The month a website accessibility lawsuit threat landed at $45K MRR: a founder diary (2026)

That sentence arrived on a Thursday, printed on letterhead, inside an envelope I had to sign for. Twelve pages. My company name spelled correctly, my URL correct, a list of eleven alleged barriers on my marketing site and signup flow, and a date fourteen days out by which my "prompt response" was expected. I was at $45,000 MRR in 2026, I had two part time contractors and no lawyer, and I read the whole thing standing up in the hallway because I could not make myself sit down.

Quick answer (2026): This is a composite founder diary about receiving an ADA website accessibility demand letter as a bootstrapped SaaS operator at $45K MRR. The three things that cost me were all misunderstandings. It was a demand letter and not a website accessibility lawsuit, which changes the timeline and the arithmetic completely, and almost nothing I read online made that distinction. The published filing counts (3,117 in federal court in 2025, 4,928 including state courts) do not include demand letters at all, so the number I was benchmarking my risk against was the wrong number. And there is no Department of Justice technical standard for private businesses, which means "compliant" was never a box I could buy my way into. The audit found 34 issues. Nine of them accounted for most of the letter, and fixing those nine took eleven days.

A demand letter is not a lawsuit, and I did not know that for six hours

I want to start here because those six hours were the worst part of the month and they were entirely avoidable.

I read "denied full and equal enjoyment" and I understood myself to be a defendant. I was not. Nobody had filed anything. There was no case number, no court, no docket, and no summons, because a demand letter is a private letter from a law firm proposing that you pay them to not file. It is the step before. That distinction sounds like a technicality when you are holding the envelope and it is the single most load bearing fact in the entire situation, because a lawsuit has a court imposed clock and a demand letter has a clock invented by the sender.

The fourteen day deadline in my letter was not a legal deadline. It was a negotiating position, printed to feel like one. I confirmed that in a forty minute paid consult with an actual lawyer two days later, which is the best $300 I have ever spent and which I should have booked in the first ten minutes instead of spending an evening reading law firm blog posts that are written for a reader who has already been served.

If you take one thing from this: find out which document you are holding before you do anything else. Look for a case number and a court name. If there is not one, you have more time than the letter says you have, and you should still move.

The numbers I found online were real and they were the wrong numbers

Once I could think, I did what everyone does, which is try to size the risk. The figures are easy to find and they are genuinely well tracked.

Seyfarth Shaw, the firm that has counted this category for years, reports 3,117 website accessibility lawsuits filed in federal court in 2025, a 27% increase over 2024's 2,452, which is 665 more cases year over year (ADA Title III blog, March 2026). UsableNet, which tracks New York and California state courts alongside federal, reports a higher total: "By the end of 2025, plaintiffs filed 4,928 web accessibility lawsuits" (UsableNet lawsuit tracker, 2025).

I spent a while trying to work out why two credible sources were about 1,800 apart, and the answer is that they are counting different courts, not disagreeing. That was mildly reassuring. Then I noticed the sentence that actually mattered, in Seyfarth's own post: "we still see a significant number of demand letters and lawsuits filed in state courts, which are not included in our federal lawsuit numbers."

Both numbers count filings. I had not been filed against. I was in neither number.

This is the part I want to be most useful about, because I have not seen it stated plainly anywhere. Every figure a founder can find describes the population of businesses that got sued. Demand letters do not create a public record, so nobody can count them, so the true denominator of businesses receiving one of these envelopes is unknown and is necessarily larger than 4,928. When I was reading "3,117 lawsuits across the entire United States" and quietly calculating that the odds of it being me were negligible, I was reading a statistic about a category I was not in.

The one honest thing to say about volume is that it is going up and the reference numbers understate the exposure for small operators specifically. On Reddit, where the people receiving these letters actually talk, the recurring description is of a template operation: one operator in r/smallbusiness in 2026 described the letters as templates where the firm fills in "the URL, business name and pay for a Fedex", calling it an "easy way to collect $10k or $15k, over and over again." That is community reporting rather than data, and I flag it as such, but it matched my letter closely enough that I stopped feeling singled out, which helped more than it should have.

What standard was I even being measured against

This was the second misunderstanding, and it is the one that makes the whole category feel unfair.

I assumed there was a rule. There is a law and there is not a rule. The Department of Justice is unambiguous that the law reaches websites: "the Department has consistently taken the position that the ADA's requirements apply to all the goods, services, privileges, or activities offered by public accommodations, including those offered on the web" (ADA.gov guidance on web accessibility). And on the same page, in the same voice, it says the quiet part: "The Department of Justice does not have a regulation setting out detailed standards," and that businesses "have flexibility in how they comply with the ADA's general requirements."

So for a private SaaS there is an obligation with no published pass mark. That is a familiar shape if you have ever been sent an enterprise security questionnaire, which is the other document that arrives asking you to prove compliance with a standard nobody will name for you, and which cost me most of a month at $34K MRR. In practice everyone converges on the W3C's Web Content Accessibility Guidelines, which is what my letter cited. WCAG is versioned: 2.0 was published December 11, 2008, 2.1 on June 5, 2018, and 2.2 on October 5, 2023, with success criteria at three conformance levels, A, AA and AAA (W3C Web Accessibility Initiative). Level AA is the level every letter and every settlement I read about names. Usefully, the versions stack rather than replace: W3C states that "WCAG 2.2 does not deprecate or supersede WCAG 2.1," and content meeting the newer version also meets the older ones, so building to 2.2 AA is not a bet you can lose.

Knowing that changed what I did next. I stopped looking for a certificate and started treating it as a defect list, which is a thing I already know how to run.

One correction while I am here, because it came up repeatedly in the threads I read and it wasted an hour of my time: Section 508 is not what applies to you. Section 508 governs federal agencies and what they procure. If you sell SaaS to the public, the relevant provision is Title III of the ADA. Several very confident replies online told me otherwise.

The overlay I nearly bought

Within about a day of the letter I had found the widget. You know the one. A line of JavaScript, roughly $49 a month at my traffic, and marketing copy that uses the words "compliant" and "protected" close together. At 11pm on day two, holding a twelve page letter, that is an extremely attractive purchase.

I did not buy it, and the reason is the only genuinely good piece of research I did that week. The overlay fact sheet, signed by several hundred accessibility practitioners and developers, states the conclusion directly: "No overlay product on the market can cause a website to become fully compliant with any existing accessibility standard and therefore cannot eliminate legal risk" (Overlay Fact Sheet). It also cites the WebAIM Survey of Web Accessibility Practitioners, in which a strong majority of respondents, 67%, rate these tools as not at all or not very effective, rising to 72% among respondents with disabilities, with only 2.4% rating them as very effective.

Two thirds of the specialists say it does not work, and the people it is nominally for say so more strongly. I would have been paying $588 a year to add a script that the actual users of assistive technology dislike, to a site whose problems it does not fix, in order to feel better on a Tuesday night.

My lawyer's version of the same advice was shorter. She asked whether I would rather show a plaintiff's firm a purchase receipt or a diff.

What we actually fixed, in what order

I ran an automated scan first, because it is free and takes four minutes, using the accessibility audit built into Chrome's developer tools, then a second pass with a dedicated extension in Firefox. That produced 34 issues across the marketing site and app shell, which is roughly the number every small site produces, and it is where a lot of founders stop and despair.

The important thing I learned is that the 34 are not equal, and that the letter itself tells you which ones matter. The eleven barriers alleged in my envelope mapped onto nine underlying defects, and every one of them was in the category an automated scanner finds in seconds:

• Form inputs on the signup and contact forms with no associated label, so a screen reader announced "edit text" with no indication of what to type. Four of the eleven allegations were this one defect repeated.
• Buttons implemented as unlabelled icon only elements, including the mobile menu toggle and the password visibility control.
• Colour contrast below the AA threshold on our secondary button and on the muted helper text under form fields, which was a direct consequence of a palette I had picked because it looked calm.
• Images with no alternative text, including, with some irony, the illustration on our accessibility free landing page.
• No visible keyboard focus indicator, because a CSS reset early in the project had removed the browser default outline and nothing had replaced it.
• A modal that could be opened by keyboard and not closed by keyboard, which is the one that genuinely bothered me. That is not an inconvenience, that is a trap.

Our marketing site is Next.js with Tailwind, and I mention that only because it is relevant to how the defects got there. Almost none of these were decisions. They were defaults, resets and conveniences: a utility class that produced a pleasant grey at 3.1:1, an icon button that never got an accessible name because the icon was self evidently a hamburger to me, an outline removed in week one to make a demo look tidy.

Then I did the thing that no scanner does. I turned on the screen reader already installed on my laptop, closed my eyes, and tried to sign up for my own product using only the keyboard. I got to the third field. It took eleven days of part time work to fix the nine, and about ninety minutes of that first attempt to stop being defensive about the letter.

What it cost

Being exact, because this is the part I wanted from other people's write ups and never found.

• Lawyer, initial consult and then response drafting and the settlement negotiation: about $4,100.
• Settlement: paid, and covered by a mutual non disclosure, so I cannot give you the figure. I will say it was inside the range operators report publicly and that it was several times the legal fee.
• Remediation: eleven days of my own time plus about $2,600 of contractor time, so call the loaded cost $9,000 to $11,000 if you value my days at anything.
• An accessibility statement page and a documented annual review, which my lawyer wanted more than I did.

Total, somewhere north of $15,000 on a $45K MRR business, which is a bad month and not an extinction event. It is almost exactly what the sales tax reckoning cost me at $41K, and it arrived the same way, in an envelope, about a thing I had known was theoretically true and had never priced. The thing that would have made it an extinction event is ignoring the envelope, and the thing that would have made it a $2,000 month is having done the nine fixes in 2025 when they were four hours of work.

The California number that reads backwards

One last piece of data, because it nearly gave me exactly the wrong idea.

In Seyfarth's 2025 federal figures the state breakdown is heavily concentrated: New York 1,021, Florida 961, Illinois 585, Minnesota 162, Pennsylvania 137. And California, the state I would have bet on, shows 4.

Four. For a moment I read that as "California is safe" and started thinking about where my customers were. That is backwards. California has its own statute, and the practical effect is that claims there are brought in state court instead of federal court, so they do not appear in a federal count at all. Seyfarth says so directly in the same post, noting a significant volume of demand letters and state court filings against businesses that the federal numbers exclude, and that stricter federal standing requirements have pushed plaintiffs toward New York and New Jersey state courts too.

A number near zero in a dataset almost never means the thing is not happening. It usually means the thing is happening somewhere the dataset does not look. I have been guilty of this reading in my own analytics more than once, and it was uncomfortable to catch myself doing it with something that mattered this much.

What I changed

Four things, and only one of them is a policy.

The nine defects are fixed and the remaining 25 are in the backlog, triaged, with the keyboard and labelling ones done first. The automated scan now runs in CI and fails the build on new violations of the categories that were in the letter, which is the single highest leverage change and took an afternoon. It cannot catch everything, and it catches all nine of mine.

I test the signup flow by keyboard alone before every release. It takes two minutes and it is the only check that would have caught the modal trap.

And I wrote the accessibility statement, which I resisted because it felt like theatre. I was wrong about why it exists. It is not a shield. It is a contact route, so that a person who cannot use something can tell me before a law firm does.

The one I did not do: I did not buy the widget, and I did not buy the annual "certification" that a different vendor offered me at $4,800 while I was mid remediation, having found me somehow. There is no certificate. The DOJ page says so.

What actually happened

MRR went from $45K to about $46K over the following quarter, which had nothing to do with any of this. Nobody churned. No customer ever mentioned it. The person named in the letter was not a customer and, as far as I can tell, had never signed up, which bothered me for about a week until I concluded that it changes nothing about whether my modal trapped keyboard users. It did.

I keep coming back to that. Strip out the letterhead and the fourteen day deadline and the $15,000, and what remains is that for two years a person navigating by keyboard could open a dialog on my site and not get out of it, and I never knew, because I had never once tried.

The one thing I would tell you

Spend an hour this week doing the free version of what cost me a quarter of a month's revenue.

Open your signup flow. Put your mouse somewhere you cannot reach it. Navigate to the first field with the Tab key, and complete the entire flow, including any modal, banner or dropdown, without touching the mouse once. Watch where the focus ring goes, and notice every point where you cannot see it at all.

You do not need a scanner, a vendor, a budget or a lawyer for that, and it will find the defects that end up in the letter, because the defects that end up in the letter are the ones a person actually hits. Every single item in my twelve pages was something that hour would have surfaced.

I did that hour for the first time on day nine, under a deadline, having already paid a lawyer. It is a much better hour when nobody is waiting for your prompt response.