How to respond to an ADA demand letter

Why these letters keep arriving

ADA Title III website demand letters are sent in volume. Most are produced by a small number of firms running automated scans against large lists of sites. The letter usually names a handful of WCAG failures, a user who could not complete a task, and a settlement figure. The letter is the start of a process, not the end of one. Responding to the specific findings in the letter without understanding the wider state of the site is the most common, and most expensive, mistake organizations make.

Step 1. The first 72 hours

Do not reply to the sender. Do not call them. Do not make on-the-fly changes to the pages named in the letter. Three things need to happen, in this order:

1. Route the letter to your general counsel or external counsel. If you do not have counsel familiar with ADA Title III website matters, your broker or insurer can usually refer one.
2. Preserve the site as it was on the date of the letter. Take a full crawl, screenshots of the pages cited, and a copy of any PDFs or third-party widgets referenced. This is your evidence of state. Do not edit the cited pages until this is captured.
3. Notify your insurance broker. Many cyber, E&O, and general liability policies have notice requirements measured in days. Late notice is a common reason claims are denied.

Step 2. Notify your broker and check the policy

Send the letter to your broker the same week. Ask, in writing, three questions:

• Does the policy respond to this matter?
• What is the retention or deductible?
• Are there panel counsel requirements?

Get the answer in writing. If the policy does not respond, you know now rather than after legal spend has accumulated. If it does, you have a record of timely notice.

Step 3. Get an independent read of the site

The plaintiff's letter describes what one party found. It does not describe the full state of your digital estate, and it does not describe what a regulator, a different plaintiff, or an AI assistant would find next week. You need an independent assessment that covers:

• Every website, subdomain, and microsite the organization owns, including sites the digital team has lost track of.
• PDFs, forms, and embedded third-party content.
• A measurable score against WCAG 2.1 AA, with dated evidence.

This is the work the risk audit is built to do. The point is not to argue with the plaintiff's findings. The point is to know your own position before you negotiate, so you are not settling on a scope someone else defined.

Step 4. Do not install an overlay

Overlay widgets, the JavaScript scripts that promise to make a site accessible by adding a toolbar, are a documented driver of further litigation, not a defense against it. Plaintiff firms specifically target sites running overlays. Courts have not accepted overlays as a substitute for accessible code. Installing one after a demand letter signals that the organization tried to paper over the issue and creates a fresh evidentiary problem.

A comparison of the available approaches is set out in RCP vs overlays.

Step 5. Build a remediation record that holds up later

Whatever counsel negotiates, the underlying work is the same: identify the failures, fix them, prove they were fixed, and keep them fixed. Three things matter for the record:

• A dated baseline. What did the site score on the day the letter arrived?
• A dated remediation log. What was changed, when, and by whom?
• Continuous evidence. Is the site still in that position thirty, sixty, ninety days later?

A one-off audit produces a snapshot. A snapshot does not protect against the next letter, because by the time it arrives the site has drifted. Continuous protection describes the monitoring pattern that produces this evidence over time.

Step 6. Settlement, fees, and the trap of "we'll fix the named pages"

Many letters offer a settlement figure to close the matter on the named pages. Counsel will handle the negotiation. The operational point is this: agreeing to fix only the pages cited in the letter does not reduce the chance of a second letter, from a different sender, naming different pages, the following month. Scope the remediation to the site as a whole, not to the plaintiff's sample.

Step 7. Close the loop with the rest of the business

After the matter is resolved, three internal actions reduce the chance of a repeat:

• Procurement: add accessibility requirements to vendor contracts so liability does not sit only with you.
• Publishing: agree the standard (WCAG 2.1 AA) and who signs off before content goes live.
• Monitoring: agree the cadence and the owner. Without an owner, the position drifts back.

What this is not

This guide is general information about responding to ADA Title III website demand letters in the United States. It is not legal advice. Specific letters require specific counsel.

Related reading

• ADA compliance checklist
• ADA Title II deadline
• Costs coverage
• Risk audit