Accessibility laws · United States (federal)

Section 508 of the Rehabilitation Act

Section 508 binds federal departments and agencies, plus the United States Postal Service, and nobody else. Taking federal money does not pull you in. What pulls you in is selling to the government, because an agency has to buy accessible technology, and a product that cannot document how it measures up does not get considered. The standard has been WCAG 2.0 Level AA since January 2018, and unlike nearly everything else on this site, it has not moved since.

WCAG incorporated: 2.0 AA
Compliance required since: 2018
Required in procurement: ACR
The one non-agency it binds: USPS

What the law is

Section 508 of the Rehabilitation Act tells every federal department and agency, the United States Postal Service included, to make the technology it buys, builds, maintains, or uses accessible to people with disabilities. Technology means more than the website. Internal tools, software, documents, video, and physical kiosks are all inside it, so the rule touches nearly everything an agency does digitally. Two things sit outside it. National security systems are excluded outright. And where full compliance would be an undue burden on the agency, the duty changes shape rather than disappearing. The agency still has to get the same information and data to people with disabilities by some other means.

The 2017 refresh of the standards wrote WCAG 2.0 Level A and Level AA into the regulation by direct reference. It has three dates and they get merged into one constantly. It was published on January 18, 2017. It was scheduled to take effect on March 20, 2017, and a regulatory freeze pushed that by a day to March 21. Compliance was not required until January 18, 2018, one year after publication, and that last one is the date that matters to you. That is not a guideline to weigh up. It is the legal text itself, which is why an agency conformance finding cites a success criterion by number. It still says WCAG 2.0 in August 2026. That is the awkward part. The DOJ Title II rule moved to WCAG 2.1 Level AA in 2024, and the HHS Section 504 rule landed on WCAG 2.1 Level AA too. Sell to a federal agency and a state agency in the same quarter and you are testing against two versions of the same standard for two arms of the same government.

One more thing came out of that same rulemaking, and it catches a completely different audience. The Access Board also issued Revised 255 Guidelines, under Section 255 of the Communications Act, covering telecommunications equipment and customer premises equipment. Different law, different readers. It reaches manufacturers who never sell a thing to a federal agency, and the two regimes share the technical chapters they are both built on.

Where Section 508 actually bites is procurement. An agency is required to buy accessible technology, so a vendor has to write down what its product does and does not do. That document is an Accessibility Conformance Report, an ACR, and it is built on a template called a VPAT that the Information Technology Industry Council maintains. The word voluntary in that template's name is doing no work at all. Section508.gov says outright that completing an ACR is not voluntary if you want the government to consider buying your product. The current template is VPAT 2.5Rev, dated April 2025, and it comes in four editions matched to different markets, one for Section 508, one for WCAG, one for the EU, and one international. A weak ACR usually knocks you out of a bid before anyone evaluates the product on its merits, though the government's own guidance is careful to say the VPAT format itself is not mandatory and that a non-conforming product can still be bought in the right circumstances. A false ACR is worse than a weak one, because it is a written claim about your product that a buyer can check and hold you to.

This applies to you if…

You are a federal department or agency, or the United States Postal Service. Those are the bodies the statute names, and the standards cover the information and communication technology your agency procures, develops, maintains, or uses.
You build and run digital services for a federal agency. The duty belongs to the agency, and it arrives at your desk through the contract and through the conformance documentation the agency has to collect before it buys anything.
You sell software, SaaS, hardware, or content to the federal government. The request for an ACR or a VPAT usually turns up during procurement, before a contract is signed. What to do first when a customer asks for a VPAT is the triage for that email, including the questions to send back before you commit to a date.
You run a state program under a "little 508" statute that copies the federal standards. Or you run one under the Assistive Technology Act, which funds a state only if it assures that its programs will comply with Section 508. Those two routes are the only way Section 508 reaches a body that is not federal, and the second one is how most public universities end up doing this work. Taking federal money does not do it on its own, because Section 508 binds federal departments and agencies and nothing else. Section 504 is the provision that follows the money, and its duty reaches organizations that receive federal financial assistance across healthcare, education, and social services.

What it technically requires

Your web content and your electronic documents have to conform to WCAG 2.0 Level A and Level AA. That standard is incorporated into the Section 508 requirements word for word rather than paraphrased into them.
Where the technical provisions do not address a function of the technology, the functional performance criteria fill the gap instead, and there is a separate requirement that software work with assistive technology like screen readers.
Legacy systems get a real safe harbor, and it is worth knowing before you budget a remediation project. Existing technology that met the older pre-2018 standards, and that has not been altered on or after January 18, 2018, does not have to be brought up to the revised standards. Touch it and the safe harbor drops, and the revised standards apply to it from then on.
If you are a vendor, an honest ACR backed by real testing is what makes the document survive contact with a buyer. Write it from a scan export and it will claim things a screen reader test contradicts in five minutes. Write it from an actual audit and you can defend every line, which is the only position worth being in when a contracting officer asks a follow-up question. Where the product does not conform yet, the plan goes in a separate document, and the roadmap guide sets out what federal buyers treat a remediation plan as, which is supporting information rather than a substitute for the report.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

How it is enforced

Any individual with a disability can file a complaint with the agency at fault and bring a civil action under the Rehabilitation Act. That right belongs to members of the public, not only to federal employees, and the complaint goes to the department or agency accused of falling short. It has a boundary written into the statute that almost nobody quotes. The complaint route reaches only technology the agency procured on or after the date the Access Board's original standards took hold. Older kit it simply kept running sits outside that door.

The Attorney General has owed the President and Congress a report on federal compliance every two years since the late 1990s. In practice the DOJ went more than a decade without publishing one and resumed in February 2023, which was news in itself. The Consolidated Appropriations Act of 2023 then required agencies to assess and report on their own efforts annually. That turned the Governmentwide Section 508 Assessment into a yearly statutory product rather than an initiative that could quietly lapse. The DOJ now files its part as an addendum inside it.

Those assessments are public. They do not read well. The FY2024 assessment drew on 245 reporting entities and found that about a third or fewer of the top-viewed federal websites, documents, and videos are fully conformant. Its governmentwide conformance index came in at 1.74 on a five-point scale, down from 1.79 the year before, and intranet conformance fell from 59 percent to 52 percent. The FY2025 assessment, published March 5, 2026 and drawing on 212 agencies and components, said the federal government continues to fall short of its legal and statutory obligations to ensure equal access. The same report counts over 70 million US adults with disabilities and 2.16 billion visits to federal websites in a single month. If you sell into this market, that is the scoreboard your buyer is measured against.

For vendors, enforcement runs through the market rather than the courts. Section 508 requirements sit inside the Federal Acquisition Regulation, the rulebook for federal buying. A product that cannot document conformance gets screened out of a purchase long before any court would look at it. There is a lawful route around that. You should know it exists. An agency can buy non-conforming technology where the market genuinely offers nothing better, but only with a written determination describing the market research it did and naming which standards cannot be met. Knowing that document exists changes how you negotiate.

Key dates

Jan 18, 2017Revised 508 standards published (the refresh)
Mar 21, 2017The rule takes effect, a day later than originally scheduled
Jan 18, 2018Compliance required: WCAG 2.0 AA in force for federal ICT

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.