WCAG 2.1 Compliance: How does it apply to password-protected web and native apps

Question

As stated in the title, I'm curious if anyone has resources explaining (or experiences with) any adjusted WCAG criteria for "gated" applications. Does something being behind a password wall, with specialized tools and even more advance functionality tied to having a business credit card, fall into the same bucket as general web requirements (I oversee design at a fintech). Fortunately, I'd designed it so that the vast majority of our application is already visually compliant (couple of color contrasts to adjust, but no biggy), but the markup itself has some shortcomings, and it's unclear if it's an all-or-nothing deal for apps that are...pseudo-public.

To be very clear: not looking for excuses to avoid making our application compliant. I have an extensive background in designing public sites and apps for non-profits and government entities, and am comfortable with and a huge proponent of digital accessibility. It's all gonna get done, as fast as possible. However, I have limited resources at the moment, so it's a matter of what is a requisite and should be done first, vs. fast follows.

I've scoured WCAG guidelines, supplemental material, etc., and have yet to find a definitive answer one way or the other. Any advice would be much appreciated.

Answer 1

I read WCAG as what tests my application needs to pass to be accessible. To be on level AA you need to pass certain tests and so on. To me WCAG has no exceptions, my application is accessible on level A, AA or AAA, or it isn't.

What WCAG doesn't tell me is when these tests need to be passed for my application to be considered accessible, when my application needs to be accessible. That comes from the legislation.

Seeing that you are from United States, isn't Section 508 the legislation you should consult to see whether your application needs to be accessible or not, and to what extent?

From a quick scan, Section 508 looks similar to European legislation in that only federal agencies need to have accessible applications, others can be as accessible as they want.

Answer 2

WCAG 2.1 defines what it means to conform to its own guidelines. It does not say what level you should conform to nor what types of sites should conform to it. In fact, that it is totally outside its scope. Standards are voluntary until legislation says that conformance to a specific standard is mandatory.

While WCAG 2.0 was being drafted (now over a decade ago), there was a lot of work on harmonisation between WCAG and the Section 508 refresh in the USA, for example. Another important piece of legislation in the USA is the Americans with Disabilities Act (ADA). In 2019, the Supreme Court found that the ADA did not only apply to brick-and-mortar public accommodations but also to the websites and apps of businesses. See Supreme Court allows blind people to sue retailers if their websites are not accessible (Los Angeles Times, 7 October 2019). The article Another Big Win in the Domino’s Pizza Accessibility Saga on Lainey Feingold's website (June 2021) also adds (emphasis mine):

The judge issued an injunction ordering Domino’s to bring its website into compliance with WCAG 2.0. [The court did not consider WCAG 2.1 which was not in existence when the case was filed.]

In the European Union, the Web Accessibility Directive, adopted in 2016, has become effective and applies to all public sector organisations. Since EU legislation cannot reference W3C recommendations directly (since the W3C is not an official European standardisation body), the Web Accessibility Directive references ETSI EN 301 549, which in turn references WCAG 2.1.

The European Accessibility Act, adopted in 2019, will apply to the majority of products and services sold on the European market. Member states still have some time to comply, so the Accessibility Act has no practical legal consequences yet.

Even before the Web Accessibility Directive was adopted at the EU level, it was possible for citizens to sue companies for accessibility reasons, but they had to rely on their country's more general anti-discrimination legislation rather than on legislation that referenced a specific technical standard.