Is a Vendor's Portal Covered by the Title II Web Rule?

Yes, in most cases. The Title II web rule covers web content and mobile apps your public entity provides or makes available "directly or through contractual, licensing, or other arrangements" (28 CFR 35.200(a)). If a vendor runs your payment portal, permit system or scheduling tool for you, the vendor's product has to meet WCAG 2.1 Level A and AA, and you are the one responsible. DOJ says a public entity "may not delegate away its obligations under the ADA."

This is general information, not legal advice.

Where does the vendor line fall?

The rule asks whether you provide or make the content available, not who wrote the code. DOJ's preamble gives examples of what is covered when you rely on them:

• Calendars, scheduling tools, maps, reservations systems and payment systems built by an outside technology company and used on your site.
• A third party that builds your website template on your behalf.
• A highway toll payment website a public entity uses so people can pay for tolls.
• A third-party website that processes applications for benefits or sign-ups for classes or programs you offer.
• A contractor's own website where a public housing authority collects online applications for a housing waitlist.

ADA.gov's fact sheet on the rule lists the same kinds of content (calendars, scheduling tools, maps, reservation systems and payment systems) as content that would not fall under an exception.

What does the third-party exception cover?

Very little. Section 35.201(c) exempts "content posted by a third party, unless the third party is posting due to contractual, licensing, or other arrangements with the public entity." DOJ calls this exception narrow. It is for independent, unaffiliated posters, such as a resident who comments on a post on your social media page, or an attorney who files a document through your court's online portal.

Even then, the exception covers only what someone posts. DOJ says the platforms and tools the public uses to post, such as message boards, authoring tools and embedded content that you provide directly or through arrangements, generally must conform.

What if you only link to the vendor's site?

You still may be responsible. DOJ's test is whether you have directly, or through a contractual, licensing or other arrangement, provided or made available the linked content. If you link to a payment site so people can pay fees, parking tickets or taxes, that site has to comply. If the link goes to a private hotel's website with no arrangement between you and the hotel, you are not responsible for the hotel's site, but the link itself, and the page it sits on, must conform. DOJ's example of a link failing: light blue text against a light background that breaks the minimum contrast ratio.

How do common vendor products sort out?

Every row marked "yes" still depends on the facts and on whether you have an arrangement with the vendor. Treat the table as a starting point for a conversation with counsel.

What if the vendor will not fix it?

You have limited options. DOJ acknowledged that buyers find it hard to procure accessible products, and it expects accessible options to increase. It also says you can choose providers that can ensure accessibility and put contract terms in place that require it.

If a vendor will not fix a problem, the rule gives you two routes:

• Fundamental alteration or undue burden (28 CFR 35.204). You carry the burden of proof. The head of the entity or a designee must make the decision after considering all resources available for funding and operating the service, and put the reasons in writing. Even then, you must take any other action that would not cause the alteration or burden, so that people with disabilities receive the benefits or services to the maximum extent possible. DOJ's preamble says entities can rely on this provision where they can meet its requirements.
• Conforming alternate version (28 CFR 35.202). An alternate version that conforms to WCAG 2.1 is permitted "only where it is not possible to make web content directly accessible due to technical or legal limitations." A vendor that simply declines to fix a problem does not fit that wording.

What should you collect from each vendor?

Start a one-page inventory. For each vendor-run tool, record:

• What the tool does and which of your services depend on it.
• Which contract or license covers it, and when it renews.
• Whether the vendor has given you an Accessibility Conformance Report (ACR), and what it was tested against. Section508.gov tells federal buyers to ask vendors for an ACR based on the VPAT. The Title II rule itself does not mention ACRs, so treat one as a starting point.
• Who at the vendor handles accessibility problems, and how fast they respond.
• Whether you have tested the live product yourself against WCAG 2.1 AA.

Then put accessibility requirements into the next contract or renewal.

Has DOJ enforced this where a vendor was involved?

This is a public case, not one of our engagements. In June 2024, DOJ and Upton County, Texas signed a settlement agreement after DOJ found the county's election website was not accessible to people with vision or manual disabilities. The agreement states that "the County receives services from a third-party website hosting service," and it requires the county to "ensure that the third-party website hosting service retains an independent web accessibility services provider" to test the site against WCAG 2.1 Level AA at least annually. The parties to the agreement are the United States and the county, and the county neither admitted nor denied DOJ's findings. The case involves a hosting service, not a payment portal, and it was resolved under Title II generally, before the web rule's compliance dates.

For a risk review of the vendor tools your site depends on, see our accessibility risk advisory service.

Sources

• 28 CFR 35.200 (web and mobile accessibility; "directly or through contractual, licensing, or other arrangements"): https://www.law.cornell.edu/cfr/text/28/35.200
• 28 CFR 35.201 (exceptions, including (c) third-party content): https://www.law.cornell.edu/cfr/text/28/35.201
• 28 CFR 35.202 (conforming alternate versions): https://www.law.cornell.edu/cfr/text/28/35.202
• 28 CFR 35.204 (fundamental alteration and undue burdens; text as printed in the Federal Register rule): https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state
• DOJ final rule and preamble, 89 FR 31320 (Apr. 24, 2024), doc. 2024-07758, discussion of 35.200, third-party content, content posted by a third party and linked third-party content (same URL as above)
• ADA.gov, Web Rule: First Steps ("can't contract away its responsibilities"): https://www.ada.gov/resources/web-rule-first-steps/
• ADA.gov, Fact sheet on the web rule (vendor-supplied calendars, scheduling tools, maps, reservation and payment systems): https://www.ada.gov/resources/2024-03-08-web-rule/
• DOJ, Settlement Agreement between the United States of America and Upton County, Texas, DJ # 204-76-243 (signed June 13-14, 2024; paragraphs 3, 4, 15-16): https://www.justice.gov/crt/media/1356116/dl
• Section508.gov, Request accessibility information from vendors: https://www.section508.gov/buy/request-accessibility-information/

Note: 28 CFR 35.200, 35.201, 35.202, 35.204 and 35.205 were checked against the eCFR versioner API (as of 2026-09-01) on 2026-10-06.