The California Attorney General’s final proposed regulations under CCPA (“Regulations”) have been submitted, and pending approval by the California Office of Administrative Law, will soon become enforceable by law. One often overlooked requirement of the CCPA is the obligation of covered businesses to provide notices that are “reasonably accessible.” All drafts of the Regulations have provided more detail about the accessibility requirement contained in the CCPA, and the final Regulations make clear that for notices provided online, businesses must follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 (WCAG) from the World Wide Web Consortium. While companies have largely focused on updating the language or substance of their notices to comply with CCPA, this requirement as to form has, by and large, slipped through the cracks, but is certain to generate some discussion (if not litigation) in coming months.
By way of background, the Americans with Disabilities Act (ADA) requires, among other things, that places of “public accommodation” remove barriers to access for individuals with disabilities. While this has long been considered the rule for physical establishments, including privately-owned, leased or operated facilities like hotels, restaurants, retail merchants, health clubs, sports stadiums, movie theaters, and so on, virtual accessibility has been much less consistent, and generally the exception rather than the norm. In fact, web accessibility hardly ever appears on businesses’ radars, due perhaps to a very short-sighted perception of what, in fact, qualifies as a disability as well as a lack of overall guidance.
Web accessibility means ensuring that websites, mobile applications, and other virtual platforms can be used by everyone, including those with disabilities, such as impaired vision. However, what exactly is required is a source of confusion. In 2019, the Department of Justice (DOJ), which is responsible for establishing regulations pursuant to the ADA, withdrew regulations that had been drafted for website accessibility, and has since yet to promulgate any such regulations. This has left courts with the task of determining how and to what extent web accessibility is required under the ADA when it comes to businesses that offer goods and services online, with varying results.
A number of courts have sided with individuals filing claims against companies that do not offer web accessibility, and this is an area of increasing litigation. By and large, lower courts have found that the statute applies, although there is quite a bit of disagreement as to when and how the ADA applies. One such recent case, Robles v. Domino’s Pizza, LLC , provides additional insight. The Robles case involved a claim filed by a blind man, who was unable to access Domino’s online services (both web and mobile app) using special screen-reading software for the visually-impaired. According to the facts, on at least two occasions, the plaintiff had unsuccessfully attempted to order online a customized pizza from a nearby Domino’s because, the plaintiff contended, Domino’s had failed to design both its website and app so that his software could read them. The Court of Appeals for the Ninth Circuit reversed a ruling of the District Court, which had dismissed the case on the narrow basis that the DOJ’s failure to promulgate ADA-related guidance and regulations for web accessibility violated Domino’s due process rights, and ruled in favor of the plaintiff. In particular, the Court of Appeals stated that “[w]hile we understand why Domino’s wants DOJ to issue specific guidelines for website and app accessibility, the Constitution only requires that Domino’s receive fair notice of its legal duties, not a blueprint for compliance with its statutory obligations.” The Supreme Court subsequently denied a petition by Domino’s Pizza for a review of the Ninth Circuit’s decision, despite major efforts (backed by multiple retailers and associations) to persuade the Supreme Court to intervene.
Importantly, web accessibility lawsuits have significantly increased in recent years, and will continue to because of and despite the lack of guidance from the DOJ: 2,250 federal suits asserting ADA violations based on website or mobile application inaccessibility were filed in 2018, nearly triple the number from the year before, according to Domino’s brief. This will be further compounded by the fact that many businesses now only conduct their operations online.
Turning back to the CCPA and the accessibility requirements, the Regulations do in fact appear to have provided some blueprint for compliance, and covered businesses will need to ensure that their notices and all methods by which consumers can exercise their rights are accessible. Not doing so could have some important consequences. Yes, the consumer private right of action under CCPA is currently limited to certain security incidents, which restricts litigation regarding the accessibility of CCPA notices alone. Nevertheless, the fact that such a high-profile law as the CCPA specifically calls out accessibility and provides the means by which compliance may be achieved is likely to generate more discussions on accessibility. This in turn may lead to greater scrutiny of the accessibility of websites AND the privacy notices and legal terms that they contain. Whether the CA Attorney General makes this a priority now that enforcement has begun remains to be seen.
However, one can imagine a number of scenarios where the lack of accessibility may indirectly play out, notably in the event of a dispute. One such scenario could involve the reliance on arbitration clauses typically buried in online terms of use to avert a class action under CCPA in the event of a data breach. It’s no secret that online terms of use (which incorporate by reference a business’ privacy notices) are extremely one-sided against consumers, and many are not accessible. If a court were to determine that a company’s terms of use are not accessible to individuals with disabilities, the validity of the clause may be called into question – and a costly class action under CCPA in the event of a data breach would be able to proceed.
Businesses can refer to generally recognized industry standards, such as the WCAG (version 2.1) available here. These provide an overview of the private industry standards for website accessibility developed by technology and accessibility experts. The WCAG 2.0 have been widely adopted, including by federal agencies, which conform their public-facing, electronic content to WCAG 2.0. Aside from the fact that the web should be all-inclusive, business owners – and particularly those whose offerings are considered to be made available to the general public – should take steps to ensure that their websites and mobile apps, including all of their legal disclaimers, notices and privacy-focused terms, are accessible to users with disabilities. There is little doubt that we can expect to see an increase in ADA website litigation, and the CCPA may be just the catalyst for this.