EAA Is Now Law: What Every E-Commerce Store Selling to EU Customers Must Fix
Giriprasad Patil·· 7 min read·EAA & Global Laws
The European Accessibility Act is no longer a deadline on the horizon. Enforcement began June 28, 2025 — and if your store serves EU customers, you are already in scope.
This isn't a privacy law that only affects your cookie banner. The EAA reaches into every part of your e-commerce experience: product pages, checkout flow, filters, popups, image alt text, form labels, and error messages. Any business selling to EU consumers must meet EN 301 549 — the European technical standard that incorporates WCAG 2.1 Level AA — or face penalties that range from formal notices to market access restrictions and fines as high as €900,000 in the Netherlands.
## What the EAA Actually Covers
The EAA (EU Directive 2019/882) was transposed into national law across all 27 EU member states, with enforcement starting June 28, 2025 for new products and services. Existing products have until June 28, 2030 to comply — but "existing" has a narrow definition, and enforcement agencies have broad discretion to act sooner if violations are serious.
**E-commerce is explicitly in scope.** The directive covers online retail websites and mobile apps as a service category. If a customer in Germany, France, the Netherlands, or any other EU country can place an order on your site, your site is covered.
The compliance standard is EN 301 549, which currently incorporates WCAG 2.1 Level AA. EN 301 549 is being updated to include WCAG 2.2 criteria — which means the bar will only rise over time.
One critical point that many US-based merchants miss: **the EAA applies extraterritorially**. If you ship to France, your site must comply with French EAA enforcement. If you have subscribers in Germany, your checkout must comply with BFSG (Germany's EAA transposition). Being headquartered in Austin or Atlanta does not exempt you.
## The Microenterprise Exemption Is Narrower Than You Think
The EAA includes a partial exemption for microenterprises providing services — but the threshold is strict: fewer than 10 employees **and** annual turnover below €2 million. If your store exceeds either threshold, you have no exemption. This means the vast majority of DTC brands, Shopify merchants, and WooCommerce stores with meaningful EU sales are fully subject to the law.
## What Enforcement Looks Like in Practice
Enforcement is handled at the national level. Each EU member state has its own enforcement authority and fine structure. The France situation is the most documented so far: French disability advocacy organizations issued formal legal notices to Carrefour, Auchan, Leclerc, and Picard within days of the June 2025 deadline, and emergency injunctions were filed in November 2025 after their compliance efforts proved insufficient (UsableNet, 2025 enforcement timeline).
Germany's model is particularly aggressive: private Abmahnungen (warning letters) are permitted under BFSG, meaning competitors and associations can issue formal warnings to non-compliant businesses — and charge legal fees. Private enforcement started in August 2025 (Greenberg Traurig, 2025).
The Netherlands has implemented mandatory compliance reporting since October 2025: companies offering covered services in the Dutch market must proactively report their accessibility status to the ACM (Authority for Consumers and Markets). That's not passive enforcement — that's a live compliance registry.
## The WCAG Issues That Matter Most to EAA Enforcement
Not all accessibility issues carry equal legal weight. The violations that regulators and advocacy organizations focus on are the ones that prevent disabled users from completing fundamental tasks: finding products, reading information, filling forms, and completing checkout.
| Violation Type | WCAG Criterion | EAA Risk Level | Fix Effort |
|---------------|---------------|----------------|------------|
| Missing alt text on product images | 1.1.1 Non-text Content | Critical | Low |
| Insufficient color contrast (text < 4.5:1) | 1.4.3 Contrast (Minimum) | Critical | Medium |
| Unlabeled form fields in checkout | 1.3.1 Info and Relationships | Critical | Low |
| Keyboard trap in modal/popup | 2.1.2 No Keyboard Trap | Critical | Medium |
| Missing focus indicator on interactive elements | 2.4.7 Focus Visible | High | Medium |
| Non-descriptive link text ("click here") | 2.4.6 Headings and Labels | High | Low |
| Error messages not announced to screen readers | 4.1.3 Status Messages | High | Medium |
| Images in image-only PDFs (product manuals) | 1.1.1 Non-text Content | Medium | High |
| Video without captions | 1.2.2 Captions (Prerecorded) | High | High |
| Missing page language declaration | 3.1.1 Language of Page | Medium | Low |
These aren't theoretical issues. They appear consistently across automated scans of real e-commerce sites, and they're the first things enforcement authorities look for when auditing a site for EAA compliance.
The challenge with dynamic e-commerce environments — Shopify stores loaded with third-party apps, WooCommerce sites using page builders, headless storefronts rendering React components — is that **static HTML scanners miss the majority of live violations**. A scanner that reads your HTML source code without rendering JavaScript will not catch a keyboard trap created by a live-chat widget, a focus indicator missing from an AJAX cart drawer, or an unlabeled form field injected by a checkout upsell app.
That's why EAA compliance requires live-DOM scanning — a scanner that renders the page the same way a real browser does, executes JavaScript, and checks what users actually experience.
## The "I'll Get to It" Risk
The 2030 deadline for existing products is real — but it does not mean immunity from enforcement until then. Enforcement authorities can act on serious violations at any time after June 2025. A complaint from a disabled user, a referral from a national disability organization, or a proactive audit from a market surveillance authority (the Netherlands ACM ran its first formal audits in Q4 2025) can trigger investigation regardless of the 2030 timeline.
According to UsableNet's 2025 mid-year report, 4,800+ ADA lawsuits were filed in the US in 2025 — a 37% increase year-over-year. The EAA doesn't use the US lawsuit model, but the pattern of enforcement is the same: once enforcement mechanisms are active, the number of formal actions escalates quickly.
## What "Compliance" Actually Means for Your Store
WCAG 2.1 AA compliance is not a binary state. It's a continuous practice. A store that passes an audit today may fail after a single app install or theme update. EAA compliance for e-commerce means ongoing monitoring, not one-time remediation. Third-party apps update without warning. New product pages get added. Seasonal sale banners go live. Each change is a new compliance risk.
It also means authenticated page testing for the pages behind login — account dashboards, subscription management portals, order tracking pages. These are in scope under the EAA and are frequently missed by tools that can only scan public pages.
And it means full checkout flow validation — the path from product page through cart, through payment form, through order confirmation. This is the highest-risk area in EAA compliance because it's the most likely to produce a formal complaint from a disabled user who couldn't complete a purchase.
ADAGuard runs live-DOM scans against 23 accessibility check modules — 22 custom checkers plus axe-core — achieving approximately 78% WCAG 2.2 AA automated coverage, compared to roughly 57% for axe-core alone and 42% for Lighthouse. It renders JavaScript, checks dynamic content, and includes authenticated scanning for pages behind login. ADA, Section 508, and EAA compliance checks are included on every plan — including Free.
## The 30-Second Fix
You can't fix what you haven't found. Before any remediation conversation with your developer or your platform's support team, you need to know exactly which violations exist on your live store — the pages EU customers actually land on, the checkout flow they actually use, the popups and widgets that fire after JavaScript renders.
Paste your URL at [adaguard.io](https://www.adaguard.io) and run a free scan. You'll get a report that lists every violation by WCAG criterion and severity — the exact information your developer needs to prioritize fixes and your EAA legal counsel needs to document compliance effort.
The EAA is already law. The question now is: do you know where you stand?
