WCAG 2.2 new success criteria: what a 2.1 VPAT leaves out

WCAG 2.2 became a W3C Recommendation on 5 October 2023. It adds nine new success criteria to WCAG 2.1 and removes one. If your solicitation names WCAG 2.2 and a vendor answers with a WCAG 2.1 report, those new success criteria are exactly the rows that will be missing, and nothing about the document will look incomplete.

This post lists the WCAG 2.2 new success criteria, says which ones matter at Level AA, and explains how they interact with ADA Title II, which still references WCAG 2.1.

The nine WCAG 2.2 new success criteria

Criterion	Level	In plain terms
2.4.11 Focus Not Obscured (Minimum)	AA	A focused element is not entirely hidden by author-created content
2.4.12 Focus Not Obscured (Enhanced)	AAA	No part of the focused element is hidden
2.4.13 Focus Appearance	AAA	The focus indicator meets size and contrast thresholds
2.5.7 Dragging Movements	AA	Anything done by dragging can be done with a single pointer without dragging
2.5.8 Target Size (Minimum)	AA	Pointer targets are at least 24 by 24 CSS pixels, with exceptions
3.2.6 Consistent Help	A	Help mechanisms repeated across pages appear in the same relative order
3.3.7 Redundant Entry	A	Information already entered in a process is not demanded again
3.3.8 Accessible Authentication (Minimum)	AA	Login does not depend on a cognitive function test without an alternative
3.3.9 Accessible Authentication (Enhanced)	AAA	A stricter version of 3.3.8

Six of the nine (two at Level A, four at Level AA) are part of a Level AA conformance target. The three AAA criteria are not.

4.1.1 Parsing was removed

WCAG 2.2 marks 4.1.1 Parsing as "obsolete and removed". The W3C's reasoning is that assistive technology no longer parses HTML directly, and that problems which used to fail 4.1.1 now fail other criteria such as 1.3.1 Info and Relationships or 4.1.2 Name, Role, Value.

The W3C has also added a note to WCAG 2.0 and 2.1 saying 4.1.1 "should be considered as always satisfied for any content using HTML or XML."

That is why the criterion counts move the way they do. A Level AA report should account for:

• 50 criteria under WCAG 2.1 (30 at A, 20 at AA)
• 55 criteria under WCAG 2.2 (31 at A, 24 at AA), after adding six and removing 4.1.1

If a report claims to be WCAG 2.2 Level AA and has 50 rows, something is missing.

What each new AA and A criterion means for government software

These are the six that matter at Level AA, with where they tend to show up in the systems public agencies buy.

2.4.11 Focus Not Obscured (Minimum). Sticky headers, cookie banners, chat widgets and fixed footers commonly cover whatever the keyboard user has just tabbed to. The criterion fails only if the focused component is entirely hidden by author-created content, but in long forms it happens often.

2.5.7 Dragging Movements. Drag-and-drop file uploads, sortable lists, calendar and scheduling boards, map pins and sliders. Each needs a way to do the same thing with single clicks or taps, unless dragging is essential.

2.5.8 Target Size (Minimum). Targets must be at least 24 by 24 CSS pixels, unless they are adequately spaced, an equivalent control meets the size, the target is inline in text, the size is set by the browser, or a particular presentation is essential or legally required. Dense data tables with small icon buttons and tightly packed pagination links are the usual problem areas.

3.2.6 Consistent Help. If a page offers help (contact details, a contact form, a self-help link, a chatbot) and it repeats across a set of pages, it must appear in the same relative order. This does not require help to exist; it requires consistency when it does.

3.3.7 Redundant Entry. In a multi-step permit application or benefits form, information the user already gave in the same process must be auto-populated or available to select, with exceptions for security, essential re-entry, or information that is no longer valid. Retyping a mailing address on step four is the classic failure.

3.3.8 Accessible Authentication (Minimum). No step in a login process may require a cognitive function test, such as remembering a password or solving a puzzle, unless there is an alternative, a mechanism to help, or the test is recognizing objects or the user's own content. The W3C lists password manager support and copy and paste as examples of qualifying mechanisms. Resident portals that block paste into password fields, or rely on puzzle CAPTCHAs, are where this bites.

What ADA Title II actually requires

The DOJ's Title II web rule (28 CFR part 35, subpart H) requires conformance with WCAG 2.1 Level AA, and incorporates the June 2018 version of WCAG 2.1 by reference. The compliance dates are 26 April 2027 for entities of 50,000 or more and 26 April 2028 for smaller entities and special district governments. The Title II deadlines post covers the dates in more detail.

In the rule's preamble the DOJ explains why it chose 2.1 over 2.2: 2.2 was finalized after the proposed rule's comment period closed, and the Department judged that fewer resources and less guidance existed for the new criteria. Three further points from the preamble are useful:

• The DOJ notes that W3C has said WCAG 2.2 does not "deprecate or supersede" WCAG 2.1.
• Because the rule adopts WCAG 2.1, 4.1.1 Parsing is still required under subpart H. The DOJ points to the rule's minimal-impact provision (28 CFR 35.205) for 4.1.1 failures that do not affect access.
• If a state law requires WCAG 2.2, nothing in the federal rule prevents an entity from meeting it.

So for a Title II buyer, WCAG 2.1 Level AA is the legal floor. Requiring 2.2 is a choice some agencies make deliberately, and the W3C itself recommends 2.2 as the conformance target, noting that content conforming to 2.2 is intended to also conform to 2.1.

What a WCAG 2.1 VPAT does not tell you

The ITI VPAT 2.5 instructions allow a vendor reporting only on WCAG 2.1 to remove the rows marked "2.2 only". That is correct use of the template, and it means a 2.1 report is simply silent on the six new A and AA criteria. Silence is not a pass and not a fail. It is no information.

There is also a quieter mismatch in the other direction. A report written to WCAG 2.2 may omit 4.1.1, since 2.2 removed it. If you are buying against the Title II standard, which still includes 4.1.1, the W3C's own advice applies: authors bound to 2.0 or 2.1 "may need to continue to test and report 4.1.1." A WCAG 2.2 report that also states the 4.1.1 result answers both questions.

Note too that the Section 508 edition of the VPAT reports against WCAG 2.0, which is what the Revised 508 Standards incorporate. A 508-only report will not contain any of the 2.1 or 2.2 additions. See which edition to require.

What to ask for

If you require WCAG 2.2 Level AA, say "WCAG 2.2 Level AA" in the solicitation, not "the latest WCAG". Then, when a report arrives:

1. Confirm the Applicable Standards section names WCAG 2.2.
2. Count the A and AA rows: 55 for 2.2.
3. Read the remarks on 2.4.11, 2.5.7, 2.5.8 and 3.3.8 in particular. These are the four new AA criteria and the ones most likely to be "Partially Supports" in software built before 2023.
4. If you also need Title II coverage, ask for the 4.1.1 result to be stated.

If you require WCAG 2.1 Level AA and a vendor offers a 2.2 report, accept it, but check that 4.1.1 is addressed somewhere.

---

Sources: W3C, "What's New in WCAG 2.2" and WCAG 2.2 (W3C Recommendation); W3C WCAG 2 FAQ on 4.1.1 Parsing; 28 CFR part 35, subpart H and the DOJ's April 2024 final rule preamble (89 FR 31320); ITI VPAT 2.5Rev WCAG edition instructions. This is general guidance, not legal advice.

GOVvpat checks that a report covers every criterion in the WCAG version your solicitation names, and flags the rows that are missing. Request a quote.