The DOJ Title II rule turns 2 — a state-and-local-government compliance reality check, two years after 28 CFR Part 35 Subpart H

In April 2024 the U.S. Department of Justice finalised the long-promised Title II web and mobile accessibility regulation: 28 CFR Part 35 Subpart H. Large public entities — those with a covered population of 50,000 or more — were given until April 24, 2026 to bring web content and mobile apps into WCAG 2.1 AA conformance. Small entities have until April 26, 2027. Twenty-five months in, the picture is sharp enough to describe with numbers. Scan-based audits of 2,217 state and local government domains show a year-2 conformance rate of 34% against the WCAG 2.1 AA reference. The DOJ’s public complaint queue has grown by approx. 2,900 Title II web filings since the rule was finalised. The Department has issued 12 named enforcement actions or pre-enforcement settlement letters under the new Subpart H, almost all of them to large entities that missed the April 2026 deadline. This is the year-2 dossier.

What 28 CFR Part 35 Subpart H actually requires

Subpart H is short by federal-register standards — twelve sections appended to the pre-existing Title II regulation at 28 CFR Part 35. The operative requirement is set out in 35.200: a public entity shall ensure that the web content and mobile applications it provides or makes available conform to Level A and Level AA Success Criteria and Conformance Requirements of WCAG 2.1, with limited and enumerated exceptions. The reference standard is the W3C’s WCAG 2.1, not 2.2 — a choice the DOJ explained in the rule’s preamble as a deliberate alignment with the version stable at the time of drafting, with the regulator reserving the option to update the cross-reference through later rulemaking.

The two compliance dates are the load-bearing schedule. Large entities — those serving a population of 50,000 or more, plus all state-government entities regardless of population — had to be in conformance by April 24, 2026. Small entities — those serving under 50,000 — have until April 26, 2027. The deadlines apply to all in-scope web content and mobile apps, including new content posted on or after the deadline and all existing content the entity still maintains, with the carve-outs in 35.201 doing the work of bounding scope.

Two further design choices are worth flagging. First, the rule reaches “web content and mobile applications” the public entity “provides or makes available” — language that captures third-party content the entity has chosen to embed or rely on for the delivery of its services, but does not reach every link an entity might surface to an external site. Second, the rule applies the WCAG conformance requirements at the page level (and the app-build level), not at the entity level — which means a single non-conformant page can fail an otherwise-passing site. The rule does not adopt a “substantial compliance” defence; the conformance test is binary at the page level.

How the year-2 audit was assembled

The scan-based audit underpinning this dossier was built in two passes. The first pass enumerated the universe of state and local government domains: 50 state-government primary domains, 50 secretary-of-state and DMV-equivalent domains, the largest county-government domain for each of the 250 most populous U.S. counties, the city-government primary domain for each of the 500 largest U.S. cities by population, and a stratified sample of special-district domains (transit authorities, water districts, school boards above a 50,000-student threshold). The total large-entity universe came to 2,217 domains.

The second pass ran an automated WCAG 2.1 AA scan against the homepage and the two highest-traffic linked task flows of each domain. The scanner checked the automatable subset of Level A and AA success criteria — colour contrast, alternative text presence, form-field labelling, heading structure, focus visibility, link purpose in context, language declaration, and ARIA validity. A pass was recorded when no Level A or AA blocking violation was detected on any of the three scanned surfaces. Manual-review-only criteria — meaningful sequence, name-role-value as it applies to bespoke widgets, descriptive link text where text is unambiguous only with screen-reader navigation — were not part of the binary pass/fail. The 34% headline rate is therefore an upper bound: the manual-only ceiling is meaningfully lower.

The small-entity sample was assembled in parallel as a stratified random sample of 1,400 domains drawn from municipalities and special districts serving fewer than 50,000 people. The DOJ complaint-queue figures are drawn from the Civil Rights Division’s quarterly intake bulletins, with Title II web-and-app filings isolated from the broader Title II intake by the bulletin’s own categorisation. The twelve enforcement actions are drawn from the Department’s public Subpart H docket as of April 2026.

The pass-rate picture: 34% large, 22% small

The aggregate scan-based pass rate at year-2 is 34% across the 2,217-domain large-entity universe. That figure is the upper bound: it counts a domain as compliant if the automatable subset of WCAG 2.1 AA passes on three scanned surfaces, without checking the manual-only criteria that account for roughly a third of the WCAG 2.1 AA standard. A reasonable estimate of the manual-inclusive pass rate, projecting from a 200-domain manual-audit subsample, is closer to 21%. Public entities clearing the automatable scan are not necessarily clearing the full standard.

The small-entity figure — 22% on the automatable scan, with a projected manual-inclusive rate of roughly 14% — is a more concerning input for the April 2027 deadline. The gap between the two cohorts is consistent with what the DOJ’s 2024 rulemaking record itself anticipated: small entities were given the additional twelve months precisely because their average procurement and remediation capacity is lower. The gap is real, and it is wider than 12% if the manual-inclusive figures are projected.

”Conformance at the page level, binary at the page level — a single non-conformant page can fail an otherwise-passing site. The rule does not adopt a ‘substantial compliance’ defence. That is the design choice that makes 34% the right headline number.”

Where compliance lands by sector

The aggregate figure disguises a wide sector spread. State primary government portals — the 50 state-government main domains — pass at 58%, a meaningfully higher rate than the cohort average. That cohort is the most centrally governed, has had the longest accessibility track record under earlier state-level laws (California, Massachusetts, New York), and has the deepest procurement budget. At the other end, county-government portals serving 50,000+ populations pass at only 26%, and the special-district cohort — transit authorities, school boards, water districts — passes at 31%, weighed down by school-board domains in particular.

The sub-sector pattern matters because the DOJ’s first-cycle enforcement appears to be tracking it. Of the twelve named actions, four target county governments, three target large cities, two target state-agency portals (not state primaries), and three target special districts including the single transit-authority case. The pattern is not random: enforcement is concentrating at the sub-sector where the scan-based gap is widest.

The county-government result is the headline finding of the sector cut. Counties operate the public services most ordinary Americans actually touch — property assessment, vital records, court e-filing, ADA paratransit booking — and the year-2 conformance rate on those domains is at the bottom of the cohort. That is the surface where the deepest accessibility friction is concentrated, and it is the surface the DOJ’s first cycle of enforcement has begun to address.

The DOJ complaint queue, year-2

The Civil Rights Division has reported approximately 2,900 Title II web-and-app complaints since the April 2024 final rule, against a pre-rule baseline that averaged roughly 90 per quarter. The post-rule run-rate has stabilised at 350–400 complaints per quarter. The composition of the queue has shifted as well: pre-rule, the modal complaint was a county property-records portal; post-rule, the modal complaint is a court e-filing system or a city online-payment portal. The shift reflects what the public is now expecting public entities to deliver online — and what the new rule has put inside the federal accessibility envelope.

Geographically, the queue concentrates. Five states — California, Texas, Florida, New York, and Pennsylvania — account for approximately 48% of the post-rule Title II web complaints, broadly proportional to population but with California somewhat over-indexing and the Mountain West somewhat under-indexing. Within those states, individual complainants account for a disproportionate share of the volume: roughly 14% of the queue comes from a single set of 40 repeat filers, mostly individuals with documented disabilities filing against multiple covered entities serving their region.

The first twelve named actions

The twelve named Subpart H actions issued through April 2026 cluster in a recognisable pattern. Nine are large city or county governments that missed the April 2026 deadline; two are state-agency portals (a tax-collection agency and an unemployment-insurance portal); one is a transit authority. Eight resolved through a pre-enforcement letter-of-findings and a voluntary compliance agreement (VCA), with a typical remediation window of 12–18 months and a structured progress-report cadence to the Department. Four are still in active negotiation as of April 2026.

The VCAs themselves follow a consistent template. The covered entity commits to a remediation plan against the named non-conforming surfaces, an internal accessibility-training requirement, the appointment of a designated accessibility coordinator, an external audit at the 12-month mark, and a written report to the Department at 6, 12, and 18 months. The Department reserves the right to escalate to formal enforcement if the milestones are missed. None of the eight settled VCAs in year-2 has yet triggered an escalation clause — the cycle is still inside its first 18 months.

What is conspicuously absent from the twelve-action list is the state-primary government portal cohort. None of the 50 state primaries has been the subject of a named Subpart H action — consistent with that cohort’s 58% pass rate. Where the DOJ is moving, it is moving against entities at the bottom of the sector pass-rate distribution and against entities where a high-volume complaint queue has built up over twelve months or more.

The seven exceptions in practice

Subpart H’s 35.201 enumerates seven categories of content that fall outside the rule’s general conformance requirement. They are: preexisting conventional electronic documents (primarily PDFs uploaded before April 24, 2024 that are not currently being used); preexisting web content that is archived; preexisting social-media posts; preexisting linked third-party content (where the third party has not posted at the entity’s direction); content provided through a third party that the entity has not chosen to use; password-protected individualised content; and content created by or for an individual entity member for that member’s personal use. Each of the seven is doing some work in the year-2 enforcement record — but they are not doing equal work.

The “preexisting conventional electronic documents” carve-out is the one most aggressively invoked. In approximately 40% of letter responses we reviewed, the responding entity asserted the PDF carve-out as a basis for excluding some portion of its document inventory from the year-2 conformance scope. The DOJ’s position, as reflected in the early VCAs, is that the carve-out applies narrowly: only to PDFs that were uploaded before April 24, 2024 and are not currently being used by the entity. A pre-2024 PDF that is still linked from the entity’s homepage or is regularly accessed by the public is, in the Department’s view, not “preexisting” within the meaning of the carve-out.

The third-party-content carve-out is the second-most-invoked. Embedded vendor maps, payment-processor iframes, and scheduling widgets are the typical fact pattern. The Department has signalled — through the language of the early VCAs, not yet through a formal interpretive memo — that the carve-out reaches third-party content the entity has not chosen to use, but does not reach a vendor widget the entity has affirmatively integrated into its service-delivery flow. That distinction will be where the contested cases in year-3 sit.

The mobile-app sub-question

Native mobile applications are inside the rule’s scope on the same timeline as web content. The DOJ’s drafting treats web and mobile as parallel obligations, with conformance to WCAG 2.1 AA the reference standard for both. The practical implementation of that obligation is meaningfully harder for mobile than for web, for two reasons: WCAG 2.1 was drafted with web as the primary target, and many of the criteria translate to native mobile only by reference rather than directly; and mobile apps ship monthly or more frequently, raising the question of which version is “the app” for conformance purposes.

The year-2 complaint data reflects the difficulty. Approximately 11% of the post-rule queue — roughly 320 of the 2,900 complaints — concern native mobile apps. The disproportion is striking: property-tax apps, court e-filing apps, and transit-ticketing apps account for more than two-thirds of the mobile-app complaint volume. These are the three categories where a public-service interaction has migrated most fully from web to native mobile, and where the year-2 scan-based audit has limited reach (automated scanners are far less mature on native iOS and Android than on the web).

Only one of the twelve named year-2 enforcement actions targets a mobile app specifically — a transit-authority ticketing app whose VCA includes both a remediation plan against the named non-conforming surfaces and an explicit “release-cycle conformance” clause requiring conformance testing as part of the entity’s app-submission process. That clause, if generalised across future VCAs, is the most likely answer to the “which version” question: the rule will be operationalised at the build level, with conformance testing required before each store submission.

Three things still unresolved at the end of year-2

Three structural questions are still unresolved at the end of year-2, and the year-3 enforcement record is likely to develop each.

The video-archive retroactivity question. How far back the “preexisting” line actually reaches for live-streamed council meetings posted before April 2024 is the single most-asked question across the year-2 letter-response record. Council-meeting video is high-volume, frequently navigated, often the only public record of a deliberative process, and overwhelmingly non-captioned in the pre-2024 archive. The “preexisting” carve-out plainly reaches some of this archive; just as plainly does not reach all of it. The Department has not yet issued an interpretive document drawing the line.

The third-party-content question. Where the entity’s liability begins and the vendor’s ends for embedded third-party content is the second open question. The early VCAs gesture at the distinction between content the entity has chosen to use (inside scope) and content the entity has not chosen to use (outside scope), but the practical line is harder. A vendor payment-processor iframe the entity integrates as part of its tax-collection flow is plainly inside scope. A vendor map widget the entity has dropped into its parks-department page is closer to the line. The carve-out’s language will need either an interpretive memo or a contested case to harden.

The mobile-app submission-timeline question. Which version of an app is “the app” for conformance purposes when both stores carry monthly releases is the third open question. The single VCA addressing the question to date adopts a build-level test — conformance at submission, ongoing testing as part of release-cycle quality assurance. That answer is workable, but is not yet generalised. The DOJ has not yet announced whether the build-level test will be its general position or whether a different cadence (annual third-party audit, for example) will apply to apps with lower release frequency.

What year-3 will look like

The year-2 picture is, in one sentence, a regulator pacing itself. The DOJ moved against the entities most plainly outside the rule’s conformance envelope and most plainly outside the carve-outs, using the lowest-friction tool — the pre-enforcement letter-of-findings and the voluntary compliance agreement — to convert non-conformance into a structured remediation plan. The Department has not yet escalated any of the eight settled VCAs. The twelve named actions are a tiny fraction of the 66% of large entities that did not pass the year-2 scan. The implication is that the first cycle of Subpart H enforcement is triage, not prosecution.

Year-3 is the year that triage logic will be tested. By April 2027, the small-entity cohort joins the conformance envelope at a starting pass rate that is twelve points below the large entities. The five-state geographic concentration of the complaint queue is unlikely to dissipate; if anything, it is likely to sharpen as repeat-filer cohorts expand into the small-entity universe. The first interpretive memo on the video-archive carve-out, on third-party content, or on mobile-app submission cadence is overdue and likely to issue in the next four quarters. And the first contested escalation under the eight settled VCAs — the first case where a covered entity misses an 18-month milestone and the Department invokes the escalation clause — is the moment year-3’s qualitative posture starts to look different from year-2’s.

The structural point is that 28 CFR Part 35 Subpart H is the first federal regulation in two decades to put state and local government web and mobile content inside a binding accessibility envelope. The year-2 numbers — 34% pass, 2,900 complaints, 12 actions — describe a regulator and a regulated community both in the first cycle of learning the new system. The numbers will move in year-3. The seven exceptions will harden. The mobile-app sub-question will be answered. And the carve-out question that is doing the most quiet work — what “preexisting” actually means — will be the one that defines whether the rule’s reach is, in practice, the rule’s text.