Ontario's legal minimum for website accessibility under the IASR (Integrated Accessibility Standards Regulation) is WCAG 2.0 Level AA — a standard the W3C (World Wide Web Consortium) first published in 2008. The current W3C standard is WCAG 2.2 Level AA, with a W3C Recommendation dated December 12, 2024 (www.w3.org/TR/WCAG22/). The gap between these two versions is real and testable: WCAG 2.2 adds six new Level A and AA success criteria that did not exist in WCAG 2.0. With the December 31, 2026 AODA (Accessibility for Ontarians with Disabilities Act) ACR (Accessibility Compliance Report) deadline six months away, Ontario businesses that believe they are "fully compliant" because they passed a WCAG 2.0 audit are likely still failing a meaningful share of current accessibility tests.
Key facts
- Ontario's IASR (O.Reg 191/11, s.14) requires organizations with 50 or more employees to make public-facing websites and web content conform to WCAG 2.0 Level AA — this is the legal floor (ontario.ca / e-Laws).
- WCAG 2.2 was first published as a W3C Recommendation on October 5, 2023; the current edition is dated December 12, 2024 (W3C, www.w3.org/TR/WCAG22/). It is the live standard.
- WCAG 2.2 adds nine new success criteria versus WCAG 2.1 — of which six are at Level A or AA (actionable for legal compliance purposes) and three are at the aspirational Level AAA (W3C, WCAG 2.2).
- WCAG 2.2 also removed one criterion from 2.1 — 4.1.1 Parsing — which was deemed obsolete for modern browsers (W3C).
- ADA (Americans with Disabilities Act) courts in the US routinely reference WCAG 2.1 or 2.2 AA as the benchmark, not 2.0, when assessing website accessibility claims — which matters for any Ontario business selling to US customers (Seyfarth Shaw ADA Title III Blog, 2025).
- Canada's new federal digital accessibility standard CAN/ASC – EN 301 549:2024, embedded in SOR/2025-255, references WCAG 2.2-level requirements through its Clause 9 (Web) requirements — applied to federally regulated employers with 100 or more employees (Canada Gazette, Part II, Vol. 159, No. 26).
- The December 31, 2026 ACR deadline applies to Ontario private-sector organizations and non-profits with 20 or more employees (ontario.ca).
What is Ontario's legal minimum for website accessibility?
The IASR (Integrated Accessibility Standards Regulation, O.Reg 191/11) is the regulation passed under the AODA that sets the concrete web-accessibility standard. Section 14 requires organizations with 50 or more employees to ensure their internet websites and web content conform to WCAG 2.0 Level AA, with two specific exceptions: live captions and pre-recorded audio descriptions remain at Level A for private-sector organizations.
Organizations with 1–49 employees must meet WCAG 2.0 Level A for new websites and new web content posted after January 1, 2012.
The ACR — the Accessibility Compliance Report submitted to the Ontario government — asks organizations to report on how they are meeting AODA standards including the IASR's web requirements. The next ACR deadline for private-sector organizations and non-profits with 20 or more employees is December 31, 2026.
WCAG 2.0 remains the legal text. That distinction matters: an organization that tests and fixes its site to WCAG 2.2 AA automatically satisfies WCAG 2.0 AA and 2.1 AA, since each version is backward-compatible. But an organization that stops at the 2.0 floor is behind current practice in ways that show up during audits, user testing, and litigation.
How does WCAG 2.2 differ from WCAG 2.0?
WCAG 2.0 was published in December 2008. It established the core four principles — perceivable, operable, understandable, robust — and the Level A, AA, and AAA framework that all later versions inherit. At its time of publication it was comprehensive. But smartphones, rich web applications, complex authentication flows, and touch-based navigation were not yet dominant — and neither were the assistive-technology use patterns that go with them.
WCAG 2.1, published in June 2018, added 17 new success criteria aimed at mobile users, low-vision users, and people with cognitive or learning disabilities. If your site was built to "WCAG 2.0 AA" and hasn't been audited since then, it may already be failing multiple 2.1 criteria — the mobile-touch and focus-management requirements in particular.
WCAG 2.2, the current standard, adds nine more criteria on top of 2.1. It removes one criterion (4.1.1 Parsing) that modern browsers have made redundant. The net result is a standard that is more protective of keyboard users, mobile users, and users with cognitive disabilities — the three groups most commonly excluded by typical Ontario business websites.
When an auditor, a court, or Canada's federal EN 301 549 standard references "current best practice," WCAG 2.2 AA is what they mean.
What are the 6 new Level A and AA criteria Ontario businesses are most likely missing?
The three Level AAA additions (2.4.12, 2.4.13, 3.3.9) are aspirational — they are not required for legal compliance. The six criteria below are the ones that apply at Level A or AA and that a site built only to WCAG 2.0 is not tested for (W3C, WCAG 2.2):
1. 2.4.11 Focus Not Obscured (Minimum) — Level AA When a user navigates to a component by keyboard, that component's focus indicator must not be entirely hidden by sticky headers, cookie banners, fixed footers, or other author-controlled elements. Many Ontario sites use persistent navigation bars or GDPR consent banners that routinely cover the focused element entirely. This criterion requires at least part of the focus indicator to remain visible.
2. 2.5.7 Dragging Movements — Level AA Any functionality that relies on a drag-and-drop gesture — sliders, sortable lists, map panning, carousels controlled by touch-drag — must also offer a single-pointer alternative (a button, click-move, or keyboard control) that does not require dragging. Users with motor impairments or who navigate by switch access cannot perform sustained drag gestures reliably.
3. 2.5.8 Target Size (Minimum) — Level AA Interactive elements — buttons, links, form controls — must have a target size of at least 24 × 24 CSS pixels, unless the element is inline in a sentence, is browser-controlled, or has sufficient spacing from adjacent targets. A site full of 16-pixel icon links or tightly packed menu items with no padding typically fails this criterion.
4. 3.3.8 Accessible Authentication (Minimum) — Level AA If a login or authentication step asks users to complete a cognitive function test — solving a puzzle, identifying images in a grid, or retyping a code — there must be an alternative mechanism that does not require cognitive recall or transcription: a password manager, email magic link, biometric authentication, or SMS code. Standard CAPTCHA implementations often fail here.
5. 3.2.6 Consistent Help — Level A If a website provides a help mechanism — a contact link, chatbot, phone number, or FAQ — across a set of pages (for example, in the header or footer), that mechanism must appear in the same relative location on each page. This prevents users with cognitive disabilities from having to relocate support options on each navigation step.
6. 3.3.7 Redundant Entry — Level A Within a single transaction or process (checkout, multi-step form, booking flow), users must not be asked to enter the same information twice unless it is essential — for example, confirming a password. Requiring a user to retype their email address on a confirmation page, or re-enter an address already provided at the previous step, fails this criterion.
Why does WCAG 2.2 matter for Ontario businesses if 2.0 is still the legal floor?
Three reasons.
Courts reference current practice, not frozen legal text. The IASR was written in 2011 and references WCAG 2.0, but that doesn't mean a court or tribunal will evaluate your site against 2008 standards indefinitely. US courts handling ADA website accessibility claims routinely cite WCAG 2.1 or 2.2 AA as the technical benchmark when assessing whether a site was accessible at the time of the alleged barrier (Seyfarth Shaw ADA Title III Blog, 2025). Any Ontario business selling to US customers carries that exposure. An HRTO (Human Rights Tribunal of Ontario) complaint under the Ontario Human Rights Code similarly evaluates real-world accessibility — what a person with a disability could or could not actually do on your site — not whether you checked boxes against a 15-year-old standard.
Canada's new federal standard already points to 2.2. The CAN/ASC – EN 301 549:2024 standard embedded in SOR/2025-255 incorporates WCAG requirements at the 2.2 level for web content. While this federal rule applies directly to federally regulated employers with 100+ employees, it signals where Canadian regulatory expectations are headed. Auditors working on any Canadian organization's accessibility program are already running WCAG 2.2 evaluations.
Passing a 2026 ACR audit without knowing your 2.2 gaps is a risk. The ACR compliance report process is still tied to the IASR's WCAG 2.0 language, but a third-party auditor verifying your attestation — or an HRTO complainant whose expert witness tests your site — will use current tools. Current automated scanners and manual testing frameworks default to WCAG 2.2. If your site has sticky headers that hide focus indicators, drag-only carousels, or CAPTCHA login without alternatives, those failures will show up on any modern accessibility evaluation regardless of which version of the guidelines is cited in the regulation.
What should an Ontario business do before the December 2026 deadline?
The practical checklist, in order of priority:
- Run a current-standard scan. Most free and paid tools now test against WCAG 2.1 or 2.2 — confirm which version your tool uses before trusting its output.
- Audit the six new AA/A criteria directly. Keyboard-navigate your site with focus visibility turned on and confirm that nothing is hidden. Test every interactive element for 24 × 24 px minimum target size. Walk through every form and checkout flow for redundant entry. Test your login for non-CAPTCHA alternatives.
- Fix at the source, not with a widget. An accessibility overlay does not fix keyboard focus issues, target sizes, or authentication flows — it sits on top of the page and cannot rewrite the underlying element behaviour that WCAG 2.2 tests. Real code fixes are what produce a defensible record.
- Document the work. A dated remediation log aligned to WCAG 2.2 success criteria — not just WCAG 2.0 — is the evidence that protects you in an HRTO complaint or an ADA claim. Here's what happened when a company had that evidence and a court tested it.
- Prepare your ACR. Your ACR due December 31, 2026 should reflect work done — not aspirations. An audit against WCAG 2.2 AA gives you a fuller and more defensible basis for that report than one stopped at the 2.0 floor.
See where your site stands in about 30 seconds — free PassProof Report: getpassproof.com. It detects overlays, shows real WCAG failures, and tells you exactly what legally applies to your organization in Ontario. No obligation.
PassProof is a remote-first accessibility-engineering studio serving Ontario. General information, not legal advice.