Get ready for the coming new wave of ADA Title III lawsuits – thanks to the new update of the CCPA regulations

By Michael Simon, Attorney with XPAN Law Group.

Introduction: Here comes the flood?

The word started going out from law firms in the last few weeks: there was likely going to be a new wave of Americans with Disabilities Act (ADA) Title III (on public accomodations) coming as a result of the most recent update of the California Consumer Privacy Act (CCPA) regulations by the California Attorney General.  Wait? You say. How can the regulations supporting a Privacy act trigger lawsuits over the accessibility of public accomodations?

Welcome to the world of “surf-by” ADA Title III lawsuits, which, like little-noticed under-ocean earthquakes can trigger massive waves of devastation.  And just like with earthquakes, California is already at the epicenter.

The CCPA regulatory updates now require that consumer notifications comply with the most recent W3C standards

Recently, the California Attorney General issued updated CCPA regulations that changed the previously vague standards for consumer notifications into something far more demanding.  In the initial proposed regulations sections 999.305 (Notice of Collection of Personal Information), 999.306 (Notice of Right to Opt-Out of Sale of Personal Information), 999.307, (Notice of Financial Incentive), 999.308 (Privacy Policy), had all, within their respective subsections 2(d), required only that such notices:

Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.

These provisions do not appear to have been particularly controversial.  The Attorney General held a 45 day public comment period, which closed on December 6, 2019.  There were also four public hearings. Of the over 300 public comments that the Attorney General’s office reviewed, only two made any comment requesting additional specification for the accessibility standard. As well, the vagueness of the disability standards were mentioned by only two witnesses at the AG’s hearings.

Nonetheless, on February 10, 2020, the Attorney General issued updated regulations that substantially changed the text of subsection 2(d) for each of the four consumer notifications to a far more exacting standard (in marked-up format):

Be reasonably accessible to consumers with disabilities. At a minimum, For notices provided online, the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Consortium, incorporated herein by reference. In other contexts, the business shall provide information on how a consumer with a disability may access the notice in an alternative format.

This change might be welcomed by many, and in most circumstances, it would be seen as a positive step towards providing clarity.  In this particular context – as we will see below – it may well instead take an already difficult situation for businesses impacted by the CCPA and dramatically worsen it. 

What are the World Wide Web Consortium Web Content Accessibility Guidelines and why do they matter (and for that matter, what is the Consortium anyway)?

The World Wide Web Consortium (commonly abbreviated as the “W3C”) is an international alliance and business, non-profits, and government organizations with 432 members (including Amazon, Apple, Facebook, Google and Microsoft).  The W3C develops universal standards for web accessibility, called the Web Content Accessibility Guidelines (WCAG). The W3C released the current WCAG 2.1 in June 2018.  

There are three “levels” of compliance, starting with the most basic Level A, with the next Level AA, and most strict Level AAA.  Each level of guidelines requires specific website coding and capabilities to make it more available to persons with disabilities.  Each WCAG level includes “success criteria” that must be reached. These “success criteria” become harder to meet as the level increases. The newest version, WCAG 2.1, includes the success criteria in WCAG 2.0 plus 17 new success criteria, some of which are oriented around mobile applications.

In 2010, the United States Department of Justice (DOJ) announced that it was considering regulations to establish website accessibility requirements for disabled individuals.  The DOJ released a proposed rulemaking notice that pronounced WCAG 2.0 AA as “well-established industry guidelines” for this purpose. However, to date, the DOJ has not actually taken any action to provide guidelines.  

Most recently, on September 25, 2018, in response to a House appropriations bill directing the DOJ to issue standards, a letter from a bi-partisian group of 103 House members demanding such standards, along with a similar letter from 6 senators, the DOJ issued a letter to Congress effectively refusing to do so.  However, the letter did indicate a willingness by the DOJ to relax what many had seen as a requirement to comply with non-legal standards such as the WCAG.

This new flexibility by the DOJ to allow businesses to adapt to standards as necessary would normally be hailed as good news, except for the fact that the courts have been moving forward on their own.  Many courts, including the California Court of Appeals, have ruled that defendants were required to comply with the WCAG 2.0 Level A or even Level AA Success Criteria to comply with ADA Title III and Unruh.  As well, the Ninth Circuit, along with many other courts, has rejected claims by defendants that imposing liability for not having an accessible website in the absence of accessibility regulations violates their due process rights.

Actually, the tsunami is already here: welcome to the perfect lawsuit storm

Law firms have been warning their clients of what they have called a “tsunami” of ADA Title III lawsuits for years.  ADA Title III prohibits discrimination on the basis of disabilities in places of public accommodations.

The concept of a “public accommodation” is defined very broadly by the ADA; with twelve categories that include restaurants, movie theaters, schools, day care facilities, recreation facilities, and doctors’ offices.  At the time the ADA was enacted in 1990, the world wide web did not exist, and so websites were not included in the twelve categories of “public accommodation.”  Yet the ADA does prohibit any “communication barriers” for persons with disabilities.  

The only remaining question at this stage of the analysis is whether websites can constitute a “place” for the purposes of Title III.  The federal circuits are currently split on whether a website alone is sufficient to support a claim or whether a website requires a nexus to a physical location to be subject to Title III.  (for a good list of which circuits support which position, with supporting citations, see here)  The Ninth Circuit is in the slight majority of circuits in requiring this nexus to a physical location.

Unlike many other, similar federal anti-discrimination laws, ADA Title III does not require notice to be given before filing suit, exhaustion of administrative remedies, or provide a time period to “cure” any violation.  Those characteristics alone might make ADA Title III appear to be a great vehicle for plaintiffs’ attorneys seeking quick monetary settlements. However, also unlike many other federal anti-discrimination laws, ADA Title III does not provide for a private right to monetary damages, only injunctive relief.

Because California allows for the private recovery of monetary damages under the Unruh Civil Rights Act,  it is not surprising that California has been ground zero for ADA Title III lawsuits since the beginning. According to analysis by the law firm of Seyfarth Shaw, there were 4,794 Title III lawsuits in California in 2019, a massive increase from just 995 lawsuits in 2013.  California not only leads the nation in the number of Title III lawsuits, nearly 43% of such lawsuits in 2019 were brought there, more than the next three leading jurisdictions combined.

ADA claims are increasingly evolving into so-called “surf-by” suits: i.e. all it takes for a potential plaintiff was to find some violation of the ADA within a website, often failure of that site to work properly with vision-impaired screen reader software that reads the website content aloud.

What do you call a tsunami that just got worse . . . a lot worse?

It is true that the CCPA only allows for a private right of action arising out of a data breach.  Thus it may seem that the Attorney General’s updating of the regulations to specify the WCAG 2.1 guidelines is a limited problem, with only the likely rare threat of an Attorney General action to back it up.

Yet in this already fraught situation, the new requirements may well make the current “tsunami” of ADA Title III/Unruh claims in California much worse.  With the more efficient “surf-by” of a company website, under these new CCPA requirements, plaintiffs might not even be required to surf the entire website, just find a CCPA notice that doesn’t comply and they are good to go – with bad news for you.

Plus, while the WCAG 2.0 Level A and AA Success Criteria have been known quantities and accepted by many courts for some time now, the regulatory update will likely bring in the 17 additional factors of WCAG 2.1.  Since many of these factors impact upon mobile websites, this will implicate a whole new environment in which you must test. Have we then reached the ultimate nightmare scenario for how far the waters of ADA Title III/Unruh claims can rise: will “surf-by” plaintiffs now be able to simply pull out their iPhones or Android phones – or even form factors you’ve never even heard of – and find CCPA notice violations without leaving the comfort of their couch? 

What can you do to prepare?

As the newest member of the XPAN team, it seems ironic that my first post presents an issue seemingly without a solution, other than perhaps the only advice that can ever be given when a tsunami (or whatever is worse) threatens: “head for the hills!”  However, there is some helpful insight, if only because heading for the hills won’t save you this time.

First of all, don’t expect relief from the DOJ, as in our current anti-regulatory environment, there won’t be any accessibility guidelines coming from the Federal government any time soon.  If you have been one of the many major businesses waiting to implement website accessibility features and coding until the regulations are settled – or even seemingly ready to appear – stop waiting.  The time for you to act is now.

Likewise, don’t expect help from the courts.  On October 7, 2019 the United States Supreme Court declined certiorari on the Ninth Circuit’s latest case approving ADA Title III/Unruh cases, Robles v. Domino’s, crushing the hopes of many defendants and their counsel of relief on that front.  Robles did leave the Ninth Circuit’s requirement of a physical nexus intact, and so you can still try to use this defense if all you have that impacts California is a website.

If you have gotten ahead of the game by at least complying with WCAG 2.0 Level A or AA, you should strongly consider working to update your website to the new WCAG 2.1 standards.  The water is only rising here, and it is best to build the levees before you need them. And, luck favors the prepared!

* * * * * *

Nothing contained in this blog should be construed as creating an attorney-client relationship or providing legal advice of any kind.  If you have a legal issue regarding cybersecurity, domestic or international data privacy, or electronic discovery, you should consult a licensed attorney in your jurisdiction.