Join Natalie and Natalie for the fourth episode of the AAArdvark Accessibility Podcast, where they discuss the different types of accessibility audits. We’ll also chat about the laws surrounding these audits and why they’re important for different countries.
Natalie Garza: Hello and welcome, everybody, to our fourth AAArdvark Accessibility Podcast. Today, joining me is Natalie.
Natalie MacLees: Hi, Natalie.
Natalie Garza: My name is Natalie.
Natalie MacLees: Hi, Natalie.
Natalie MacLees: Natalie and Natalie.
Natalie Garza: We’ve got the two Natalies joined up again. And in today’s episode, we’re going to discuss WCAG audits—or website audits in general, right?
So last week, we talked about the whole auditing accessibility process. And one of those parts was getting the audit done. So, Natalie, go ahead and kick us off. What are the different types of audits out there?
Natalie MacLees: Oof.
Uh, okay. So, if you’re in the United States and doing business with the government, then you have Section 508. Section 508 is the 508th section of the Rehabilitation Act of 1973. And you might be thinking, “There weren’t any websites in 1973. What are you talking about?”
But Section 508, or the Rehabilitation Act in general, is just a law saying any technology used by the federal government has to be accessible. The exact rules for what that means are set up separately as regulations by the Department of Justice. The Department of Justice is constantly adjusting those rules, and, obviously, once websites became a thing, they added those to the list.
There are now requirements that websites must be accessible. The Department of Justice has a page where you can learn more about that. It requires all websites for businesses that do business with the public to be WCAG AA compliant, which we’ll talk about in a minute.
But if you’re building a website for the federal government or one to be used by the federal government, it will need to be Section 508 compliant. So, you’d need to do an audit to make sure you’re meeting those Section 508 rules.
That’s called a Trusted Tester audit, and it can only be done by people who hold a Trusted Tester certification from the federal government.
We also have a bunch of laws tied to specific WCAG versions. For example, the Department of Justice requires WCAG AA compliance, and most other accessibility laws around the world do the same or something roughly equivalent to it.
WCAG, of course, has several versions currently in play: 2.0, 2.1, and 2.2. They’re all very similar, sharing the same set of success criteria, but 2.1 adds a few more, and 2.2 adds a few more.
Currently, U.S. law is still using 2.1, and I think that’s the case for many international laws as well. But they should start using 2.2 very soon. By 2025, I’d expect most governments to switch to WCAG 2.2.
WCAG also has three levels of compliance: A, AA, and AAA.
- A is the bare minimum you can do to say your website is accessible.
- AAA is the most you can do to meet the highest level of guidelines.
Even so, AAA doesn’t include all best practices you could implement. But according to the guidelines, AAA is the highest level.
Most laws refer to AA compliance. Even the WAI (Web Accessibility Initiative), who writes the WCAG standard, doesn’t recommend trying to build a website that’s AAA compliant. It’s just too difficult, expensive, and time-consuming for most cases.
What you can do is build your site to be AA compliant and then choose specific parts of AAA that are especially important to your audience and implement those.
If you’re in the EU, you also have the EU equivalent of Section 508, called EN 301 549. I don’t know if there’s a specific way people pronounce that law, but it’s essentially the EU’s standard.
Any websites for EU governments or anything associated with the European Union need to comply with that law, which is roughly equivalent to WCAG AA.
Lastly, we have what’s commonly called a VPAT. That stands for Voluntary Product Accessibility Template. The “template” part is important because the report you create isn’t actually a VPAT—it’s an ACR (Accessibility Compliance Report). But no one calls it that; everyone just calls it a VPAT.
There are different versions of VPATs for Section 508, WCAG 2.0, WCAG 2.1, WCAG 2.2, and EN 301 549. You download the template, fill it in, and go line by line to determine whether your website complies with each rule.
You can indicate compliance, partial compliance, non-compliance, or mark a rule as not applicable. For example, rules requiring captions for videos wouldn’t apply if you don’t have any videos.
It’s a lot.
Natalie Garza: Take a breath.
It is a lot. I guess…do you want to go through a speed round?
Natalie MacLees: Yeah.
Natalie Garza: Okay. I have a few questions.
Section 508: Does it apply to government, state, and county websites?
Natalie MacLees: Yes. It also applies to any organizations receiving federal funding, including public schools from kindergarten to college.
Natalie Garza: Wow, even state-funded universities?
Natalie MacLees: Yes. And even many private universities receive some federal funding, so it applies to them too.
Natalie Garza: For Section 508, you mentioned needing a certified tester. Is that true for all the other audits?
Natalie MacLees: No, it’s only true for Section 508. And even then, it’s only required if you’re auditing for a federal government entity. For example, if you’re auditing the Department of Justice’s website, you’d need a Trusted Tester certification from the Department of Homeland Security.
Natalie Garza: Fun. I love the U.S. Department of Homeland Security.
Natalie MacLees: Yeah. Why it’s Homeland Security, I don’t know. That came up in a discussion in one of my accessibility communities, and no one really knows.
Natalie Garza: They want to secure the website experience of their homeland. Mystery solved.
Natalie MacLees: Maybe.
Natalie Garza: How often should you get audits done?
Natalie MacLees: It depends on how often you’re changing your website. If you change it a lot, every six months is a good idea. If you don’t change it much, once a year should be fine.
Natalie Garza: Does this explain why the government never updates their websites?
Natalie MacLees: It might be a tiny 1% part of the explanation.
Natalie Garza: That’s fair, but 1% isn’t enough.
Alright, we’ve covered the U.S. and the EU, but there are more countries with accessibility laws, right?
Natalie MacLees: Oh, yeah. Countries like Australia, Brazil, Canada, and Japan all have accessibility laws.
Natalie Garza: Thank you. One last question: What’s the difference between an audit and a VPAT?
Natalie MacLees: A VPAT—or ACR, to be technically correct—is a report meant to be shared with others. For example, if you make software and the federal government wants to buy it, they’ll ask for your VPAT as part of the procurement process.
An audit report, on the other hand, is usually for you or your developer to fix issues. A VPAT is more formal and public, detailing who did the testing, how it was done, and when.
Natalie Garza: Does anyone check VPATs for accuracy?
Natalie MacLees: That’s the responsibility of the person creating it.
Natalie Garza: So someone could fake a VPAT?
Natalie MacLees: They could, but they’d get in trouble if caught. If there’s an obvious accessibility error not listed in the VPAT, that’s a problem.
Natalie Garza: So, for U.S. viewers, what laws are in place right now regarding audits?
Natalie MacLees: There’s no law requiring audits, but accessibility is required. For example, the Department of Justice ruled last year that businesses serving the public must comply with WCAG 2.1 AA.
Some states have additional laws, and California is debating a law requiring websites to be audited before launch by certified professionals.
Natalie Garza: That sounds like a logistical nightmare.
Natalie MacLees: It would be—millions of websites needing certified audits and only so many certified people to do them.
Natalie Garza: Well, Natalie, I think we’re out of time. Where can people get started with audits?
Natalie MacLees: At AAArdvarkAccessibility.com. You can sign up for free, scan your homepage, and get guidance on fixing accessibility issues.
Natalie Garza: Thank you, Natalie. And thank you, viewers, for joining us for the fourth episode of the AAArdvark Accessibility Podcast, where we went over audits.
