W3C Recommendation · October 2023
What WCAG 2.2 added, and what it means for a site that already passes 2.1
WCAG 2.2 is backwards compatible: everything that passed 2.1 still passes, with one exception that was removed rather than tightened. What it adds is nine success criteria aimed at problems that show up on phones, in long forms and for people who do not remember passwords. Six of them sit at level A or AA, which is the level every regulation points at.
The nine additions, and where each one bites
| Criterion | Level | What it stops |
|---|---|---|
| 2.4.11 Focus Not Obscured (Minimum) | AA | Sticky headers and cookie bars covering the element you just tabbed to |
| 2.4.12 Focus Not Obscured (Enhanced) | AAA | Any part of the focused element hidden |
| 2.4.13 Focus Appearance | AAA | Focus rings too thin or too low in contrast to see |
| 2.5.7 Dragging Movements | AA | Sliders, reordering and maps that only work by dragging |
| 2.5.8 Target Size (Minimum) | AA | Tap targets under 24 by 24 pixels with no spacing around them |
| 3.2.6 Consistent Help | A | Support links that move around between pages |
| 3.3.7 Redundant Entry | A | Asking for the same information twice in one process |
| 3.3.8 Accessible Authentication (Minimum) | AA | Login that demands a cognitive test, such as transcribing or remembering |
| 3.3.9 Accessible Authentication (Enhanced) | AAA | The same, with no object recognition exception |
The one that disappeared
4.1.1 Parsing was removed. Browsers now recover from duplicate IDs and unclosed tags well enough that the criterion was testing something assistive technology no longer trips over. Removing it makes some old audit reports look stricter than the current standard, which is worth knowing when you compare a 2019 report with a new one.
Authentication is the expensive one
3.3.8 says a cognitive function test cannot be the only way to log in. Transcribing a code from another device, solving a puzzle, remembering a password with no way to paste it, all of those fail unless an alternative exists. Allowing paste in the password field, supporting password managers and accepting a passkey are the usual fixes, and each touches the part of the stack that security owns rather than design.
Banks, marketplaces and anything with a one-time code should assume this is the criterion that costs them something, and that the security team has to be in the room when it is discussed.
Target size is where mobile sites lose points
24 by 24 CSS pixels is not large. What fails is the dense row of icons in a table, the close button on a toast, the inline "edit" link in a list. The criterion has exceptions, for inline links in a sentence and for targets with enough spacing, so the fix is often spacing rather than resizing.
What it means for compliance in Europe and Canada
EN 301 549 imports WCAG and moves with it, so European work already points at 2.2 at level AA. Ontario's O. Reg. 191/11 still names WCAG 2.0 AA for section 14, which means a Canadian report has to prove 2.0 and, if you want it to hold up with buyers, is worth running against 2.2 as well. Testing against the newer version and reporting both is cheaper than testing twice, because the newer criteria are a superset.
If you already have a 2.1 report
- The pass results stay valid. Nothing that passed 2.1 fails 2.2 on its own.
- Six new criteria have to be checked, and four of them are usually found in the same screens: login, forms, mobile layouts and anything sticky.
- 4.1.1 findings can be closed, because the criterion no longer exists.
- The date matters more than the version. A 2.1 report from three years ago is stale whatever the standard.
What each new criterion costs to fix
Focus obscured is a stylesheet change: give sticky elements a scroll margin and the problem disappears across the whole site. Target size is spacing, adjusted once in the design tokens rather than screen by screen. Redundant entry and consistent help are information architecture, cheap during a redesign and irritating afterwards. Dragging alternatives mean adding buttons beside a slider or a map, which is a day of work per component.
Authentication is the outlier, because it crosses into security policy, session handling and sometimes into a vendor you do not control. Budget for it separately and start the conversation with the security owner before the audit lands, not after.
Reading a report that mixes versions
Old audits still circulate, and they are easy to misread. A 2019 report shows 4.1.1 failures that no longer exist as a criterion. A 2021 report has nothing on target size or authentication, because those criteria were not written yet. Neither is fraudulent; both are stale. When a supplier sends you a report, look at the date and the version before the score, and ask what changed in the product since.
The same applies in reverse when you send yours. Stating the version and the date at the top saves the evaluator a question and saves you a week of email.
What about WCAG 3
It is a working draft with a different scoring model and no legal status anywhere. Nobody should be buying against it, and any provider quoting conformance to WCAG 3 today is selling a word. Plan on 2.2 for the next several years.
How we test it
We run 2.2 at level AA on the journeys you choose, with keyboard only, screen readers on desktop and phone, zoom at 200 and 400 per cent, and report criterion by criterion so you can see the pass, the fail and the not applicable. Where a client needs a Canadian record, we map the same results to 2.0 for section 14. See what the audit covers and how EN 301 549 fits on top.
Questions we get before buying
Is WCAG 2.2 legally required anywhere?
Laws point at standards rather than at WCAG directly. EN 301 549 in Europe tracks the current version, while Ontario section 14 still names WCAG 2.0 AA.
Does passing 2.1 mean we nearly pass 2.2?
Usually yes. Six new criteria at A and AA have to be checked, and most sites fail two or three of them at first.
Why was 4.1.1 Parsing removed?
Browsers and assistive technology now handle the markup problems it tested, so the criterion no longer measured a real barrier.
What is the hardest new criterion?
Accessible Authentication. It reaches into login and security decisions rather than into design.
Is 24 by 24 pixels the same as the Apple and Google guidance?
No. Platform guidance suggests larger targets. 24 by 24 is the floor, with exceptions for spacing and inline links.
Do we need a new audit or an update?
If your report is recent, a delta check on the six new criteria is enough. If it is older than a year, retest properly.
Does 2.2 change anything for PDFs?
The criteria apply to documents as well, though the new ones mostly concern interactive behaviour, which PDFs have less of.
Should we wait for WCAG 3?
No. It is a draft with no legal status and no timetable you can plan against.
Can automated tools check the new criteria?
Partly. Target size is measurable, dragging alternatives and authentication are not.
Do you report 2.0, 2.1 and 2.2 separately?
We test at 2.2 AA and map the same findings back, so one test produces the report each jurisdiction asks for.
One test, reported at the level each buyer asks for
WCAG 2.2 AA on the journeys that matter, mapped to 2.0 where a Canadian record needs it.