California ADA Website Compliance 2026: Unruh and 8 Tools

California has no statute setting a technical accessibility standard for private websites. As of November 2026, the pressure comes from the Unruh Civil Rights Act, which treats an ADA violation as an Unruh violation and carries a minimum of $4,000 per violation, plus case law on when a website counts as covered. Two bills that would have written a standard into state law, AB 1757 and AB 2190, both stalled. What follows covers the rule, the bills, who is exposed, what overlays and scanners can and cannot prove, eight tools compared, three scanner verdicts on this site, and a 30-day plan.

The short answer: no statute, real exposure

Most pages ranking for this topic say California has the strictest web accessibility law in the country. The line is tidy. It isn't quite accurate. No California statute tells a private business which technical standard its website must meet. What exists is a federal civil rights law, the ADA, a state civil rights law, Unruh, that adopts ADA violations as its own and attaches money to them, and a handful of appellate decisions about when a website is covered at all. The standard everyone argues about, WCAG, comes from the W3C, not Sacramento.

The exposure is real, but it's built from damages and precedent rather than a rulebook. This is general information, not legal advice.

The Unruh rule: damages per violation

Unruh makes a violation of the ADA a violation of California law. That link matters because of what Unruh adds on top. The Assembly Privacy and Consumer Protection Committee's analysis of AB 2190 describes the remedy as actual damages, "treble actual damages but not less than $4,000, and any attorney's fees as the court may determine to be proper" (Civil Code section 52). The same analysis notes the ADA authorises only injunctive relief. Sue under the federal law alone and you get a fix, not a cheque. Under Unruh, the floor is $4,000 per violation. The separate Disabled Persons Act carries its own statutory minimum per violation.

Two more details from that analysis matter. ADA-based Unruh claims don't require a showing of intentional discrimination. Non-ADA Unruh claims generally do. That gap explains much of what follows.

Why is California the busiest venue? Vendors say it is, and it sounds plausible, but treat vendor claims as vendor claims. Accessibility.Works says California generates more digital accessibility lawsuits than any other state. AccessibilityChecker.org (published 22 July 2026) says each barrier a visitor meets can be counted separately, and that federal ADA filings for California websites have dropped sharply as plaintiffs' firms moved to state court for Unruh damages. Neither gives a count I'd quote. The mechanism is the point: a per-violation minimum that doesn't depend on proving financial loss, plus attorney's fees, makes even a modest site worth a demand letter.

The bills that would have changed it

Three bills come up whenever this topic does. Only two touch websites, and neither became law.

AB 1757 (2023-24): failed

Introduced on 2 March 2023 under the title "Accessibility: internet websites", it was built around WCAG 2.1 AA. It would have limited statutory damages for website inaccessibility and made it unlawful for vendors to build inaccessible sites or falsely represent them as accessible. Digital Democracy lists its status as Failed: held under submission in committee on 15 August 2024. Done.

AB 2190 (2025-26): parked

AB 2190, authored by Assembly Member Greg Wallis, is the one to watch, or rather the one that stopped. It was introduced on 19 February 2026 and amended on 9 and 23 April. As described on its Digital Democracy page, it would have given a business an affirmative defence to a statutory damages claim over a specific website barrier if, within 30 days of a written prelawsuit demand, it showed the plaintiff either of two things:

• It had published a digital accessibility report on its accessibility page disclosing that barrier, and updated the report when the barrier was fixed.
• It had a reasonable, good faith basis to believe the site conformed to the standard, backed by its efforts to find and fix barriers.

The defence also required barriers to be remediated within 45 days of publication in the report or of identification by testing. The standard in the April 9 version, per the committee analysis, was WCAG 2.1 AA before 1 January 2027 and WCAG 2.2 AA on or after that date. Later text appears to shift the switch date, so check the current bill text before quoting it.

Two other pieces matter. A "small business entity" meant fewer than 25 full-time employees, under $5,000,000 in annual revenue, and not publicly traded. The bill would also have barred a vendor from falsely representing that a resource or part of a website is accessible, with small businesses and public attorneys, including the Attorney General, able to sue to enforce that.

The votes were lopsided: it passed the Assembly Judiciary Committee 12-0 on 7 April, Privacy and Consumer Protection 14-0 on 21 April, and Appropriations 15-0 on 14 May 2026, which sent it to the floor. On 21 May 2026 it was ordered to the inactive file at Wallis's request. The California Chamber of Commerce, California Retailers Association and Civil Justice Association of California opposed it, arguing the defences were too hard to achieve. Disability Rights California and the California Council of the Blind supported it. An inactive file isn't a repeal. It means the bill is parked, and it isn't law.

SB 84 (Niello): physical access only

SB 84 gets mixed into website articles and shouldn't. Its title is "Disability access: construction-related accessibility claims: notice of violation and opportunity to correct". It would bar construction-related statutory damages claims against a defendant with 50 or fewer employees unless the defendant was served a letter naming each alleged violation and failed to correct within 120 days. It passed the Senate in June 2025, was amended on 18 June 2025 and re-referred to the Assembly Judiciary Committee, where it stalled (Digital Democracy). It also stops a plaintiff relabelling a physical-access claim as a general ADA claim to dodge the process.

Say it plainly: SB 84 does not cover websites. Any page telling you California has a 120-day cure period for website claims is wrong.

Who is exposed

Three groups, three different risk profiles.

Businesses with physical locations

This is the clearest case. According to the Assembly analysis, in Thurston v. Midvale Corp. the Court of Appeal held the ADA applies to commercial websites with a nexus to a physical place of public accommodation, and upheld an injunction requiring WCAG 2.0 Level AA. A restaurant, clinic, gym or shop whose site books, sells or informs about the physical place sits inside that reasoning. Because an ADA violation is an Unruh violation, the $4,000 floor comes along.

Web-only businesses

Martinez v. Cot'n Wash, Inc. (Cal. Ct. App., docket B314476, decided 1 August 2022) affirmed the dismissal of an Unruh claim over a retail website. The court held the plaintiff hadn't alleged the site was a "place of public accommodation" under Title III of the ADA, and that failing to fix known effects of a facially neutral website doesn't alone prove intentional discrimination under Unruh. The company wasn't alleged to offer products or services at any physical location. The plaintiff's audit of four pages used the free WAVE tool, which the complaint called "one of 162 web accessibility evaluation tools".

The Assembly analysis says recent California decisions have followed that approach, so plaintiffs against online-only businesses must prove intentional discrimination directly under Unruh. That lowers the risk. It doesn't erase it, because the analysis also notes federal courts are split on the ADA question, and the fact that AB 2190's author tried to change this shows the pressure runs both ways.

Public entities

No ambiguity here. The Department of Justice published a final rule on 24 April 2024 setting WCAG 2.1 Level AA as the technical standard for state and local government web content. An Interim Final Rule published on 20 April 2026 extended the compliance date to 26 April 2027 for governments with a population of 50,000 or more, and to 26 April 2028 for smaller ones and special districts, per Mass.gov's summary. That reaches California cities, counties, UC and CSU. Which date applies to a given body depends on its population and type, so check with counsel.

Selling into Europe as well? The European Accessibility Act is a separate regime with its own deadlines.

What "compliant" means in practice

There is no certificate. Nobody issues a California compliance badge, and nothing in Unruh defines one. In practice, "compliant" means conforming to WCAG, and the working version is 2.1 Level AA. That's the DOJ's Title II standard, it's the pre-2027 standard in AB 2190, and it's what a plaintiff's tester most commonly measures against. Thurston's injunction used the older 2.0 AA, which tells you courts lag the guidelines.

My advice is to aim for WCAG 2.2 AA. Content that meets 2.2 generally meets 2.1 as well, so you lose nothing, and AB 2190's own text pointed that way. The Assembly analysis counts 61 testable success criteria in WCAG 2.0, 17 added in 2.1 and nine more in 2.2. That's a manageable delta, not a rebuild.

How far are most sites from the target? The analysis cites WebAIM's 2026 report on the top 1 million home pages: 95.9% had detectable accessibility failures, and the most common error was low contrast text, at 83.9%. If your site fails, you're in the majority. That's no defence, only context.

Overlays, scanners, code-fix tools and audits

Four categories get lumped together. They prove different things.

• Overlay. A script added on top of the page that offers a toolbar (text size, contrast, spacing) and may apply automatic adjustments in the browser. It does not change the source code a plaintiff's tester inspects. It can help some visitors. It can't prove your underlying code conforms.
• Scanner. Automated testing that reports issues against rules. Fast and repeatable, but automated checks catch only a share of WCAG problems. A clean scan is evidence, not a verdict.
• Code-fix tool. Software that identifies issues and generates or applies changes to your actual HTML, CSS or templates. This is what changes the thing a tester sees, provided a person ships the fix.
• Audit. Expert manual testing with assistive technology, usually producing a report. The strongest evidence of conformance, and the slowest.

On overlays specifically, the regulatory record is worth knowing. The Federal Trade Commission ordered accessiBe to pay $1 million over claims that its AI tool could make any website WCAG compliant (proposed in January 2025, final order in April 2025). That is the FTC's finding about marketing claims, and it's separate from any Unruh claim against a site owner. The practical reading is simple: be sceptical of any tool, from any vendor, that promises compliance by installing a script. The widget may do useful things. The promise is the problem.

The 8 tools compared

The W3C's evaluation tools list shows 119 tools, with information submitted by providers, and W3C doesn't endorse specific products. This table is a shortlist, not a ranking. Pricing is described as a model; I haven't listed figures because they change and I can't source them.

accessiBe

accessiBe pairs a widget with accessScan, its scanner, and offers services on top. Its strength is breadth for a small team: one vendor covers the visitor toolbar, the scan and some human help. Given the FTC order above, read its compliance claims against the actual scan output on your own pages.

Tabnav

Tabnav is an AI accessibility agent. It scans, explains each issue and generates code-level fixes, and it handles PDF remediation. It's listed on the W3C evaluation tools list. Its own page lists a free widget, monitoring and a free checker for WCAG 2.2 issues, and claims 100k+ websites on its plugin and 40+ languages (vendor claims). I used its monitor scan on this site, and the results are further down.

AudioEye

AudioEye combines automated fixes with expert audits. The appeal is the mix: automation for the repetitive stuff and people for the judgement calls that scanners miss.

UserWay

UserWay is a widget with scanning, and it's part of Level Access. That's useful if you start small and later need audit-grade work, because the path to the larger platform already exists.

EqualWeb

EqualWeb offers a widget plus manual audits. It also publishes a plain explainer on the Unruh Act, which is where its description of the $4,000 per-violation minimum comes from. Treat that as a vendor summary and check the statute.

Level Access

Level Access is the enterprise option: a testing and audit platform built for organisations that need documented processes, reporting and repeatable audits across many properties. For a five-page brochure site it's more than you need. For a university or a large retailer, it's the sort of thing procurement asks for.

Deque axe

Deque's axe covers two things: axe DevTools for developers, and the open-source axe-core engine that many other tools embed. If your team ships code, axe in the test pipeline catches regressions before they go live. The engine is free, which is a real strength.

WebAIM WAVE

WAVE is a free evaluator that overlays errors, alerts and structural information on the page. It's quick, visual and a good teaching tool. Remember the Martinez plaintiff used it for a four-page audit, so anyone can run the same check on your site.

What three scanners said about this site

Here's the first-hand part. I ran three tools against gautamkhorana.com and got three different answers.

Tabnav monitor scan, 4 November 2026 (three pages: home, about, ai-consultant): accessibility score 85, 36 issues, 14 failed criterion checks. The issues by type:

• 22 links opening a new tab without a warning (SC 3.3.5, AAA)
• 4 images of text (1.4.5, AA)
• 3 landmark structure issues (1.3.1, A)
• 3 links without a clear name (2.4.4, A)
• 3 search fields without a search landmark (2.4.1, A)
• 1 section without a heading (2.4.10, AAA)

Fixes shipped the same day: the main nav wrapped in a header for a banner landmark, role="search" on the search wrapper, a descriptive name for an icon-only link, a visually hidden heading, and an "(opens in a new tab)" announcement on every target=_blank link in all 8 site languages. The rescan that evening scored 100 with 0 failed checks.

axe-core 4.10.2, 12 November 2026, same three pages: 0 violations on all three, with 42 to 47 rules passed per page. Colour contrast was left as "needs review" on 132 elements of the homepage, 14 on about and 7 on ai-consultant.

WebAIM WAVE, homepage, 12 November 2026: 0 errors, 5 very low contrast errors (the dimmed words of the hero tagline), 15 alerts, and an AIM score of 8.8 out of 10.

So what's the lesson? Three tools, three verdicts on the same page. One reported 36 issues, many of them AAA items beyond the AA target. One reported zero violations but handed 132 contrast elements back to a human. One flagged contrast errors the others didn't. Automated tools catch a share of WCAG issues and disagree about contrast over gradients and dimmed text, so a manual check still matters. A perfect score from one scanner isn't a conformance statement.

A 30-day plan for a California business

The order matters: measure, fix at source, test as a human, say something honest, then watch.

1. Days 1 to 3: scan. Run at least two different scanners (say, axe-based and WAVE) on your highest-traffic templates: home, a product or service page, checkout or booking, contact. Record the results with the date. Don't chase every item yet; sort by WCAG level and by how many pages each issue touches.
2. Days 4 to 14: fix in code. Fix templates, not individual pages. Landmarks, link names, form labels, heading structure, focus states and contrast belong in the theme or component library. Re-scan after each batch.
3. Days 15 to 21: manual pass. Tab through every key flow with a keyboard only. Then run the same flows with a screen reader (NVDA on Windows or VoiceOver on Mac). Check how the pages behave when zoomed in, and review every contrast item the scanner left as "needs review".
4. Days 22 to 25: accessibility statement. Publish a plain-language page linked from the footer: the standard you're working towards (WCAG 2.2 AA), known gaps, and a real contact route (an email address someone reads, ideally a phone number too). Don't claim full compliance. AB 2190 would have barred vendors from false accessibility representations; the sensible habit applies to you as well.
5. Days 26 to 30: monitoring. Schedule recurring scans, add axe-core to your build checks if you ship code, and give one named person ownership of fixes and of the inbox that receives accessibility reports.

If the scan turns up template-level problems that also hurt crawling and rendering, a technical SEO audit can fold those fixes into one pass, and the technical SEO audit checklist shows what that covers.

FAQ

Is there a California website accessibility law for private businesses?

Not one that sets a technical standard. The pressure comes from Unruh and ADA case law. Bills to create a state standard, AB 1757 and AB 2190, did not pass, and SB 84 deals with physical access only.

Does Unruh apply to web-only businesses?

It can, but the route is harder. After Martinez v. Cot'n Wash, and per the Assembly analysis of later decisions, a plaintiff against an online-only business generally has to prove intentional discrimination under Unruh rather than rely on the ADA. The risk is lower, not zero, and a physical location changes the picture.

Do overlays prevent lawsuits?

No tool can promise that. An overlay sits on top of your page and leaves the source code unchanged, and the FTC has ordered one vendor to pay $1 million over compliance claims. Use overlays, if at all, as an addition to fixing the code.

WCAG 2.1 or 2.2?

Target 2.2 AA. The DOJ's public-sector rule uses 2.1 AA, so 2.1 is the minimum working standard, but 2.2 adds only nine criteria and is the safer target.

What does a demand letter usually ask for?

Letters vary. They commonly list the barriers the sender's tester found, ask for fixes and a settlement, and set a deadline. The one fixed point is that AB 2190 would have started a 30-day clock on receipt of a written prelawsuit demand, and it didn't pass. Hand any letter to a California attorney the day it arrives.

The sharpest fact here is that California's exposure comes from Unruh's $4,000-per-violation floor and case law, not from any statute defining a website standard, and the bills that would have added one stalled. Fix the code, test by hand, and keep dated records, because a single scanner's clean result won't settle anything on its own.