021
Full enforcement: Jul 2025

What the law is

This law comes in three layers, and keeping them apart is the only way it makes sense. The statute is where the duty lives. House Bill 21-1110, passed in 2021, put it plainly. Under Colorado law it is discrimination for a public entity or state agency to fail to fully comply with the accessibility standards the state sets. The date it fixed for that was July 1, 2024. Senate Bill 23-244 then gave the Office of Information Technology, the OIT, explicit authority to write and update those standards. The rules the OIT wrote are the second layer, and they are where you find out what compliance actually means. House Bill 24-1454 is the third, and what it added was a time-limited immunity rather than a later deadline. The July 1, 2024 date never moved.

Covered means public entity, which Colorado defines the way the Americans with Disabilities Act does. Any state or local government, or any department, agency, special district, or other instrumentality of one. Cities, counties, state agencies, K-12 school districts, and public colleges and universities all sit inside that. So do special districts, which is the category people forget until one of them gets a complaint about its website. The law reaches vendors as well, though it does that indirectly. A public entity has to buy technology that meets the standard, so any software or content supplier selling into Colorado government inherits the requirement through the contract.

The standard is WCAG 2.1, Level A and Level AA, and there is a trap in how you arrive at it. The statute tells the state's Chief Information Officer to write rules based on the most recent WCAG the W3C has published, which would point at WCAG 2.2, a W3C Recommendation since October 2023. The rules did something else. They incorporate WCAG 2.1 conformance levels A and AA as published on September 21, 2023, expressly excluding any later amendments or versions. So read the statute on its own and you would conclude WCAG 2.2 applies in Colorado. It does not. WCAG 2.1 does, at both levels.

This applies to you if…

You are a Colorado state or local public entity. That covers departments, agencies, special districts, and other instrumentalities of state or local government, along with K-12 school districts and public institutions of higher education.
You sell digital products or services to Colorado public entities. The WCAG 2.1 standard runs straight into their procurement, so it lands in your contract whether or not you would have chosen to meet it.
You build public-facing tools for those entities, including portals, payment systems, forms, or apps. It makes no difference whether you think of yourself as a government vendor or as a software company that happens to have one as a customer.
You run internal systems for a covered entity. The rules cover internal-facing technology alongside public-facing, which puts a staff intranet and an HR portal under the same standard as the city website.

What it technically requires

Conformance runs to WCAG 2.1 Level A and Level AA, and the scope is far wider than websites. The rules reach all information and communication technology a public entity procures, develops, maintains, or uses, internal-facing as well as public-facing. That list names websites, applications, kiosks, digital signage, digital documents, video, audio, and third-party tools the entity owns or controls. It also reaches the parts of hardware that transmit information to a user or carry a user interface. The PDF board packet, the lobby kiosk, the meeting recording, and the staff intranet are all inside it.
The rules apply to technology in active use on or after July 1, 2024, and to anything newly created, developed, acquired, or purchased after that date. For technology that is not in active use, they apply when you alter or update it, or when a person with a disability asks for an accessible version. Active use has a tighter meaning than most people expect, covering the authorized official version rather than previous versions still sitting on the server, archives, working products, or drafts. That is Colorado's archive exception, and it is more generous than the federal ones, because it asks nothing about designated archive areas or whether the file has changed since.
Publish a technology accessibility statement, in a conspicuous place, and treat this as the cheapest item on your list. Rule 11.6 wants four things in it. A commitment to accessibility, with a description of the progress and the effort you are actually making. A commitment to respond in good time. A prominent notice offering more than one way to reach you, where an accessible feedback form, an email address, or a toll-free number with TTY all count. And your existing grievance procedure, plus the people in your organization who know about access. A generated contact page misses half of that. Written properly, one page meets a hard requirement on its own. It is also the first ingredient in the compliance route below.
Full conformance is one way to comply and not the only way, which is the part most coverage of this law gets wrong. A public entity whose technology does not fully conform is still in compliance where it posts that accessibility statement and meets at least one of five further requirements. Substantially equivalent access, with accommodations where they are needed, is one. Providing accommodations plus evidence of good-faith progress on a plan to remove barriers across your inventory of technology is another. Procuring the technology that best meets both the standards and your business needs, again with accommodations, is a third. A conforming alternate version is the fourth. Undue burden, fundamental alteration, or direct threat is the fifth. The statutory immunity that House Bill 24-1454 created did expire on July 1, 2025. This structure did not, and it was never time-limited.
If the progress route is your route, the plan is the deliverable, and the rules describe what a real one contains. Annual progress updates that actually show movement. A prioritized inventory of your technology, ranked by legal requirements, user impact, usage numbers, and how central the thing is to the program it serves. The steps you are taking to remove barriers. Timelines for the inaccessible items, with an interim accommodation plan for the people waiting on them. And a policy for testing and remediating regularly rather than once. Write that down and you are inside a recognized route to compliance. Skip it and that route is not open to you.
Undue burden is the fifth of those routes and it has a defined test, which is not the same as a feeling that the money is not there. Rule 11.10 asks you to consider all resources available to the program or component the technology is being bought, built, maintained or used for. Three circumstances qualify. Resources are not readily available, or using them would fundamentally alter the program. A contractual, legal, regulatory or technical constraint stops you modifying the thing. Or the auxiliary aids you would need are not feasibly available. Direct threat is narrower again, and it needs an individual assessment of the nature, duration and severity of the risk, the probability of injury, and whether a modification would reduce it. Then comes the part people miss. A finding of undue burden is not an exit. You still take whatever other reasonable action is open to you, and you cannot send the bill to the person who needed it, because the rules say a public entity cannot require somebody with a disability to pay for the measures that give them nondiscriminatory treatment.
Two regimes, one website. The Colorado rules say themselves that complying with them does not necessarily mean you comply with other laws, and the other law here is federal. Nearly every Colorado public entity is also covered by the DOJ Title II rule. That one requires WCAG 2.1 Level AA by April 26, 2027 from an entity whose Census population is 50,000 or more, and by April 26, 2028 from everyone else, including every special district government. Same website, two clocks, two different exception lists. Neither one is simply the stricter of the two, because the federal rule is harder on conformance while Colorado's reaches more of your technology and adds the statement duty. Plan against both.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

This law expects a published accessibility statement, and regulators check for it first. Generate yours free →

How it is enforced

A person with a disability who's affected can sue directly. The remedies are a court order requiring a fix, plus either actual monetary damages or a statutory fine of $3,500 payable to each plaintiff for each violation. Read that as an either-or, because that is how the statute writes it. One or the other, not both.

Now the part that changes the arithmetic. The statute says a violation occurring on a single digital product counts as a single incident rather than as separate violations. One website is one violation. Find forty WCAG failures on it and the count is still one. That does not make the exposure small. The fine is payable to each plaintiff, and a large entity runs many separate digital products. But it is a completely different shape from the per-barrier math people reach for when they see $3,500.

A small business defendant gets a fifty percent reduction in the statutory fine for correcting the violation within thirty days, unless it knowingly or intentionally created the barrier. Small business here means twenty-five or fewer employees and no more than $3,500,000 in annual gross income. A public entity is not a small business, so this one will not help a city. It sits in the same remedies section and it matters to vendors facing a claim under other parts of the same statute.

Vendors risk the contract itself. A covered entity that buys inaccessible technology takes on its own exposure the moment it signs, so the safer commercial decision for the agency is usually a different supplier.

The statutory immunity ran out on July 1, 2025, which means a claim that would have been blocked before that date can be brought now. Here is the honest position on what has happened since. We could not find a single named case, complaint, or agency action brought under this statute. Plenty of compliance guides warn that districts and municipalities could face penalties. None of them point at one that has. So treat this exposure as real and untested, which is a different thing from a wave of litigation.

Key dates

Jul 1, 2024Compliance date under HB21-1110
Jul 1, 2025HB24-1454 grace period ends: full exposure begins

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.