What's new in WCAG 2.2 — and why you should care

WCAG 2.2 added 9 new criteria to the AA bar. Here is what they actually mean, what design and engineering changes they require, and when courts will start citing them.

WCAG 2.2 was published as a W3C Recommendation in October 2023. It is the current state of the standard — the previous version, WCAG 2.1 (2018), is no longer the latest. If you are buying or selling accessibility services in 2026, the version on the contract should say 2.2.

WCAG 2.2 didn't replace 2.1. It is a strict superset: every criterion in 2.1 is still in 2.2, and 9 additional criteria were added (one Level A, four Level AA, four Level AAA, with one criterion — 4.1.1 Parsing — removed because modern HTML parsers handle malformed markup gracefully). If you were AA-conformant under 2.1, you are most of the way to 2.2 AA — but not all the way.

The 4 new Level AA criteria you actually need to fix

2.4.11 Focus Not Obscured (Minimum)

When a focusable element receives keyboard focus, its focus indicator must not be entirely hidden by sticky headers, footers, cookie banners, or other floating UI. This breaks an enormous number of sites with sticky navs — the focus ring lands behind the nav bar and the keyboard user has no idea where they are.

Fix pattern: when scrolling a focused element into view, add scroll-padding-top equal to the height of your sticky header, OR usescroll-margin on focusable elements. Modern CSS handles this in about 4 lines.

2.5.7 Dragging Movements

Any interaction that requires a dragging gesture (sortable lists, signature pads, slider thumbs, kanban boards) must offer a single-pointer alternative — usually buttons or keyboard shortcuts. People with motor impairments and people on touch devices with assistive switches can't reliably perform a drag.

Fix pattern: every drag-to-reorder list needs “move up” / “move down” buttons next to each item. Yes, even if they're ugly.

2.5.8 Target Size (Minimum)

Interactive elements must have a clickable target of at least 24×24 CSS pixels — or be spaced from their neighbors by at least that much, so an offset miss still hits the right element. Pagination dots, social icons in dense footers, and inline edit/delete icons in tables are the most common offenders.

Fix pattern: bump small icons to a 24px hit-area using padding (visual size can stay the same), or add margin so adjacent targets don't crowd each other.

3.3.8 Accessible Authentication (Minimum)

Authentication processes must not require cognitive function tests — including memorizing usernames, transcribing characters from images, or solving puzzles — unless an alternative is provided (passkey, OAuth, copy/paste from a password manager, etc.). This effectively bans CAPTCHA-only sign-in flows.

Fix pattern: support magic-link, OAuth, or passkey login as an alternative to anything that requires cognitive effort. Our own sign-in flow is magic-link only — by design.

Why this matters legally — even though courts haven't caught up yet

U.S. courts have not yet specifically cited WCAG 2.2 in published ADA Title III decisions (most settlements still reference 2.1 AA). But the legal pressure moves with the standard:

• The U.S. Department of Justice issued an ADA Title II rule in April 2024 that requires public-sector entities to conform to WCAG 2.1 AA — a floor, not a ceiling. As 2.2 becomes the de-facto standard, expect Title III settlements to follow.
• Plaintiff law firms in the U.S. are already incorporating 2.2 criteria into demand letters because it's easier to argue that a 24×24 target size is a reasonable bar than to argue an unspecified one.
• State-level laws (California Unruh Act, New York 504, Illinois IADAA) all tend to track the federal ADA standard — so where WCAG 2.2 lands at the federal level, the state laws will follow.

Practically: if you're writing or signing accessibility commitments in 2026 (procurement contracts, product roadmaps, settlement agreements), reference WCAG 2.2 AA. It's the safer commitment, and it's only marginally harder to meet than 2.1.

How Plumb audits against 2.2

Plumb defaults all new scans to WCAG 2.2 Level AA. Our axe-core ruleset includes the new 2.2 criteria, and our AI augmentation specifically looks for the judgment-based ones (focus obscuring, drag alternatives, accessible auth) that automated tools cannot detect on their own. You can pick A, AA, or AAA on the scan form for paid plans; AA is the sweet spot for compliance.