Knowledge base
Vendor-Run Websites: Why the ADA Obligation Stays With You
Most government websites are built, hosted and updated by an outside vendor, and the DOJ wrote its rule with that fact in view. The rule covers web content an entity provides "directly or through contractual, licensing, or other arrangements." Outsourcing the website does not outsource the obligation.
Sources
Key takeaways
- The rule's own example: a county page built and updated by a web design company still has to meet WCAG 2.1 AA, and the county still answers for it.
- Portals count: permitting, payment and records systems from third-party vendors are the entity's web content under the rule.
- Vendor content is not excepted: none of the rule's narrow exceptions is "a vendor runs it."
- The management answer: put WCAG 2.1 AA in the contract, and have someone independent of the vendor measure it.
What exactly does the rule say about vendors?
The regulation, 28 CFR § 35.200, covers the web content a public entity provides or makes available directly or through contractual, licensing or other arrangements. The DOJ's fact sheet uses the example itself: a county's website built and updated by a web design company must meet the standard, and the county remains responsible.
Which vendor-run websites and systems are caught?
The ones residents actually touch: permitting and licensing portals, utility payment systems, records request tools, job application platforms, meeting agenda systems and school enrollment portals. Each one is web content made available by the entity, whoever's logo is in the footer.
In detail
These systems are also where accessibility problems concentrate, because they are the most interactive things an entity publishes: multi-step forms, date pickers, file uploads, payment flows. They are precisely the content a resident with a disability cannot route around, and precisely the content a vendor's marketing one-pager says is "fully compliant" without a test date attached. Treat that claim as a thing to verify, never a thing to file.
How do you manage an obligation someone else operates?
With a contract and a measurement. The contract names WCAG 2.1 Level AA, puts remediation duties and timelines on the vendor, and survives renewals. The measurement is independent testing of the vendor's work, because a vendor grading its own accessibility saves itself a repair with every defect it misses.
In detail
That separation is the core of how ADA Site Monitor works: we sell no hosting, design or content services to the entities we monitor, so a finding costs us nothing to report. The initial assessment measures every property including the vendor portals, findings go to the vendor with remediation guidance, and the monthly scan verifies each fix and watches for regressions after the vendor's next update. The dated record that results shows your board, and anyone else who asks, that the entity managed the obligation rather than assuming the vendor had it.