Section 508 Compliance: Federal Website Accessibility Requirements

What Is Section 508?

Section 508 is an amendment to the Rehabilitation Act of 1973 that requires federal agencies to ensure that their electronic and information technology is accessible to people with disabilities. The law was significantly updated in 2017 through the ICT Refresh, which aligned Section 508 requirements with WCAG 2.0 Level AA.

Section 508 covers all ICT developed, procured, maintained, or used by federal agencies, including websites, web applications, software, hardware, electronic documents, multimedia, and telecommunications equipment.

Section 508 vs. ADA: Key Differences

• Who it applies to: Section 508 applies to federal agencies and their contractors. The ADA applies to state/local governments (Title II) and private businesses that are places of public accommodation (Title III).
• Technical standard: Section 508 incorporates WCAG 2.0 AA (via the 2017 ICT Refresh). The ADA Title II rule references WCAG 2.1 AA.
• Scope: Section 508 covers all ICT, not just websites. This includes desktop software, mobile apps, kiosks, documents, and hardware.
• Enforcement: Section 508 is enforced through federal procurement requirements, agency self-assessment, and administrative complaints. The ADA relies on DOJ enforcement and private lawsuits.

Who Must Comply with Section 508

• Federal agencies: All departments, offices, and independent agencies of the federal government.
• Federal contractors: Companies that build, sell, or maintain ICT products and services for federal agencies must deliver Section 508-compliant technology.
• Organizations receiving federal funding: Entities that receive federal grants or contracts may be required to meet Section 508 standards as a condition of funding.

For federal contractors, Section 508 compliance is increasingly a procurement requirement. Non-compliant products can be excluded from consideration during the procurement process, meaning accessibility failures directly affect your ability to win government contracts.

Section 508 Technical Requirements for Websites

For web content, Section 508 adopts WCAG 2.0 Level AA success criteria. This includes the same four principles as WCAG 2.1 (Perceivable, Operable, Understandable, Robust) with 38 Level A and Level AA criteria.

While the formal standard is WCAG 2.0, meeting WCAG 2.1 AA (which is a superset of 2.0 AA) will satisfy Section 508 requirements and also prepare you for ADA Title II compliance. We recommend targeting WCAG 2.1 AA to cover both Section 508 and ADA obligations with a single effort.

Run a free scan against WCAG 2.1 AA to identify violations relevant to both Section 508 and ADA compliance.

Voluntary Product Accessibility Template (VPAT)

Federal procurement officers use VPATs to evaluate the accessibility of ICT products. A VPAT is a document where the vendor self-reports the conformance level of their product against Section 508 standards.

If you sell software, SaaS, or web applications to federal agencies, you will almost certainly need to produce a VPAT. The document should be based on the VPAT 2.4 template (or later), which maps to WCAG 2.0 AA, Section 508, and EN 301 549 standards.

Key VPAT best practices:

• Be honest about conformance levels (Supports, Partially Supports, Does Not Support)
• Provide specific details about known issues and workarounds
• Update the VPAT with each major product release
• Base your VPAT on actual testing, not assumptions

Testing for Section 508 Compliance

1. Automated scanning: Use ADA Scanner or similar tools to test against WCAG 2.1 AA criteria. Automated testing catches approximately 30–50% of issues.
2. Manual testing: Keyboard navigation, screen reader testing (JAWS is the federal standard, NVDA as secondary), and color contrast verification.
3. Trusted Tester process: The DHS Trusted Tester methodology is the federal standard for conformance testing. It provides a structured, repeatable testing process for Section 508.
4. Document results: Maintain detailed test results for procurement documentation and VPAT creation.

Maintaining Compliance

Section 508 compliance is not a one-time certification. Federal agencies are expected to maintain compliance as technology evolves. Set up continuous monitoring and integrate accessibility testing into your development pipeline to catch regressions early.