Third-party content and vendor obligations

The core rule for third-party content

The 2024 DOJ rule applies to web content that a public entity "provides or makes available, directly or through contractual, licensing, or other arrangements" (Source: 28 CFR Part 35, Subpart H ) . The "or through contractual, licensing, or other arrangements" language is the operative phrase for third-party content.

The mechanism is straightforward: when an entity makes content available to the public through a vendor platform, a licensed system, or a contracted authoring arrangement, the entity is providing that content within the meaning of the rule. The entity remains responsible for the accessibility of content it makes available, regardless of who authored it or what platform delivers it.

Contractual and licensing arrangements

The phrase "contractual, licensing, or other arrangements" reaches a broad set of relationships:

• Vendor-supplied content management systems where the vendor's templates, components, and default content shape the public-facing site
• Learning management systems (Canvas, Blackboard, Moodle, D2L) under license to the entity, hosting course materials authored by faculty and staff
• Document management and records platforms where retrieval interfaces are provided by the vendor
• Online application platforms for admissions, employment, benefits, permits, public records requests
• HR and payroll portals licensed from a vendor and provided to employees
• Library catalog and database systems licensed from publishers and database aggregators
• Form-building and survey tools embedded in the entity's web presence
• Video hosting and streaming platforms for entity content

In each case, the platform is the vendor's and may be under the vendor's technical control, but the content the entity puts on the platform (and often the platform itself, as the entity provides it to users) is in scope.

Platforms and systems this affects

Two scope questions arise repeatedly with platform-hosted content.

Platform-supplied UI vs. entity content

A typical LMS has the vendor's interface (navigation, buttons, dashboard) and the entity's content (courses, instructor materials, student-facing pages). Both are in scope. The vendor's interface accessibility is reachable through procurement (vendor's VPAT or accessibility conformance report) and contract terms. The entity's content accessibility is the entity's direct responsibility.

Vendor-hosted vs. entity-hosted

Whether content lives on the entity's server or on the vendor's server does not control coverage. The test is whether the entity provides or makes the content available. A document hosted on a third-party platform, accessed through a link on the entity's website or through entity authentication, is being made available by the entity.

Where responsibility still sits

Entity responsibility for third-party content does not mean the entity must single-handedly fix every vendor's product. It means the entity must:

1. Know what is in scope. Inventory the third-party platforms and systems used to provide content to the public or to employees.
2. Evaluate vendor accessibility. Request VPATs or ACRs, review them critically, identify gaps.
3. Address content authored on third-party platforms. Faculty-uploaded Canvas content, staff-uploaded documents in SharePoint, vendor-supplied content the entity republishes: all need accessibility attention from the entity, even though the platform is third-party.
4. Plan for known platform gaps. Where the vendor's product has known accessibility limitations, the entity needs a workaround, a remediation plan, or a vendor-replacement plan.
5. Use procurement to push accessibility upstream. Future contracts should require WCAG 2.1 AA conformance, regular accessibility reporting, and remediation obligations. See Vendor responsibilities and procurement.

Common misreadings

"It's the vendor's product, not ours"

Title II coverage attaches to the entity, not to the vendor. A vendor's product that delivers content the entity provides to the public is in scope for the entity's compliance posture, regardless of who built the product.

"The vendor's VPAT says they conform, so we're covered"

A vendor accessibility statement is one data point. It does not substitute for the entity's own evaluation, and it does not address the accessibility of content the entity authors on the platform. A LMS that ships with WCAG 2.1 AA conformance does not make an instructor-uploaded inaccessible PDF accessible.

"Our contract has an accessibility clause"

Contract clauses obligate the vendor under contract law. They do not transfer ADA Title II liability away from the entity. If the public-facing content is inaccessible, the entity remains the responsible party under Title II.

"The third-party content is behind authentication"

Authentication does not affect coverage. Student portals, employee portals, parent portals, and similar logged-in environments are in scope.

Operational response for public entities

A practical response to third-party content scope typically includes:

Inventory

A list of the third-party platforms and systems that deliver content to the entity's public or workforce. CMS, LMS, HR portal, financial system, document management, library systems, application platforms, video hosting, form tools.

Vendor accessibility review

For each platform: request the VPAT or ACR, review against current WCAG 2.1 AA criteria, identify gaps, document the response. For platforms with material gaps, plan for workarounds, contract renegotiation, or replacement.

Authoring guidance for staff on third-party platforms

Faculty using the LMS, staff using SharePoint, communications staff using social media, registrar staff posting forms: each authoring pipeline needs accessibility guidance specific to its platform.

Procurement upgrade

Future contracts include WCAG 2.1 AA conformance, ongoing accessibility reporting, and clear remediation obligations. The procurement change pays off across all future vendor relationships, not just one. See Vendor responsibilities.