In April 2024, the U.S. Department of Justice (DOJ) published its final rule updating Title II of the Americans with Disabilities Act (ADA) implementing regulations. This update to 28 CFR Part 35 significantly clarifies and strengthens federal requirements for digital accessibility at state and local government entities. The rule establishes WCAG 2.1 Level AA as the binding technical standard for all digital content, with specific implications for how PDFs are treated. For the first time, a major federal accessibility regulation explicitly and unambiguously includes PDFs in its scope.
This post unpacks what the final rule says, what it means for PDFs specifically, how the compliance timeline works, and what "undue burden" actually means in practice.
Background on the rulemaking process
The ADA was enacted in 1990, predating the internet era. As digital technology proliferated, the law's application to websites, apps, and documents became ambiguous. Different courts, OCR decisions, and DOJ guidance created a patchwork of requirements.
In 2010, the DOJ proposed broad regulations requiring all public entities to make websites accessible. The rulemaking stalled, becoming politically contentious. A conservative administration withdrew it; a subsequent administration proposed it again. The process dragged on for over a decade.
In 2022, a federal court ruled in United States v. Yale University that Title III of the ADA applied to websites, settling a major legal ambiguity. Shortly after, the DOJ announced it would finalize Title II regulations covering state and local government entities. The April 2024 final rule is the product of this renewed push.
The rule was developed with input from thousands of stakeholders (disability advocates, government entities, industry, and the general public) and takes effect immediately upon publication, though enforcement phases in based on entity size.
What the final rule actually requires
The core obligation: WCAG 2.1 Level AA
The final rule establishes a single, clear technical standard: all digital content must conform to Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. This applies to state and local government entities (public agencies, universities, schools, courts, etc.).
WCAG 2.1 AA is an internationally-recognized standard developed by the World Wide Web Consortium (W3C). It contains 50 specific success criteria covering:
- Perceivable: Content must be perceptible to users (text alternatives for images, captions for videos, sufficient color contrast, resizable text).
- Operable: Interface must be usable with keyboard alone, free of seizure-inducing content, navigable by structure, and not confusing.
- Understandable: Text must be readable, predictable, and have error assistance for forms.
- Robust: Content must work with assistive technology and be validated against web standards.
The rule does not invent new requirements; it codifies the internationally-recognized standard that has been the de facto requirement for federal accessibility for years.
Compliance timelines by entity size
The rule staggered compliance deadlines based on total annual revenues or student enrollment (for education institutions):
- Entities with $50 million or more in annual revenue (or 50,000+ students): Compliant by January 1, 2026.
- Entities with $15 million–$50 million (or 5,000–50,000 students): Compliant by January 1, 2027.
- Entities with $7 million–$15 million (or 1,000–5,000 students): Compliant by January 1, 2028.
- Entities with less than $7 million (or fewer than 1,000 students): Compliant by January 1, 2029.
The staggered timeline acknowledges that large entities have more resources and should move faster. Small entities get additional time but must still comply. There is no exemption for any size.
How PDFs are specifically addressed
PDFs are "web content" under the rule
The final rule defines "web content" as "information and related functionality made available through a website or web application, including but not limited to electronic documents." The regulation explicitly states: "Electronic documents include, but are not limited to, PDF files and other digital file formats."
This is significant because it removes ambiguity. For decades, there was debate about whether PDFs qualified as "web content" subject to accessibility law. Some argued PDFs were "documents," not "web content," and therefore exempt. This argument has been decisively rejected by the final rule.
Scope: Any PDF available on a government website, in an email sent on government business, posted to a government cloud storage, or otherwise made available by a public entity is covered. This includes:
- PDFs on government websites and agency portals
- Downloadable forms (tax forms, permit applications, licensing documents)
- Reports, policies, and administrative documents
- Course materials in public university learning management systems
- Library digitized collections and archives
- PDFs in government databases and search systems
- Email attachments (when sent to the public or service applicants)
No carve-out for legacy content: The rule does not say "make new PDFs accessible" or "legacy PDFs are exempt." All PDFs must be accessible within the compliance timeline. However, the rule does provide flexibility through the "undue burden" provision (discussed below).
What "accessibility" means for a PDF
The rule requires PDFs to meet WCAG 2.1 AA, which means:
- Properly tagged structure: The PDF must have a logical structure tree (tags) that describes headings, paragraphs, lists, tables, and other content elements. Screen readers rely on tags to navigate and understand the document.
- Alt text on images: All images and figures must have meaningful alternative text describing the content and function.
- Accessible tables: Tables must have marked-up headers with scope attributes so screen readers can announce row and column headers with each cell.
- Form accessibility: Interactive forms must have labeled fields and clear instructions. Users must be able to fill out and submit forms using keyboard alone.
- Accessible color and contrast: Text must have sufficient color contrast (4.5:1 ratio for normal text, 3:1 for large text) and must not rely on color alone to convey information.
- Resizable and reflow-friendly: Content must be usable when zoomed to 200% and must reflow in a single column when zoomed.
- Readable fonts and language: Text must use clear fonts, define the language of the document, and explain abbreviations.
- Searchable text: Scanned images with text must be OCR'd so text is extractable.
Most of these requirements are automatically met by properly-structured, natively-digital PDFs. Scanned PDFs without OCR, or PDFs with poor structure, require remediation.
The "web content" definition and PDFs
One area of remaining ambiguity: Does every document in a government entity's possession have to be made a PDF and put online, or only documents that are actually available through websites or digital means?
The rule's answer: The obligation applies to "information and related functionality made available through a website or web application." This is a critical qualifier. A dusty file cabinet full of paper documents that have never been digitized is not "made available through" a website. The obligation does not require digitizing legacy paper documents.
However, once a document is digitized or made available online (by the entity or a third party), it must be accessible. Many entities have digitized historical documents, posted them to websites or archives, and failed to remediate them for accessibility. These documents trigger the rule's requirements.
Practical implication: State and local government entities should audit their digital holdings (websites, portals, databases, document repositories, LMS platforms). Documents found there must be accessible within the compliance timeline. Documents not yet digitized do not trigger an obligation to digitize them, but if they ever are digitized, they must be made accessible before posting.
The equivalent facilitation provision
The rule includes a provision for "equivalent facilitation." In limited cases, if an exact WCAG-compliant version of content cannot be created (e.g., legacy software limitations, technical constraints), an entity may instead provide an alternative that achieves equivalent accessibility.
Example: A scanned historical document image cannot be made truly accessible (it's just pixels). An entity could provide the scanned image plus a text transcript or an accessible HTML version as an equivalent alternative.
However, equivalent facilitation is a limited exception, not a standard practice. The DOJ expects most content to be directly accessible via WCAG compliance, not sidestepped through alternatives.
Safe harbor and the "undue burden" exception
What "undue burden" actually means
The most discussed provision in the rule is the undue burden exception. Public entities do not have to comply if doing so would impose a "fundamental alteration" in the operation of the program or an "undue financial or administrative burden."
But the burden of proof is on the entity, and the bar is high.
An entity claiming undue burden must document:
- Why the content cannot be made accessible (specific technical or practical reason, not vague cost concerns).
- What alternative formats or services were considered.
- That the determination was made by a senior official (not a department head or IT staff member).
- That the decision was made in writing, with reasoning, and is subject to periodic review.
The DOJ provides guidance on what does not qualify as undue burden:
- "We have too many documents." Volume alone is not undue burden. If an entity has 50,000 documents and can remediate 1,000 per month, that's a plan (5 years), not undue burden.
- "It's expensive." Cost is relevant only if it truly prevents the entity from operating (e.g., a small town with a $500k budget cannot spend $10M on accessibility). For large government agencies and universities with multimillion-dollar budgets, cost arguments are weak.
- "We don't have the expertise." This is what contractors and software vendors exist for. It's not undue burden; it's a business decision to hire help or buy tools.
- "Legacy software is hard to update." If the software truly cannot be updated or replaced, the entity must provide alternative accessible formats or modes of service.
What "undue burden" might justify
The DOJ's own examples are narrow:
- A small city with 300 residents and very limited budget might have undue burden making a website accessible if it would require hiring staff it cannot afford. But even then, the city would still need to provide alternative services (like accepting in-person applications instead of online-only).
- A niche legacy database with highly specialized, unavoidable inaccessible technology might qualify, but the entity would need to provide accessible alternatives (like printed reports or staff assistance).
- Extraordinarily high remediation costs for a genuinely essential but unavoidable barrier might qualify, but this would be documented and subject to periodic review.
In practice, very few entities will successfully claim undue burden. The DOJ has been clear that this is an exception, not the rule.
Alternative formats and individualized accommodations
Even if an entity cannot fully remediate content, it must still provide accommodations. If someone requests an accessible version of a document and the entity says "undue burden," the entity must provide an alternative (like OCR'd text, a transcript, or human assistance).
The entity cannot simply say "not accessible, nothing we can do." It must try.
Enforcement mechanisms and penalties
How the rule is enforced
OCR investigations: The Office for Civil Rights investigates complaints from students, employees, or members of the public. A single inaccessible course syllabus or form can trigger a formal investigation of the entire entity.
Pattern and practice reviews: OCR can initiate investigations proactively, without a complaint, if it suspects systemic non-compliance. This is increasingly common for large universities and state systems.
Compliance agreements: When OCR finds violations, it enters into a resolution agreement with the entity. These agreements typically require:
- A comprehensive audit of all digital content
- A remediation plan with timelines and milestones
- Monthly or quarterly progress reporting
- Hiring of accessibility staff
- Third-party audit to verify compliance
- Ongoing monitoring for 3–5 years
Entities subject to compliance agreements report that the costs and disruption are substantial, often exceeding what proactive compliance would have cost.
Penalties and consequences
Loss of federal funding: OCR can threaten or recommend loss of federal funding (grants, student aid, contracts) for egregious, unresolved violations. This is rare but used as leverage in serious cases.
Legal liability: While the Title II regulation itself does not create a private right of action to sue, the underlying ADA does (through Section 504). Courts have interpreted the ADA to include websites and digital content as covered services. Plaintiffs can sue for attorney fees and damages.
Injunctive relief: Courts often order injunctive relief requiring the entity to remediate content and implement systematic compliance monitoring, often at significant cost.
Reputational damage: Entities subject to OCR investigations or lawsuits face negative media coverage and loss of trust.
Relationship to existing Section 508 requirements
Section 508 of the Rehabilitation Act is a separate law that applies specifically to federal agencies (not states or localities). It predates the ADA and has been in effect since 1998. Its requirements are similar to WCAG 2.1 AA, and most compliant documents meet both standards.
The 28 CFR Part 35 rule does not change Section 508. Federal agencies remain subject to Section 508 and the General Services Administration (GSA) standards that implement it. State and local entities are not directly covered by Section 508 but must comply with Title II of the ADA (which the new rule clarifies).
Practical implications for organizations managing PDF libraries
Audit your holdings
Start by identifying all PDFs your organization makes publicly available or that are available through your website, portal, or digital platforms. Use automated tools to detect accessibility issues:
- PAC 2024: Scans PDFs for WCAG 2.1 AA compliance and provides detailed reports.
- Axe PDF: Browser plugin that flags inaccessible PDFs linked from websites.
- PDFUA Validator: Checks PDF/UA (ISO) compliance, a proxy for WCAG compliance.
Quantify the problem: How many PDFs? What percentage are inaccessible? What are the most common issues? This data informs your remediation strategy and timeline.
Prioritize by usage and criticality
Not all documents are equally important. Prioritize:
- Tier 1 (by Jan 1, 2027 or 2028): High-traffic documents linked from main website, forms required for services (permit applications, benefit forms), commonly-requested documents.
- Tier 2 (by compliance deadline): Medium-traffic documents like policies, guidelines, informational brochures.
- Tier 3 (after compliance deadline, if undue burden claimed): Low-traffic or archival documents with alternative formats available.
Implement a remediation workflow
For small organizations: Use automated remediation tools (RemeDocs, Acrobat's Make Accessible) to process the backlog. Budget $5k–$20k one-time; then sustainable costs for new content going forward.
For large organizations: Establish a dedicated team or role. Allocate budget for staff, tools, and training. Use automated tools for bulk processing, but plan for human review of complex documents. The rule's compliance timelines are generous only if you start immediately.
Prevent new inaccessible content
This is the highest ROI activity. Establish policies:
- All new PDFs must be created with accessibility in mind (using templates, proper styles, etc.).
- All documents must be tested before posting (using PAC or similar tools).
- PDFs posted without accessibility testing are removed until compliant.
- Departments and staff are trained on accessible PDF creation.
Once new content is consistently accessible, you only need to manage the legacy backlog, which is finite and decreasing over time.
Document your good faith effort
Even if you do not achieve 100% compliance by the deadline, document your effort:
- Written plan for remediation with timelines
- Monthly progress reports
- Budget allocation and staff assignments
- Tools and services contracted
- Training delivered to staff
If OCR investigates, evidence of good faith effort and systematic progress is powerful. Entities that make credible progress toward compliance often avoid penalties or are treated more leniently. Entities that ignore the rule invite aggressive enforcement.
Key takeaways
1. PDFs are explicitly covered. There is no ambiguity anymore. Every PDF a public entity makes available must be accessible within the compliance timeline.
2. The timelines are real and enforced. The DOJ and OCR are actively monitoring compliance. Entities that miss deadlines face investigation and enforcement.
3. "Undue burden" is narrow and rare. Claiming undue burden requires documentation, good faith effort, and alternative formats. It is not an escape hatch.
4. Preventive compliance is cheaper than remediation. Making new PDFs accessible from the start costs far less than remediating thousands of legacy documents. Implement accessibility in your creation workflow immediately.
5. Plan and budget now. Organizations that wait until 2026 or 2027 will face emergency remediation. Organizations that start now can achieve compliance methodically and within reasonable budget.
The 28 CFR Part 35 rule is unambiguous and legally binding. PDFs are web content. They must be accessible. The time to plan and act is now.