AB 2190 defines a statutory framework for internet website accessibility in California by requiring entities to publish an "accessibility" page and a downloadable, date‑stamped digital accessibility report that identifies specific accessibility barriers and remediation timelines. The bill conditions limited protection from statutory damages on either (a) publicly listing a barrier and showing it was remediated within a specified cure period or (b) documenting routine testing, timely remediation, and having an accessible complaint-and-response process.
The measure also regulates resource service providers (vendors) by forbidding them from supplying or representing as conformant any web component they control that causes inaccessibility, and it gives small businesses a direct remedy against vendors for damages paid to plaintiffs. The bill sets a timeline for which WCAG version applies, preserves federal remedies, and establishes mechanisms that will shift how plaintiffs, businesses, vendors, and enforcement agencies litigate and manage web accessibility risk.
At a Glance
What It Does
AB 2190 requires covered entities to maintain a publicly linked "accessibility" page and a downloadable digital accessibility report that lists specific barriers, locations, responsible parties, and remediation dates. It creates two alternative affirmative defenses to California statutory damages for accessibility claims and makes resource service providers liable for providing inaccessible components or falsely claiming conformance.
Who It Affects
Retailers, service providers, and any entity subject to Sections 51, 54, or 54.1 of the California Civil Code that operate public-facing websites or mobile apps; resource service providers (vendors) who construct or maintain site components; small business entities (defined by employee and revenue thresholds) that contract with vendors; and enforcement actors such as the Attorney General and local prosecutors.
Why It Matters
The bill converts a defensive compliance tactic — public reporting and documented testing — into a partial statutory safe harbor and creates a direct statutory cause of action against vendors, shifting legal risk away from some site owners and toward suppliers. It also standardizes the accessibility baseline by tying California to WCAG 2.1 until 2027 and WCAG 2.2 thereafter (unless a stricter federal standard applies).
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 2190 builds a structured remedy-and-reporting regime around website accessibility. At its core the bill requires an entity to host an "accessibility" page, linked from its primary domain and home page, that contains a prescribed disclosure and a hyperlink to a downloadable, date‑stamped digital accessibility report.
That report must identify where each barrier appears, describe how it impedes users (including reference to WCAG success criteria where applicable), name who the entity believes is responsible, and provide both the date the barrier was first published in the report and an expected remediation date. The report must also preserve a rolling history of barriers for at least three years.
For state statutory damages under California's disability-access statutes, AB 2190 creates two alternative affirmative defenses an entity may use if it produces evidence within a specified period after receiving a written pre‑lawsuit demand. One defense hinges on publicly disclosing a barrier and showing it was remediated within a specified cure period after that disclosure.
The second defense requires that the entity had a reasonable, good‑faith belief its site was conformant, documented regular automated and manual testing at the same frequency as site updates, remediated barriers within a specified period after discovery, maintained an accessibility page with a clear policy, and operated an accessible reporting process that acknowledges reports within 48 hours and reviews them within five business days.The bill separately targets resource service providers: it prohibits vendors who, for consideration, construct, license, distribute, or maintain online components from negligently, recklessly, or knowingly supplying or representing as conformant any component they control that causes inaccessibility. Small business entities that paid such a vendor and were injured may recover damages (including amounts they paid in statutory damages and attorneys' fees in suits against the small business).
State enforcement agencies may seek injunctive relief and fees. AB 2190 also sets which accessibility standards govern — WCAG 2.1 AA before January 1, 2027, and WCAG 2.2 AA thereafter unless a stricter federal standard applies — and preserves federal remedies while removing any requirement that plaintiffs follow an ADA pre‑suit notice-and-cure process for state statutory claims based on federal standards.
The Five Things You Need to Know
The bill requires an "accessibility" page, linked from an entity's homepage and primary domain, that must include a prescribed disclosure and a hyperlink to a date‑stamped downloadable digital accessibility report.
A digital accessibility report must list each barrier's location, description, responsible party (or contributor), date first listed, expected remediation date (within a specified cure period), remediation date upon fix, and a cumulative three‑year history.
An entity can assert one of two affirmative defenses to California statutory damages if it either (A) publicly listed the barrier and remediated it within the bill's cure period or (B) can show documented, regular automated and manual testing, prompt remediation within the cure period, an accessibility policy, and an accessible report-and-response process with a 48‑hour acknowledgement and five‑business‑day review.
The bill bars resource service providers from knowingly or negligently providing inaccessible components or falsely claiming conformance and gives small businesses a statutory cause of action to recover damages and fees they paid to plaintiffs as a result of vendor-supplied inaccessibility.
AB 2190 ties the state standard to WCAG 2.1 AA until January 1, 2027, then to WCAG 2.2 AA after that date, but defers to any federal accessibility standard that requires greater accessibility.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions and scope (accessibility page, digital accessibility report, standards)
This section defines core terms the rest of the bill uses, including what counts as an "accessibility" page and what must appear in a "digital accessibility report." It also specifies the meaning of "accessible," "conformant," "resource service provider," and "small business entity," and sets the applicable accessibility standards (WCAG 2.1 AA before 2027, WCAG 2.2 AA thereafter) while allowing a stricter federal standard to control if present. Practically, these definitions scaffold duties and defenses: how an entity labels and structures its reporting page, the format of the downloadable report (nonproprietary, viewable offline), and the small‑business thresholds ($5 million revenue; fewer than 25 full‑time employees) are all treated as statutory building blocks for compliance and litigation.
Affirmative defenses to statutory damages for listed accessibility barriers
This section creates two alternative paths an entity can use to avoid statutory damages under California's accessibility statutes, provided the entity produces evidence within a defined time after a written pre‑lawsuit demand. Path one is narrow and factual: publish the barrier on the digital accessibility report and show that it was remediated within the bill's cure period after initial publication. Path two is process‑based: document a reasonable belief of conformance, routine automated and manual testing aligned with update frequency, remediation within the cure period, a public policy describing testing practices, and an accessible user complaint-and-response system (including retention of reports for three years). The section also specifies operational response times: review reported barriers within five business days and send an acknowledgement within 48 hours.
Vendor (resource service provider) duties and private and public remedies
This provision makes it unlawful for a vendor, for consideration, to negligently, recklessly, or knowingly supply or represent as conformant any web component they control that causes inaccessibility. It grants standing to (1) injured small businesses that contracted with the vendor to recover damages (including amounts they paid in lawsuits), (2) state enforcement entities to pursue injunctions and fees, and (3) individuals or disability‑rights nonprofits when a vendor creates similar barriers across multiple sites. The section also voids contractual clauses shifting liability away from vendors onto small business customers and clarifies that other legal theories (contract, warranty, false advertising) remain available.
Notice-to-remedy and intentional discrimination presumption
If a user with a disability provides the entity written notice describing a specific accessibility barrier and the entity fails to remediate that barrier within the bill's specified cure period, the bill deems the entity to have intentionally discriminated under the state statutory discrimination provisions. This creates a presumptive path to enhanced remedies and signals that timely responses to individual notices carry significant legal consequences.
Procedural and saving clauses (pre‑suit notice, effective date, and federal interplay)
This section clarifies procedural scope: the bill says federal ADA notice-and-opportunity-to-cure requirements do not apply to state statutory claims founded on federal access standards, and it states the part applies to civil actions filed on or after January 1, 2026. It also lists exceptions (for example, video programming subject to federal CVAA rules) and reiterates that the bill does not limit federal rights or indicate Congressional intent regarding federal jurisdiction. These clauses shape litigation strategy by removing a state-level pre‑suit cure prerequisite while preserving federal claims.
This bill is one of many.
Codify tracks hundreds of bills on Civil Rights across all five countries.
Explore Civil Rights in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Entities that proactively report and remediate barriers: By publishing a digital accessibility report and following the bill's procedures, entities can obtain an affirmative defense to statutory damages, reducing monetary exposure for remediated issues.
- Small business entities that contract with vendors: Small businesses can sue resource service providers for vendor‑caused inaccessibility and recover statutory damages and attorneys' fees they paid in suits, shifting remedy power back toward plaintiffs harmed by vendor failures.
- People with disabilities and advocacy organizations: The bill requires more transparency (downloadable, date‑stamped reports, remediation timelines, and an accessible complaint process), which should improve information flow and speed remediation for known barriers.
- State enforcement agencies (Attorney General, Civil Rights Department, local prosecutors): The bill gives public enforcers explicit authority to seek injunctive relief and fees against noncompliant vendors and entities, aiding systemic enforcement.
Who Bears the Cost
- Entities operating public-facing websites and apps: They must create and maintain accessibility pages and downloadable reports, implement testing regimes, respond to reports within strict windows, retain records for three years, and potentially face statutory damages if they fail to meet procedural requirements.
- Resource service providers and vendors: Vendors face potential civil liability (including claims brought by small businesses and enforcement actions) and cannot contractually shift liability away from themselves; they may need to increase testing, documentation, and warranty disclosures.
- Small businesses (operational burden): Even with vendor remedies, small businesses that meet the bill's definition must navigate claims, preserve records, and possibly shoulder compliance costs while pursuing recovery from vendors.
- Enforcement entities and courts: The new statutory constructs — especially reports that must be produced, remediations tracked, and vendor patterns litigated — will create investigative, evidentiary, and adjudicative work that agencies and courts must absorb.
Key Issues
The Core Tension
The bill tries to balance two legitimate goals — incentivizing transparency and remediation by offering conditional protection from statutory damages, and preserving remedies for people harmed by inaccessible websites — but that balance is fragile: offering a self‑help safety valve (public reports and testing) reduces immediate plaintiff recoveries, yet it risks being gamed or producing opaque, proprietary disclosures; tightening cure periods protects users but may be impractical for complex sites or third‑party components.
AB 2190 seeks to convert transparency and documented testing into partial shields from statutory damages, but that design creates several implementation and enforcement challenges. The bill leaves multiple cure periods blank ("____ days") in critical places: remediation after public listing, remediation after identification by testing, and the time to produce evidence after a written pre‑lawsuit demand.
Those blanks are material; the practical value of the affirmative defenses depends entirely on how long the statutory cure windows are set. Short windows may be infeasible for complex fixes; long windows will blunt plaintiff leverage.
The digital accessibility report requirement raises operational and proprietary tensions. The report must name the location and identify parties responsible for a barrier and be downloadable in a nonproprietary format that can be viewed offline — useful for transparency but potentially exposing confidential development relationships or security details.
Requiring an expected remediation date for each barrier also creates pressure to commit to timelines that may be unrealistic for third‑party components. Vendor liability provisions shift risk down the supply chain but will also spark contract and indemnity disputes: vendors may respond by tightening warranties, increasing prices, or refusing services that are hard to make accessible.
Finally, removing the state-level ADA pre‑suit notice requirement narrows procedural hurdles for plaintiffs and may accelerate filings under state law, increasing litigation volume even as the bill purports to create defenses tied to self‑reporting and testing.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.