I got an ADA demand letter — what to do in the first 48 hours

What NOT to do

• Do not install an accessibility overlay widget in a panic. Plaintiff's firms specifically flag overlay sites (accessiBe, UserWay, AudioEye, EqualWeb) as evidence of bad-faith compliance. The FTC fined accessiBe $1M in January 2025 for deceptive claims. Installing one after receiving a letter is among the worst signals you can send.
• Do not reply directly to the plaintiff's attorney without counsel. Anything you say can become part of the proof of willful non-compliance.
• Do not modify the accessed pages before documenting them. You need a snapshot of the site as the plaintiff saw it. Fix later.
• Do not assume it's a scam. Even when the letter reads boilerplate, the underlying ADA exposure is real. The mill approach is a feature, not a fraud.
• Do not ignore the timeline. Most letters specify a 7-14 day response window. Silence triggers filing.

Hour 0 — preserve the evidence

1. Archive the current live site. Submit the landing page and the specific URLs cited to the Wayback Machine Save Page Now. This creates a third-party-timestamped snapshot that can't be retroactively altered.
2. Screenshot everything. Full-page screenshots of the cited URLs, the checkout flow, the login flow. macOS: Cmd+Shift+5. Linux: scrot --full.
3. Save the rendered HTML. View source on the cited pages and save the HTML to a dated folder. This is your authoritative record of what the served markup was on the date of the demand.
4. Retain the letter itself. Scan it if paper. Do not annotate or reformat.
5. Capture analytics for the cited pages. Session volume, bounce rate, conversion metrics. Useful later for proportionality arguments.

Hour 4 — scan and inventory

You need to understand what the plaintiff is actually seeing. Plaintiff's firms typically run one of two tools: axe-core (open source, same engine axle uses) or WAVE (WebAIM). Reproduce their scan locally.

1. Run axe-core against the cited pages using the homepage scan form or the CLI: npx axle-cli scan https://your-site.com.
2. Save the full JSON output. Per cited URL, capture the rule ID, severity, node count, target selector, and HTML snippet. Anchor every claim in the letter to a specific rule in your scan.
3. Compare against the letter's allegations.Letters usually cite 5-20 specific violations. Check: are they real? Are they still present? Were some misidentified? Plaintiff's firms sometimes include false positives or issues that were already fixed.
4. Add to the inventory any violations the letter missed. Your counsel will want the complete picture, not just what was cited.

The scan output is evidence in two directions: it documents what needs fixing and it anchors any future “this was already remediated” claim in timestamped data.

Hour 8 — engage counsel

If you don't already have an attorney, now is the time. What to look for:

• ADA Title III experience specifically. General employment or litigation counsel will likely refer out. Ask about comparable matters in the last 24 months.
• Jurisdiction match.Most website-accessibility filings concentrate in the Southern District of New York (SDNY), the Eastern District of New York (EDNY), Florida (SD FL), and California (CD CA). Counsel admitted in the plaintiff's filing venue is essential.
• Willingness to negotiate vs. litigate. In most cases, settlement is cheaper than discovery. A counsel who defaults to scorched-earth will add six figures to your bill for minimal benefit.

Counsel will usually handle the response letter directly. Your job is to give them the technical facts: the scan, the inventory, the remediation plan, and the CI evidence that the regressions won't recur.

Hour 24 — remediation plan

By hour 24 you should have a written remediation plan with real dates. Typical structure:

1. Cited violations — remediate within 30 days.
2. Critical/serious axe-core severities not cited — remediate within 60 days.
3. Moderate/minor severities — remediate within 90-120 days.
4. Human audit — scheduled with a certified auditor (IAAP CPACC or similar) within 60 days. Covers the ~43% of WCAG issues automated tools can't detect.
5. CI gate — pre-merge accessibility check deployed within 14 days to prevent regressions.

The dated plan is often what settles the matter. Plaintiff's firms want either money or observable compliance; a credible dated plan delivers the latter. The CI gate is the part they rarely see from defendants and it's the clearest signal this won't recur.

Hour 48 — CI + statement

By hour 48 two pieces of long-term infrastructure should be in place:

1. CI pipeline scanning every PR for WCAG 2.1 AA regressions. Install the axle GitHub Action (or equivalent). Run it on main. Run it on every PR. This creates a continuous evidence trail.
2. Published accessibility statement at /accessibility with conformance status, named contact (email + phone), assessment methodology, preparation date. Use the statement generator to produce the markup.

Both are cited in virtually every settlement as required deliverables. Get ahead of the requirement by having them live before the response letter goes out.

The lawsuit landscape

Context to calibrate severity: approximately 4,000 ADA website-accessibility lawsuits were filed in US federal courts in 2024, with an estimated further 8,000+ demand letters that settled privately. Most filings concentrate in four venues:

• SDNY / EDNY (New York) — highest filing volume, plaintiff-friendly precedent.
• CD CA (Los Angeles, Unruh Act crossover) — California's Unruh Civil Rights Act statutory damages ($4,000 per violation) layer on top of ADA.
• SD FL (Florida) — growing volume, mixed precedent.
• Federal courts in Illinois and Pennsylvania — emerging.

The most-targeted industries: e-commerce (~70% of filings), hospitality, restaurant chains, professional services with consumer-facing booking, and higher education. Sites on Shopify, WooCommerce, Magento, and Salesforce Commerce Cloud disproportionately appear; the underlying theme inventory usually does.

Typical settlements in the $8,000-$40,000 range for a first-time defendant who remediates promptly. Contested cases can reach six figures in attorney fees alone.

Typical mistakes that make it worse

• Installing an overlay after the letter arrives.As above — signals bad faith and is specifically targeted by sophisticated plaintiff's firms.
• Replying “we're working on it” without dates. Undated commitments are treated as evasion. Always pair commitments with specific remediation dates backed by an engineering plan.
• Partial fixes without CI. Fixing the cited pages and leaving the rest of the site untouched produces the next demand letter within the year, from the same or different plaintiff. The CI gate is what prevents letter #2.
• Assuming a manual audit PDF is enough.A human audit from Q1 2025 doesn't prove the site was accessible in Q4 2025. Continuous CI evidence does.
• Not publishing a statement. A published statement with named contact and escalation path is among the most-cited required deliverables in consent decrees and settlement agreements. Publish it proactively.