ADA Title II and third-party vendors: who is responsible?
ADA Title II and third-party vendors: a city or county stays responsible for vendor-run portals, payment systems and apps. What the rule says and what to do.
A large share of what a state or local government puts online is not built by the government. Payment portals, permit systems, agenda and minutes software, recreation booking, utility billing, library catalogs, job applications, 311 apps: most of it is licensed from third-party vendors. The question this article answers is what the ADA Title II web rule says about that, and the answer is short. The public entity remains responsible.
ADA Title II and third-party vendors: what the rule says
The DOJ's 2024 rule (28 CFR part 35, subpart H) opens with the general requirement in section 35.200(a). A public entity must ensure that the following are readily accessible to and usable by individuals with disabilities:
(1) Web content that a public entity provides or makes available, directly or through contractual, licensing, or other arrangements; and
(2) Mobile apps that a public entity provides or makes available, directly or through contractual, licensing, or other arrangements.
The same phrase, "directly or through contractual, licensing, or other arrangements", appears again in the compliance requirements in 35.200(b), which set the WCAG 2.1 Level AA standard and the compliance dates: 26 April 2027 for entities with a total population of 50,000 or more, 26 April 2028 for smaller entities and special district governments, as extended by the interim final rule of 20 April 2026.
None of this is new in principle. The general Title II nondiscrimination provision, 28 CFR 35.130(b)(1), has long used the same words: a public entity may not discriminate "directly or through contractual, licensing, or other arrangements." The web rule applies that existing principle to a specific technical standard.
The DOJ's small entity compliance guide puts it plainly: if you have a contract, license or other arrangement with another entity to provide public services for your government, "you still need to make sure that those services comply with Title II."
The third-party content exception does not cover vendors
The rule's exceptions in 35.201 include "content posted by a third party". Read carelessly, that sounds like it might cover a vendor's platform. It does not. The full text is:
Content posted by a third party, unless the third party is posting due to contractual, licensing, or other arrangements with the public entity.
The exception is for content posted by unaffiliated third parties, such as members of the public commenting on a forum. A vendor operating a service under contract is posting because of a contractual arrangement, which is exactly what the exception excludes. The DOJ's guide makes the point with examples: calendars, scheduling tools, maps, reservation systems and payment systems developed by an outside technology company do not fall under the exception. The guide also notes that the exception does not cover the tools and platforms that let third parties post content. If residents post comments through a vendor's engagement platform, the comments may be excepted; the platform they type into is not.
The exceptions article covers the other four exceptions and their limits.
Where vendor systems meet the other exceptions
Two other exceptions are worth understanding precisely, because vendors sometimes cite them more broadly than they read.
Individualized, password-protected documents. Section 35.201(d) excepts conventional electronic documents (PDF, word processor, presentation and spreadsheet files) that are about a specific individual, their property or their account, and that are password-protected or otherwise secured. A utility bill PDF behind a login may fall within it. The login page, the account dashboard and the payment form do not, because they are not documents. The exception is about files, not portals.
Preexisting documents. Section 35.201(b) excepts conventional electronic documents available before your compliance date, unless they are currently used to apply for, gain access to, or participate in your services. A permit application form hosted on a vendor's portal is the kind of document the "unless" clause is about.
What the rule does not let you hand to the vendor
The rule places the obligation on the public entity. What the vendor owes you is what your contract says. That has three consequences.
The defenses stay with you. Section 35.204 lets a public entity show that full compliance would result in a fundamental alteration or undue financial and administrative burdens. The decision must be made by the head of the public entity or their designee, after considering all resources available, with a written statement of reasons, and the entity must still take other action to ensure access to the maximum extent possible. A vendor saying a fix is too expensive is not that determination.
Minimal-impact noncompliance is narrow. Section 35.205 deems an entity compliant where nonconformance has so minimal an impact that people with disabilities can still access the same information, engage in the same interactions, conduct the same transactions and otherwise participate, with substantially equivalent timeliness, privacy, independence and ease of use. The burden of demonstrating that is the entity's. It is not a substitute for knowing how the vendor's product performs.
Mobile apps count. If a vendor provides a resident-facing app on your behalf, the app is covered alongside the web version. Ask whether the vendor's conformance report covers it, or only the website.
What to do about it
Since you cannot transfer the obligation, the practical work is making sure you know where you stand and that the contract gives you a remedy.
- Inventory vendor-provided services. List every public-facing system run by a third party: what it does, who uses it, when the contract renews. Payment, permitting, benefits, scheduling and anything residents must use to complete a transaction come first.
- Get a current conformance report for each. An Accessibility Conformance Report on the version in service, reporting on WCAG 2.1 Level AA. A report on the federal Section 508 edition alone does not address the twelve WCAG 2.1 criteria at Level A and AA; Section 508 vs ADA Title II explains why.
- Read it for gaps, then ask in writing. For each gap, ask for evidence, a remediation date, or a justification. How to read a VPAT walks through the order.
- Put accessibility in the contract at renewal. A conformance commitment to a named standard, the ACR as an exhibit, notice of regressions and remediation timelines. At renewal you have leverage that you do not have mid-term.
- Plan interim access. Where a vendor system has a known gap, decide how a resident who cannot use it will be served in the meantime, and make sure front-line staff know.
- Keep the record. What you required, what each vendor disclosed, what you asked and what they committed to.
None of this makes the vendor's product conform. It establishes what you knew and what you did about it, which is the part of the problem that is in your control.
For an overview of how GOVvpat fits into this for public entities, see for government.
Sources: 28 CFR part 35, subpart H (the DOJ's 2024 Title II web rule, as amended by the interim final rule of 20 April 2026), in particular sections 35.200, 35.201, 35.204 and 35.205; 28 CFR 35.130(b)(1); the DOJ's small entity compliance guide for the Title II web rule on ada.gov. This is general guidance, not legal advice.
GOVvpat reviews the conformance reports your vendors submit and keeps the record of what was raised and answered. Request a quote.