The California ADA lawsuit trap, and the CIPA twist most OC owners don't see coming

Two things Orange County small business owners should know going into summer 2026. The first is bad. The second is worse.

ADA website lawsuits are not slowing down. California was the third-highest state for digital accessibility lawsuits in 2025, behind only New York and Florida. The WebAIM Million 2026 scan found 95.9% of homepages have at least one automatically detectable WCAG failure — which is worse than last year, not better.

The six errors causing almost every violation

The good news inside the bad: the failures are concentrated. Six issue categories account for 96% of all detected accessibility violations. All six are fixable, most without a redesign.

Source: WebAIM Million 2026 — automated scan of one million homepages

If you fix these six, you eliminate the overwhelming majority of what plaintiff firms scan for and target. None of them require a redesign. All can be fixed in a focused afternoon by anyone who knows what to look for.

The CIPA twist

This is the part most owners have not heard about. Plaintiff firms are now bundling ADA claims with California Invasion of Privacy Act (CIPA) claims in the same complaint.

CIPA was passed in the 1960s as a wiretapping statute. Modern plaintiff firms have successfully argued that session-replay tools (Hotjar, FullStory, etc.), live chat widgets that record conversations, and tracking pixels that share data with third parties are forms of unlawful interception under the same statute.

The math gets ugly fast. An ADA claim alone is typically settled in the $5,000–$15,000 range to avoid a federal case. Layered with CIPA, settlements jump into the $25,000–$75,000 range. And both are often filed by the same firm in the same week.

Who actually gets sued

A common misconception is that only big businesses get hit. Not true. Plaintiff firms run automated scanners, identify any business with a public-facing website that fails the WebAIM scan, and file in volume. Small Orange County businesses — restaurants, dentists, contractors, real estate agents, financial advisors — are routinely targeted.

Most never make the news because they settle quickly. The ones that do not settle become precedent.

What to actually do

The fix is in two parts: accessibility and tracking consent. Start with the accessibility part because it is broader and the returns are immediate.

Part 1 — the accessibility audit

1. 1
   Run WAVE on your homepage and 3-5 key pages

   WAVE is free at wave.webaim.org. Paste your URL. It flags every detectable WCAG issue with a red icon. Most sites have between 5 and 50 issues per page. Most issues are 5-minute fixes.

2. 2
   Fix the six high-impact categories first

   Low contrast text, missing alt text, missing form labels, empty links, empty buttons, missing document language. WAVE will flag each of these specifically.

3. 3
   Re-run WAVE after fixes

   Confirm errors are at zero or near-zero. Aim for the green WAVE summary. This is the standard automated scanners catch — which is what plaintiff firms run.

Part 2 — the tracking consent layer

1. 1
   Audit what is actually on your site

   Open your homepage in Chrome, right-click and choose Inspect, then go to the Network tab and reload. Look for connections to Meta, TikTok, Hotjar, FullStory, LinkedIn, anything similar. Each one is a potential CIPA exposure if it loads before consent.

2. 2
   Install a real consent management platform

   Cookiebot, OneTrust, Termly, or Iubenda. Free tiers exist for small sites. The point is that NO third-party tracking script loads until the user clicks Accept.

3. 3
   Verify the cookie banner actually blocks scripts

   Many cookie banners are decorative — they show a banner but the scripts load anyway. Test by accepting nothing, reloading, and checking the Network tab again. If Meta Pixel still fires, the banner is not doing its job.

What this is going to cost you

For most small business sites, the accessibility fixes take 4-8 hours of focused work. The cookie banner is a one-time setup of 2-3 hours. Total: under a day of developer time. Compare that to a $25,000+ settlement, and the math is obvious.

The deeper point

Accessibility work is not a legal compliance exercise. It is a customer experience exercise. About 1 in 4 American adults has a disability that affects how they use the web — vision, motor, cognitive, or auditory. Sites that do this well serve more customers, rank better, and avoid lawsuits as a side effect.

The legal pressure is what gets owners to act. The customer experience benefit is what makes it worth doing well.