Incident response

Received an ADA Demand Letter? What to Do First

An ADA accessibility demand letter is serious — but it is not a lawsuit. It is a notice that specific accessibility failures exist on your site and a request that you remediate them. Most website owners who fix the cited issues and document their work resolve these matters without litigation. Here is exactly what to do, in order.

• Understand what you received
• Preserve evidence first
• Make the fixes
• Document remediation
• Consult an attorney
• Ongoing posture
• Verify with ShipSafe
• FAQ

1. Understand what you received

A small number of plaintiff firms send high volumes of ADA demand letters to website owners. Their workflow is typically automated: they run accessibility scanners across thousands of URLs, identify sites with common WCAG failures, and send templated demand letters on behalf of clients who are disabled individuals covered by ADA Title III.

The letter likely cites one or more of the following failures — the four that appear most frequently because automated scanners detect them reliably:

Read the letter carefully to identify which specific criteria are cited. Some letters reference vague WCAG categories; others name specific success criterion numbers (e.g. "WCAG 1.1.1", "WCAG 1.4.3"). Note the URLs that were checked — typically just the homepage from automated scans, sometimes a few additional pages.

2. Preserve the current state before touching anything

Before making any changes, document the site as it exists now. This creates a timestamped "before" record that is useful if the matter escalates.

• Take full-page screenshots of the URLs cited in the letter. Use a tool that captures the full scroll height, not just the viewport.
• Run ShipSafe on each cited URL and save the results page (screenshot or PDF). This gives you an independent, timestamped audit of the current failures.
• Record the date you received the letter and the date you first accessed the cited URLs.
• Save the letter itself in a secure location — including the envelope if it arrived by post (some letters are sent certified mail).

Do not delete or modify web server logs if you have them. Access logs may be relevant if questions arise about whether the plaintiff's representative actually visited the site.

3. Fix the cited issues — in priority order

Work through the specific failures the letter names first, then run the full ADA compliance checklist to catch anything the scanner didn't flag. The five fixes most commonly cited in demand letters are fast to implement:

Add lang="en" to the <html> element

Find the opening <html> tag in your base template and add the lang attribute. Use the correct BCP 47 language code for your site's primary language (lang="en" for English, lang="es" for Spanish, etc.). This is a one-line change that propagates to every page instantly if you use a template or layout component.

<!-- Before -->
<html>

<!-- After -->
<html lang="en">

Add alt text to all informational images

Run the free Axe DevTools browser extension on each cited page — it flags every image missing an alt attribute with a specific element selector. For informational images, write descriptive text that conveys the image's meaning. For purely decorative images (borders, background textures, icons that duplicate adjacent text), use an empty alt="" so screen readers skip them entirely.

Associate labels with every form input

Axe will also identify every unlabeled input. The fix is to wrap each input and its visible label text in a <label> element, or use <label for="inputId"> with a matching id on the input. Do not use placeholder text as a substitute for a label — it disappears on input and is not a programmatic association.

<!-- Broken -->
<input type="email" placeholder="Email address">

<!-- Fixed -->
<label for="email">Email address</label>
<input type="email" id="email" placeholder="you@example.com">

Fix color contrast failures

Use the WebAIM Contrast Checker or the colour picker in Chrome DevTools (click any text color in the Elements panel; the contrast ratio appears below the colour wheel). Any text below 4.5:1 against its background fails for normal text; below 3:1 for large text (18px+ or 14px bold+). Darken the text or lighten the background until the ratio passes. The most common failure is light grey body text on a white or near-white background.

Add a skip navigation link

Add the following as the very first element inside <body>, before the header:

<a class="skip" href="#main">Skip to main content</a>

In your CSS, style it to be off-screen by default but visible on keyboard focus:

.skip {
  position: absolute;
  left: -9999px;
  top: auto;
  width: 1px;
  height: 1px;
  overflow: hidden;
}
.skip:focus {
  position: static;
  width: auto;
  height: auto;
  padding: 8px 16px;
}

Add id="main" to your <main> element so the link's target is correct.

4. Document the remediation thoroughly

Your documentation is the evidence that you responded in good faith. Good-faith remediation is the most practically important factor in how these matters resolve for small and mid-size businesses.

• Record the specific changes you made: file names, the old code, the new code, the date of each change. A git commit log with descriptive commit messages is ideal evidence — the timestamps are verifiable.
• Run ShipSafe (or Axe) on each cited URL after fixing and save the results. Capture the date. This is your "after" record.
• Take new full-page screenshots of the fixed URLs. Pair them with the "before" screenshots from Step 2.
• Note the date you completed each fix. If you are fixing multiple pages, document each separately.
• If your site has a git history, the commits documenting your fixes are timestamped by GitHub/GitLab and difficult to dispute.

5. Consult an attorney before responding in writing

Do not send a written response to the demand letter yourself — not even an acknowledgement — without first speaking to an attorney who handles ADA accessibility matters. What you put in writing can affect your legal position, including admissions about prior knowledge of the failures.

Attorneys who regularly handle ADA website demand letters can advise you on:

• Whether the specific claims in the letter are valid under the WCAG criteria cited
• The appropriate response: settlement, a remediation timeline agreement, or contesting the claims
• Whether a settlement demand, if included, is within the typical range for a matter like yours
• How to draft a response that demonstrates good faith without creating unnecessary admissions

Disability rights legal organizations and ADA-focused bar associations can provide referrals. Many accessibility attorneys offer an initial consultation at low or no cost for straightforward demand letter situations.

6. Establish an ongoing accessibility posture

A one-time fix is a starting point, not a permanent solution. Sites change — new pages, new components, third-party widgets, CMS updates — and each change can introduce new failures. After resolving the immediate matter, set up a sustainable posture:

• Add an accessibility statement page — a publicly accessible page describing your commitment to WCAG 2.1 AA, a contact email for reporting accessibility issues, and the date of your last audit. This gives users a resolution path and demonstrates good faith to regulators and courts.
• Schedule quarterly checks — run ShipSafe and Axe on your most-visited pages every three months, or after any significant template or component change. Document the results.
• Test new features before launch — add an accessibility checkpoint to your launch process: Tab-through keyboard test, Axe run on the new component, contrast check on any new color combinations.
• Audit the full checklist at least annually — run through the 30-item WCAG 2.1 AA checklist once a year, not just the items the automated scanner flags.
• Ensure you have a privacy policy if your site collects any personal data. Plaintiff firms that scan for WCAG failures frequently check for missing privacy policies in the same pass — CCPA, CalOPPA, and GDPR each independently require one if you collect emails, names, IP addresses, or analytics data. A missing or inadequate privacy policy can be bundled alongside an accessibility allegation in the same complaint, or sent as a separate demand letter. ComplyKit generates a privacy policy, terms of service, and cookie consent notice in your browser, free, in under two minutes.

HTTP security headers are a complementary layer worth checking at the same time. Missing Content Security Policy, HSTS, and cookie flags are separate from accessibility compliance but are the kind of low-friction hygiene that both security scanners and prospective clients check for. HardenCheck grades your response headers for free — enter your URL or paste raw response headers.

Verify your fixes with ShipSafe

ShipSafe scans your page's HTML for the accessibility failures that appear most frequently in ADA demand letters: missing lang attribute, unlabeled form inputs, images without alt text, contrast failures, and no skip navigation link. Run it on each URL cited in the demand letter after making your fixes to confirm the repairs are reflected in the live markup.

Check my site with ShipSafe →

More ShipSafe guides:

• ADA compliance checklist for web developers — 30 testable WCAG 2.1 AA items
• WCAG compliance for AI-generated sites — the 5 most-flagged gaps and how to fix them
• WCAG 2.1 vs 2.2: what changed and do you need to update your site?
• WCAG remediation checklist for existing websites — fix accessibility issues systematically

Frequently asked questions

Also in the Copper Bay Labs suite

Accessibility is one layer of pre-launch risk. These free tools cover the rest: