What is actuallyhappening in the filings.
Accessibility litigation stopped being an edge case somewhere around 2023 and became a volume practice. The numbers below describe an industry, not an accident, and the fourth one is the claim most teams have not priced at all.
Federal website accessibility suits filed in 2025, up 27% over 2024. UsableNet projects 2026 finishes roughly 20% higher again.
UsableNet 2026 Midyear Digital Accessibility Lawsuit ReportShare of filings coming from the top ten plaintiff firms. One Illinois firm alone files better than one in five cases nationally. This is templated volume work, not selective enforcement.
Seyfarth Shaw ADA Title III, 2026Share of 2025 federal cases naming a company that had already been sued once and never fixed the underlying code. Settling is not remediating.
UsableNet, 2026Statutory damages per violation under California's wiretapping statute, with no requirement to prove harm. That is the second claim, and it runs against your tag manager.
California Invasion of Privacy ActNobody audited you.A template did.
An accessibility claim does not begin with a customer complaint routed through your support desk. It begins with a scan, run at scale, that flags a handful of well-known failures on a page anyone can load. The findings are dropped into a filing template, and the same template is used again the following week against someone else.
A scan finds you
Automated tooling sweeps thousands of sites for the same short list: unlabeled form fields, images without alternatives, contrast below threshold, a keyboard trap in a modal, a menu that never announces itself.
A letter arrives
Counsel for a named plaintiff sends a demand describing the barriers and asking for a remediation commitment and fees. Nothing has been filed yet. Most matters resolve here.
Or a complaint is filed
If the letter is ignored or the response is slow, a complaint follows in federal court. Now you have your own counsel, a docket, and a deadline you did not set.
A consent decree follows
Settlement typically carries a remediation schedule, third-party verification, and a monitoring period. That is the part with the engineering cost attached.
Forty-five percent of 2025 federal cases named a company that had already been sued once. They settled the first claim and never touched the code.
Targeting is not random.It follows the platform.
E-commerce and retail draw the majority of accessibility filings, and Shopify-based sites accounted for 44% of Q1 2026 filings. That is not a comment on Shopify. It is a comment on themes: a popular theme with a known set of defects gives a plaintiff firm one scan pattern that works against thousands of merchants.
What the scan finds on a storefront
The failures cluster in the same places on almost every store, because they come from the theme, the app stack, and the checkout, not from anything a merchandiser did. A theme update reintroduces them. An app added for a promotion brings its own.
Roughly a quarter of recent filings targeted sites that already had an accessibility widget installed.
In January 2025 the FTC fined a leading overlay vendor $1 million for misrepresenting the product as guaranteed compliance. An overlay sits on top of the markup and cannot repair the markup underneath it. In diligence it reads the same way it reads in court: as a purchase, not a remediation.
EcomBack Q1 2026; Federal Trade Commission, 2025Of Q1 2026 filings named a Shopify-based site. If you run a common theme with a common app stack, you are inside the pattern a template was built against.
EcomBack, Q1 2026You are unlikely to bethe volume target. That is the trap.
A B2B marketing site draws fewer templated filings than a storefront, and teams read that as safety. The exposure sits somewhere else: in the logged-in application, and in procurement, where accessibility is a document your buyer asks for before signing.
The application, not the brochure
The highest-risk interactions in a B2B business are almost never on the marketing site. They are in the customer portal, the quote and configuration flow, the scheduling tool, the document upload, the dashboard your customers work in daily, and the internal application your own employees use. Those surfaces were built by product teams against functional requirements, and they were rarely tested with a screen reader or a keyboard alone.
Procurement asks first
Enterprise, healthcare, education, financial services and any buyer touching public funds increasingly require a conformance statement before a contract moves. The request usually arrives late in a deal, from security review or legal, and it asks for something specific: what standard you tested against, when, by whom, and what is still open. A vendor who cannot answer stalls in the last mile of a cycle that took nine months to build.
This is the version of the risk that shows up as lost revenue rather than legal spend, and it is the one that reaches the sales team's number. It is also the easier one to fix, because a documented audit with a prioritized remediation plan is itself the answer to the question.
In commerce, accessibility is a litigation cost. In B2B it is a sales cost first, and a litigation cost second.
The second suitruns against your tag manager.
Accessibility is the claim most teams have heard of. The privacy claim is the one growing faster, and it reaches the same page. Plaintiffs argue that analytics tags, advertising pixels, session replay and chat widgets function as unauthorized wiretaps or pen registers when they fire before a visitor consents.
The statute
California's Invasion of Privacy Act is the primary vehicle. Statutory damages run $5,000 per violation with no requirement to prove actual harm, which is exactly what makes class scale worth pursuing. A $3.85 million class settlement received final approval in June 2026.
California Invasion of Privacy Act; reported settlements, June 2026The overlap
In March 2026 the Northern District of California held that the CCPA's private right of action is not limited to data breaches and can reach unauthorized disclosures through tracking pixels, at $100 to $750 per consumer per incident. Regulators act independently: the CPPA settled with a national retailer for $1.35 million over consent and opt-out failures.
Mirmalek v. Los Angeles Times Communications LLC (N.D. Cal. 2026); CPPA enforcement announcementsThe trigger
The technical cause is mundane. A cookie banner exists, but the tag manager fires every tag on page load, so data has already moved before the visitor sees a choice. Courts have dismissed claims where consent was captured correctly and let them proceed where tags fired first. It is a configuration problem with a seven-figure tail.
Pyxl · consent architecture practiceOpen your site in a clean browser session, open the network panel, and load a page without touching the banner. Every request to an analytics, advertising, session-replay or chat endpoint that appears before you click anything is a tag that fired without consent. If the list is not empty, the banner is decorative, and the banner is what your privacy policy says you rely on.
The settlementis the smallest line.
The figure that circulates is the settlement, because it is the one that gets reported. It is rarely the largest part of the bill. Defense counsel is spent whether you win or lose, and the mandated remediation arrives on a court's schedule rather than yours.
Ranges reflect published settlement data and legal industry reporting. Actual outcomes vary by revenue, jurisdiction and how early a matter resolves. Under the ADA a prevailing plaintiff can recover attorney fees from the defendant, so a settlement often carries both sides' legal costs.
The cost that does not appear on this table is roadmap. Developers get pulled off the plan to fix violations against a deadline someone else set. Rush remediation typically runs two to three times normal rates, and the opportunity cost usually exceeds the settlement.
Two things teams buythat do not close the exposure.
The share of real issues automated tooling catches
A scanner is good at what it can measure: a missing attribute, a contrast ratio, a duplicate identifier. It cannot tell you whether the alternative text describes the image, whether focus order matches reading order, whether an error message is announced, or whether a keyboard user can complete a purchase. A green automated score is routinely compatible with a site that is unusable by screen reader, and a plaintiff's expert tests by hand.
The FTC fine against a leading overlay vendor, January 2025
For misrepresenting the product as guaranteed compliance. Overlays inject a script that attempts to reinterpret markup at runtime; they cannot repair the markup itself, and roughly a quarter of recent filings named sites that already had one installed. Fixes belong in the source, where they survive a theme update and where an audit trail can point at a commit.
Ninety days,in the order that matters.
This is the sequence we run, written so your team can run it without us. The order is deliberate: find the exposure before scoping the fix, fix templates rather than pages, and then make the standard structural so it does not decay between releases.
Find out where you stand
Fix the templates, not the pages
Make it hold
Accessibility is insidethe engineering practice.
Pyxl has spent 19 years building and maintaining the websites, applications and marketing infrastructure companies run on. Accessibility and consent architecture sit inside that practice rather than beside it as a compliance product, because both are decided by the same code we ship.
WCAG engineers and testers
Trained specialists auditing against WCAG 2.2 Level AA, the standard courts reference. Manual screen reader and keyboard-only testing, not scans alone.
Code-level remediation
Fixes in the source, delivered as prioritized, developer-ready tickets with a defensible audit trail.
Applications, not just sites
Portals, checkout and booking flows, scheduling tools and internal applications, where the highest-risk interactions actually live.
Consent architecture
Tag sequencing, Consent Mode v2 and consent management implementation, so tags fire after a choice rather than before it.
Find out before someone else does.
Pyxl is not a law firm. Findings should be reviewed with your counsel.
If it comes back clean, that is worth knowing before your next diligence cycle. If it does not, you found out before a plaintiff's firm did.
Seyfarth Shaw ADA Title III (2026); UsableNet 2026 Midyear Digital Accessibility Lawsuit Report; EcomBack Q1 2026; Federal Trade Commission (2025); Allison v. PHH Mortgage (N.D. Cal. 2026); Mirmalek v. Los Angeles Times Communications LLC (N.D. Cal. 2026); California Privacy Protection Agency enforcement announcements. Litigation cost figures are illustrative ranges drawn from published settlement data and legal industry reporting; they are not a quote, a prediction, or a substitute for legal advice. This document does not constitute legal advice.
Questions we getbefore the first call.
Why are website accessibility lawsuits increasing?
Because the claims are templated and cheap to originate. Automated tooling identifies a short list of well-known failures across thousands of sites, the findings drop into a filing template, and the top ten plaintiff firms account for roughly eighty percent of filings. UsableNet counted 3,117 federal website accessibility suits in 2025, up twenty-seven percent over 2024, and projects 2026 finishes about twenty percent higher.
Does an accessibility overlay widget protect us from a lawsuit?
No. Roughly a quarter of recent filings targeted sites that already had an overlay installed, and in January 2025 the FTC fined a leading overlay vendor one million dollars for misrepresenting the product as guaranteed compliance. An overlay injects a script on top of your markup and cannot repair the markup underneath. Fixes belong in the source, where they survive a theme update and leave an audit trail.
We already passed an automated scan. Are we covered?
Automated tooling catches roughly thirty percent of real issues. It cannot tell whether alternative text describes the image, whether focus order matches reading order, whether an error is announced, or whether a keyboard user can complete a purchase. A green score is routinely compatible with a site that is unusable by screen reader, and a plaintiff's expert tests by hand.
How can analytics tags create a privacy lawsuit?
Plaintiffs argue that analytics tags, ad pixels, session replay and chat widgets act as unauthorized wiretaps or pen registers when they fire before a visitor consents. California's Invasion of Privacy Act carries statutory damages of five thousand dollars per violation with no requirement to prove harm. Courts have dismissed claims where consent was captured correctly and allowed them where tags fired first, which makes it a tag-sequencing problem rather than a policy problem.
What does a single case actually cost?
All-in exposure typically runs fifty-five thousand to two hundred seventy thousand dollars or more: five to fifty thousand for a demand letter resolved before filing, thirty to a hundred fifty thousand once a suit is filed, twenty-five to a hundred thousand in your own defense counsel even in cases you win, and twenty to a hundred forty-five thousand in mandated remediation, verification and monitoring. Under the ADA a prevailing plaintiff can recover attorney fees, so a settlement often carries both sides' costs.
Is this only an eCommerce problem?
No, but it presents differently. Commerce and retail draw the majority of filings, and Shopify-based sites accounted for forty-four percent of Q1 2026 filings. In B2B the exposure sits in the logged-in application — portals, quote and booking flows, dashboards, internal tools — and in procurement, where enterprise buyers ask for a conformance statement before a contract moves. There it costs deals before it costs legal fees.
Where should we start?
With an audit of the two or three flows that carry revenue, tested by hand, plus an inventory of what fires before consent. Then remediate at the template and component level rather than page by page, and add the checks to CI so a regression fails a build instead of arriving as a letter.