Two markets, one technical standard, and 149 stores with nothing published

Why this page exists

The European Accessibility Act has applied to e-commerce since 28 June 2025. Plenty has been written about the rule. Very little has been written about what the situation actually looks like on real stores, or about what enforcement is genuinely doing as opposed to what vendors say it is doing.

I build front-end remediation for online stores, so I have a commercial interest in you being worried. That is exactly why the methodology is described in full, the scanner is public, and the sections below separate what I measured from what I read.

Part one — my own field test

All 192 domains come from the public member register of a national e-commerce trustmark in one EU member state. That was deliberate: these are certified stores, businesses that already submit themselves to checks on legal compliance, security and financial stability. If anywhere was going to be clean, it was here.

What this is not: a survey of the European Union. It is one market, one register, one alphabetical slice of it. I have no field data on Germany, France or anywhere else, and I am not going to pretend otherwise. When I test another market it gets its own section here, with its own numbers.

Fourteen domains were unreachable, almost all because their bot protection returned a 403 to the scanner. That is their right and I did not work around it. Those fourteen count nowhere.

Finding 1 — the statement is missing almost everywhere

Of the 178 reachable stores, I could not find an accessibility statement at any of the usual addresses on 149 of them. That is 84 percent.

This is the cheapest item on any remediation list and simultaneously the most visible. It is the first thing an outsider can check without reading a line of code, and where supervision has started, it has started here.

Finding 2 — the homepage gives a false reading

This is the most important outcome, and the reason I set the test up differently from the usual approach.

Most accessibility checks look at one page, normally the homepage. I tested three per store: the homepage, a product page and the cart. The difference is substantial.

One example from the dataset, anonymised. A store returned zero critical findings on its homepage and twenty-five on its product page: twenty-four form fields with no label, plus a button with no accessible name. Anyone testing only the front page concludes this store is fine.

That is explicable. The homepage is the shop window — it gets looked at and maintained. The product page and the cart are functional, and that is precisely where a customer drops off.

Finding 3 — the same defect across unrelated stores

On several stores I found exactly the same defect, down to identical CSS selectors: the main navigation uses role="menuitem" without a valid parent structure, combined with tabindex="-1". Keyboard-only navigation therefore does not behave as a user expects.

Identical selectors across unrelated businesses means this does not come from their own work but from the platform's default theme. Good news for the stores involved, and it means one good fix is reusable across many at once — which is why I published one.

Finding 4 — not one overlay in the sample

Of the 178 reachable stores, not one was running an accessibility overlay: no accessiBe, UserWay, EqualWeb or equivalent.

Read one way that is good news: this is a market that has not spent money on false reassurance. Read another way it is not, because it also means the subject has not been touched at all at most of these stores. Hold that thought until the American section below.

Part two — what EU enforcement actually looks like

This section is not my research. It is compiled from published legal and regulatory reporting, and I have tried to separate what is confirmed from what is announced, because a great deal of the material written on this subject is produced by companies selling accessibility services.

The headline nobody selling audits will lead with

As of mid-2026, no confirmed fine issued specifically under a national law implementing the EAA could be verified. All 27 member states have transposed the directive and enforcement powers have existed since June 2025, but the penalties themselves have not yet arrived.

What has arrived is narrower and worth understanding precisely:

• France. Disability rights organisations filed emergency injunctions in November 2025 against several major retailers over inaccessible online services. A court acknowledged accessibility problems but did not order corrective action in summary proceedings, and the matter went to appeal. Enforcement there is being driven by civil society, not by a regulator.
• Germany. Within weeks of the BFSG taking effect, e-commerce operators began receiving private warning letters. These came from law firms using Germany's competition law framework rather than from regulators, and specialist legal commentary has characterised many of the early ones as weak. The cost of responding to one is nonetheless real.
• Sweden. The telecoms regulator began inspections in late 2025 using screen reader testing and opened its first e-commerce cases.
• Netherlands. Responsibility is split across several authorities, with e-commerce sitting under the competition and markets authority. Follow-up investigations have been reported, and active enforcement is expected in the second half of 2026.

The honest summary: regulators are building capacity, private actors are testing the mechanisms, and the penalties on the books have not yet been applied. Those penalties are not small — national maximums range from tens of thousands of euros to over a million depending on the member state, Italy uses a percentage of turnover, and Ireland is the only country with criminal sanctions attached. But a maximum that has never been imposed is a forecast, not a fact.

Why I am telling you this rather than the scary version

Because you can check it, and because the scary version is what everyone else is selling. If your reason for fixing your storefront is fear of an imminent fine in the EU, the evidence does not currently support the urgency. If your reason is that a measurable share of your customers cannot complete a purchase, the evidence supports that today, on your own site, and I can show you where.

Part three — the American picture is completely different

Also not my research. I have run no field test on US stores. This comes from published litigation tracking, and I include it because it is the sharpest available evidence on what overlay widgets actually do.

Web accessibility litigation in the United States runs at roughly four hundred federal filings a month. E-commerce and retail are the most targeted sector by a wide margin. There is no size exemption: small stores receive demand letters at the same rate as large ones. Enforcement happens through private lawsuits rather than through a regulator, which is why the volume is so much higher and the pace so much faster than in Europe.

The number worth pausing on: in the first quarter of 2026, around a quarter of all filings were against sites that already had an accessibility overlay installed. Not sites that had ignored the subject — sites that had paid for a solution. In a single month later in the year, more than a hundred of roughly four hundred defendants had one running.

That is consistent with what the US Federal Trade Commission concluded when it fined the largest overlay vendor one million dollars in 2025 over claims about what those widgets deliver, and barred it from making compliance claims without evidence for twenty years.

Set that against Finding 4 above. In the European market I tested, not one store had bought a widget. In the American market, buying one demonstrably did not prevent being sued. One market has not yet spent the money; the other spent it and got sued anyway.

What connects the two

Two things, and both matter more than the differences.

The same technical standard. The European harmonised standard EN 301 549 v3.2.1 points at WCAG 2.1 AA. American courts and settlements commonly reference WCAG 2.1 AA as well. The legal machinery is entirely different; the success criteria underneath are the same. One piece of code work satisfies both.

The EAA follows the customer, not the company. It applies based on where a service is offered rather than where the business is registered. A store based in the United States that sells to consumers in the European Union is inside its scope, regardless of where its offices are. The reverse is also true of American exposure for European sellers with US customers.

Which means the question "which regime applies to me" often has the answer "both", and the answer to "what do I have to do differently for each" is, at the code level, "very little".

Which failures come up most often

From my own dataset, ordered by how directly they stop a customer:

Most common critical findings, and what a customer experiences

Rule	What is missing	What the customer notices
label	form fields with no label	Hears that something must be filled in, not what
button-name	buttons with no accessible name	Hears "button", not what pressing it does
image-alt	images with no alt text	The image does not exist; product information disappears
link-name	links with no accessible name	Hears "link", not where it goes

The most uncomfortable example in the dataset: at one store, the link to the shopping cart has no text and no aria-label.

<a class="header-button action showcart" href="/checkout/cart/"></a>

A screen reader announces this as "link", and nothing else. A blind visitor cannot find the cart — not even when there are already products in it.

Methodology

Every store was opened in a real browser, not fetched as plain HTML. Cookie walls were dismissed so the scanner sees the page the way a visitor does. Three pages were tested per store: the homepage, a product page and the cart. The product page was confirmed by checking for product structure in the page rather than guessed from the URL.

Testing was done with axe-core against WCAG 2.1 AA and 2.2 AA.

Every page three times

Each page was tested three separate times. Only findings that reappeared in all three runs count. Findings that showed up once and then not again — usually a rotating banner or lazily loaded images — were discarded.

This is not excessive. In an earlier version of this test the same store returned different counts on two consecutive runs. A finding you cannot reproduce is not a finding you can put in front of a business owner.

What was deliberately excluded

• WCAG 2.2 rules such as target-size. The harmonised European standard in force is EN 301 549 v3.2.1, pointing at WCAG 2.1 AA; an update carrying WCAG 2.2 is expected around October 2026. Until then that is a deadline, not a violation — and including it would have inflated the numbers badly, because target-size was the single most common finding of all.
• Contrast findings. Automated contrast measurement fires regularly on text over images, gradients and overlays. Kept separate, because a human has to confirm them.
• Repetition across pages. One missing attribute in a theme produces three findings across three pages. That is one defect, not three.

What a store can do with this tomorrow

Three things, cheapest first, and none of them require hiring anyone:

• Publish an accessibility statement if you sell into the EU. It is required, it is the first thing supervision looks at, and it costs no developer time.
• Do not test only your homepage. Walk through your product page and your cart using the keyboard alone — no mouse. Do you reach the "add to cart" button? That is a ten-minute test you can run yourself, and it finds what most automated checks miss.
• Look at your theme, not at individual pages. Most defects sit in the template and therefore repeat everywhere. One good fix then works across the whole site.

And one thing not to do: do not buy an overlay widget and consider the matter closed. The American filing data is the clearest evidence available on how that ends.

Data and source code

The scanner is public, including the scoring logic and the judgement calls described above, alongside a published fix for the navigation defect in Finding 3: github.com/fantazeer01/eaa-scanner

The underlying dataset contains store names and is therefore not published. Journalists and researchers who want to verify the figures are welcome to get in touch — I will walk through the methodology.