1. The 2026 legal framework: EAA, EN 301 549, WCAG 2.2 AA
Digital accessibility is no longer a matter of good practice: it is a regime of precise, enforceable obligations backed by a penalty scale. Three instruments shape the landscape in 2026, and confusing them is the leading cause of compliance failure in the organisations we audit.
The timeline that applies to your website
- 28 June 2025 — the European Accessibility Act (Directive (EU) 2019/882) became applicable. All in-scope private digital services — e-commerce, banking, ticketing, e-books, communication platforms — must be compliant right now; any grace period has expired.
- Reference standard: EN 301 549 V3.2.1, which incorporates the W3C WCAG 2.2 level AA success criteria. Version V4.1.1 published in 2025 consolidates the alignment on WCAG 2.2.
- Public sector: national equivalents (RGAA 4.1.2 in France), with a mandatory multi-year accessibility plan and a designated accessibility coordinator.
In practice, if you sell online, if you publish a consumer-facing web application, or if you provide payment, transport or electronic communication services, you are in scope. Only microenterprises with fewer than 10 staff and under €2M turnover are exempt — and that exemption does not cover key services such as banking.
The accessibility statement: the document everyone forgets
Technical compliance is not enough: every in-scope website must publish an accessibility statement visible on every page (footer link), stating the conformity status ("fully compliant", "partially compliant", "non-compliant"), the results of the latest audit, the multi-year accessibility plan and the enforcement procedure (e.g. the Défenseur des droits in France). A missing or misleading statement is penalised as such.
| Instrument | Scope | Required standard |
|---|---|---|
| EAA / Directive 2019/882 | Private sector: e-commerce, banking, ticketing, consumer SaaS | EN 301 549 → WCAG 2.2 AA |
| National transpositions (e.g. décret 2023-931) | All in-scope sites & apps | Accessibility statement + multi-year plan |
| RGAA 4.1.2 | Public sector & their contractors | RGAA audit + mandatory statement |
| GDPR Art. 4(11) & 7 | Consent banners (all websites) | Accessible refusal = valid consent |
2. The deadly link between accessibility and GDPR consent
This is the Observatory's major doctrinal contribution: an inaccessible consent interface produces void consent. GDPR Art. 4(11) requires a freely given, specific, informed and unambiguous expression of will; Art. 7(3) requires refusal to be as easy as giving consent. As soon as a blind, low-vision or keyboard-only user cannot reach the "Reject All" button as easily as the "Accept All" button, the choice is vitiated.
The consequence is severe: trackers dropped on the basis of that consent (Meta Pixel, Google Analytics 4, Criteo, TikTok) become unlawful — exactly as if the banner did not exist. The cases we have analysed show this is precisely the reasoning regulators adopt when they cross an accessibility inspection with a cookie inspection.
The six failures that vitiate consent
- Focus trap (WCAG 2.1.2): Tab gets stuck in the banner or, worse, leaks to the page before any choice. Full analysis.
- Insufficient Reject button contrast (WCAG 1.4.3): below 4.5:1, refusal is visually concealed = a dark pattern penalised by DPAs. Demonstrated with luminance math.
- Missing or broken ARIA (WCAG 4.1.2): without
role="dialog",aria-modaland accessible labels, screen readers never announce the refusal option. The 7 fatal ARIA errors. - Tap targets below 24x24px (WCAG 2.5.8) on mobile: the most widespread failure across the CMP market. iOS/Android audit.
- Uncalibrated dark mode: contrast collapses as soon as the system theme flips. Real measurements.
- Accept/Refuse visual asymmetry: size, colour and position engineered to skew the choice = a freedom defect.
For the full GDPR × accessibility picture, see our GDPR & CMP Accessibility guide.
3. Auditing: methodology, 25-point checklist and CMP benchmark
A serious accessibility audit combines three levels: automated inspection (roughly 30% of criteria are detectable), behavioural testing (keyboard, focus, screen readers) and human expertise on comprehension. Our 25-point EN 301 549 / WCAG 2.2 audit checklist formalises this method for consent banners; it doubles as an enforceable grid in front of a client or a regulator.
What the Observatory actually tests
- Playwright network interception: which trackers fire before consent, regardless of how the banner looks.
- Accessibility tree: native Chromium extraction to verify the roles, names and values actually exposed to assistive technology.
- Keyboard tab cycle: focus order, focus containment, choice revocation, Escape key behaviour.
- Contrast computation: real WCAG luminance ratios on every button, including transparent backgrounds and dark mode.
- Screen reader testing: NVDA (Windows), VoiceOver (macOS/iOS) and TalkBack (Android) across the accept / reject / customise journeys.
CMP benchmark: what our crash tests reveal
Our comparative audit of Didomi, OneTrust, Axeptio, Cookiebot and Tarteaucitron shows that no CMP on the market is accessible out of the box: gaps concentrate on focus management inside preference centres, consent toggle semantics (often plain clickable divs) and choice revocation. For teams building a bespoke banner, our complete developer guide provides the HTML5 dialog markup, the focus trap and the test suite to run in CI.
On the open-source side, Tarteaucitron remains the most auditable option (open code), but its default configuration needs rework: see the advanced configuration guide.
4. Scams, exposed sectors and the 2026 penalty scale
Accessibility overlays: the false sense of security
AccessiBe, UserWay, Facil'iti and other widgets promise compliance with a single line of code. Our technical teardown proves the opposite: these overlays repair neither the broken DOM, nor real contrast, nor keyboard navigation; they conflict with native screen readers and no regulator recognises them as proof of compliance. US case law (Robles v. Domino's Pizza, the Winn-Dixie follow-ups) has already established that adding a widget does not equal remediation.
The most exposed sectors in 2026
- E-commerce & checkout flows: cart, forms, 3-D Secure — the most audited journeys. Remediation guide.
- B2B SaaS & web applications: data grids, dataviz, PDF/UA exports, focus traps inside internal modals. SaaS compliance.
- Healthcare & banking: essential services under the directive, where the GDPR (sensitive data) × EAA stacking risk is at its maximum.
The real penalty scale
The 2026 accessibility & cookie fine scale details the amounts actually applicable: up to €150,000 per infringement (legal persons) for EAA non-compliance, daily coercive fines for ignored injunctions, specific penalties for missing or false accessibility statements — and, in cascade, up to €20M or 4% of global turnover when inaccessible design produced void consent and unlawful tracker drops.
Our position as an Observatory: the question is no longer "am I at risk" but "how long does your compliance file survive an automated inspection crossing accessibility and cookies". That is exactly what our free forensic scanner verifies.