How to know if your website is exposed under Australia’s Disability Discrimination Act
Most Australian businesses assume the DDA is a government concern. It covers every business that offers a service online. Here's how to know if your website is exposed.
Author
Head of Research and Experience Design
Topics
Most Australian businesses assume the Disability Discrimination Act is a public sector problem. Federal government agencies, universities, maybe large banks. Something that applies to organisations with a dedicated compliance team and a legal department watching over their shoulder.
It doesn’t work like that.
The DDA has covered private businesses since 1992. And with the Australian Human Rights Commission releasing updated digital accessibility guidelines in April 2025, the question of whether your website creates legal exposure is becoming a lot harder to sidestep. The review of the Act itself concluded in late 2025, and the direction of travel is clearly toward stronger, more specific obligations – not weaker ones.
So if you’ve been in “we’ll get to it” mode on accessibility, here’s what you need to understand before that catches up with you.
More than 90% of disabled users who abandon an inaccessible site never tell the organisation why.
What the DDA actually says about your website
The Disability Discrimination Act 1992 prohibits discrimination in the provision of goods, services, and facilities. Digital services are included. The legal precedent was established in 2000 – Maguire v SOCOG – when the Federal Court found that the Sydney Olympics website constituted a “service” under the DDA, and that its inaccessibility to a blind user amounted to unlawful discrimination.
That case is now 25 years old, and the principle it established has since been expanded and built upon.
The Australian Human Rights Commission’s updated 2025 guidelines expanded the scope significantly. Digital accessibility obligations under the DDA now explicitly cover mobile apps, cloud-based software, IoT devices, and biometric systems. The word “website” barely does justice to the range of digital touchpoints Australian businesses now operate. If your business runs any kind of digital service – which almost every business does – the DDA applies to it.
There’s no revenue threshold that exempts you. No business size that puts you outside the scope. The Act applies to any organisation providing goods or services to the public.
Why most businesses get this wrong
The honest reason is that inaccessible websites don’t generate obvious, immediate feedback. A user with a disability who hits a broken screen reader flow or a form they can’t navigate doesn’t usually call your customer service line and explain why, they simply leave. Moreover, The Click-Away Pound research found that more than 90% of disabled users who abandon an inaccessible site never tell the organisation why.
So accessibility failures stay invisible to the businesses creating them, normally until it’s been escalated and it’s too late.
The other reason is that the DDA doesn’t have an enforcement mechanism that creates a visible signal in your inbox. There are no fines, no audits, no proactive compliance checks. The mechanism is complaint-driven: someone experiences discrimination, files a complaint with the AHRC, and your business finds out about its legal exposure when a letter arrives.
Most DDA complaints don’t come from a lawyer scanning your site for issues. They come from real users trying to do something they have a right to do – and finding they can’t.
What "exposure" looks like in practice
When someone files a complaint with the AHRC, they’ll contact your organisation and initiate conciliation – a structured mediation process between the complainant and the business, facilitated by the Commission. In most cases, this is where a settlement is reached, and can involve financial compensation to the complainant, a commitment to remediate the accessibility failures, or both.
If conciliation fails, the complainant can take the matter to the Federal Court.
The Commonwealth Bank was the subject of a complaint about inaccessible touch-screen interfaces – specifically, systems that excluded people with low vision or motor impairments. That case settled through the AHRC process rather than going to court. But the legal and operational cost of getting through that process was real regardless, the reputational exposure was real, and the bank still had to fix the problem at the end of it.
This is the shape of DDA risk for most businesses. Smaller than a class action, but not small.
The specific failure patterns that generate complaints
The failure patterns that generate the most risk tend to cluster around a few areas:
Transaction and form flows
If your checkout process, booking form, or enquiry form can’t be completed by someone using a screen reader or keyboard navigation only, that’s your service failing at the exact moment it’s supposed to work. This is where complaints originate most often.
Video and multimedia content
Video without captions excludes deaf and hard-of-hearing users. The 2025 AHRC guidelines specifically call out multimedia as an area of consistent failure across Australian businesses. If your website uses explainer videos, testimonials, or event recordings without captions, that’s live exposure.
Authentication and verification
Biometric-only login, inaccessible CAPTCHA, and two-factor processes that assume full physical capability – these are increasingly flagged under the updated guidelines. The Commission explicitly addressed biometric barriers as a form of indirect discrimination. If your security or verification layer excludes users with certain disabilities, the underlying service is effectively inaccessible to them.
PDF documents and downloadable content
Reports, spec sheets, service guides, terms and conditions – these are often completely inaccessible to screen reader users. An inaccessible PDF is still a service failure even when the rest of the website is fine.
Any one of these is enough to generate a complaint. Most businesses carrying this kind of risk are carrying more than one.
How WCAG connects to DDA exposure
The DDA doesn’t name a specific technical standard. There’s no version of WCAG written into the Act. But the AHRC’s position is clear: meeting WCAG 2.1 Level AA (and increasingly 2.2, as guidance catches up) is the recognised way of demonstrating you’ve taken reasonable steps to provide accessible digital services. For a full breakdown of what changed in the latest standard, it’s worth reading our overview of what WCAG 2.2 means for Australian businesses.
“Reasonable steps” is the key phrase. The DDA allows a defence of unjustifiable hardship – but courts and the AHRC assess what’s reasonable based on the size and resources of the business, the nature of the accessibility barrier, and how long the issue has existed. A well-resourced enterprise with an inaccessible checkout that’s been live for three years has a harder time arguing unjustifiable hardship than a small business that discovered the problem two weeks ago and is actively fixing it.
How to check where you stand
Automated accessibility scanners are a starting point, not an answer. Tools like Axe, WAVE, or Lighthouse will surface around 30-40% of WCAG failures – the ones that are machine-detectable. The failures most likely to generate complaints are often the ones automated tools miss: broken keyboard navigation sequences, screen reader flows that make no logical sense, forms that technically validate but confuse assistive technology completely.
Knowing where you actually stand requires a structured audit that combines automated scanning with manual expert testing using real assistive technologies – screen readers, switch access, magnification software. That gives you an honest picture of the barriers, not just the ones a tool can see.
What you’re looking for is a prioritised list of what creates actual exposure, what affects the most users, and what can realistically be fixed within your existing development roadmap. What you’re not looking for is a compliance certificate that you can file away and forget about.
If you want to understand where your website actually stands, our digital accessibility team can work through it with you. Start with an audit – it’s the only way to know what you’re genuinely dealing with.
Frequently asked questions
Does the Disability Discrimination Act apply to private businesses?
Yes. The Disability Discrimination Act 1992 applies to any organisation providing goods, services, or facilities to the public – including private businesses of any size. There is no revenue threshold or exemption for small businesses. If your business operates a website, app, or any other digital service, the DDA applies to it.
What happens if someone makes a DDA complaint about my website?
Complaints are filed with the Australian Human Rights Commission (AHRC), which will contact your organisation and attempt to resolve the matter through conciliation – a structured mediation process. Most cases settle at this stage, which can involve financial compensation and a commitment to fix the accessibility issues. If conciliation fails, the complainant can escalate to the Federal Court.
What WCAG standard do I need to meet under the DDA?
The DDA does not name a specific technical standard, but the AHRC’s updated 2025 guidelines recognise WCAG 2.1 Level AA as the benchmark for demonstrating reasonable steps toward accessibility compliance – with WCAG 2.2 increasingly referenced as guidance catches up. Meeting WCAG 2.1 AA is the recognised way to demonstrate your organisation has taken its DDA obligations seriously.
How do I find out if my website has DDA exposure?
Automated tools like WAVE or Lighthouse are a useful starting point but only detect around 30-40% of accessibility failures. A proper assessment requires a structured audit combining automated scanning with manual expert testing using real assistive technologies – screen readers, keyboard-only navigation, and magnification software. This gives you an accurate picture of the barriers that create genuine legal and user experience risk.
Does the DDA only cover websites, or does it apply to apps and other digital services too?
The DDA applies to any digital service your organisation provides to the public. The AHRC’s 2025 updated guidelines explicitly extended coverage to mobile apps, cloud-based software, IoT devices, and biometric verification systems – reflecting the reality that services are now delivered across a wide range of digital touchpoints, not just websites.
Related articles
Real outcomes, for real Australian organisations.
How accessible design nearly doubled loyalty membership for a leading Australian retailer.