The 9 new success criteria in WCAG 2.2 and what they mean for e-commerce
Published: 7 min readThe AccessibleOrNot team
WCAG 2.2 is the version the W3C published on 5 October 2023, adding 9 new success criteria to WCAG 2.1: 2 at Level A, 4 at AA and 3 at AAA. The old criterion 4.1.1 (Parsing) was removed. Most of the new criteria touch the most sensitive parts of an online shop: sticky headers, colour and size pickers, price sliders, and login and checkout forms.
In short
- WCAG 2.2 has 9 new criteria: 3.2.6 and 3.3.7 (A); 2.4.11, 2.5.7, 2.5.8 and 3.3.8 (AA); 2.4.12, 2.4.13 and 3.3.9 (AAA).
- In the EU, EN 301 549 v4.1.1 (September 2026) added the 6 new Level A and AA criteria; they will apply under the EAA once the reference is published in the Official Journal of the EU.
- Türkiye's Circular No. 2025/10 requires WCAG 2.2 Level A, so 3.2.6 Consistent Help and 3.3.7 Redundant Entry are on its mandatory list.
- Clickable targets must be at least 24×24 CSS pixels, or have enough space around them (2.5.8).
Which are the 9 new criteria in WCAG 2.2?
| Criterion | Name | Level | Where it affects a shop |
|---|---|---|---|
| 3.2.6 | Consistent Help | A | Where contact, help and live chat links sit |
| 3.3.7 | Redundant Entry | A | Delivery and billing address, multi-step checkout |
| 2.4.11 | Focus Not Obscured (Minimum) | AA | Sticky header, cookie banner, chat bubble |
| 2.5.7 | Dragging Movements | AA | Price range slider, swipeable gallery |
| 2.5.8 | Target Size (Minimum) | AA | Colour and size chips, quantity +/- buttons |
| 3.3.8 | Accessible Authentication (Minimum) | AA | Login, password field, one-time code, CAPTCHA |
| 2.4.12 | Focus Not Obscured (Enhanced) | AAA | No part of the focused element may be covered |
| 2.4.13 | Focus Appearance | AAA | Thickness and contrast of the focus indicator |
| 3.3.9 | Accessible Authentication (Enhanced) | AAA | Object recognition CAPTCHAs are not accepted either |
Removed criterion: 4.1.1 Parsing. Because browsers and assistive technology now handle invalid HTML consistently, the W3C made this criterion obsolete.
Level A: two new criteria on Türkiye's mandatory list
3.2.6 Consistent Help. If a help mechanism (phone, email, contact form, FAQ, chat) is repeated on several pages, it must appear in the same relative order across them. A "Help" link in the footer of the product page shouldn't move to another corner on the checkout page. The criterion doesn't require you to offer help; if you do, it must be consistent.
3.3.7 Redundant Entry. Information the user has already entered in the same process must be either filled in automatically or available to select. The classic e-commerce example: a "same as delivery address" option for the billing address. Exceptions: when re-entering is essential (security reasons such as confirming a password) and when the information is no longer valid.
Level AA: four criteria sellers to the EU should prepare for
2.4.11 Focus Not Obscured (Minimum). When you reach an element with the keyboard, it must not be entirely hidden by the site's own content. A sticky header, a cookie banner that slides up from the bottom and a chat bubble in the bottom-right corner are the three things that break this most often. Test: tab through the page; can you always see at least part of the focused element?
2.5.7 Dragging Movements. Anything done by dragging must also be possible with a single click or tap. Two number boxes for a price range slider, or next and previous buttons for a swipeable product gallery, are enough.
2.5.8 Target Size (Minimum). Clickable targets must be at least 24×24 CSS pixels. If they are smaller, a 24-pixel circle centred on the target must not overlap a neighbouring target. Links within text are an exception. In shops, the places most likely to fail are small colour chips, quantity plus/minus buttons and the small "remove" icon in the cart.
3.3.8 Accessible Authentication (Minimum). A cognitive test (remembering a password, typing a code, solving a puzzle) must not be the only way to log in; there must be an alternative or a mechanism to help. In practice: don't block pasting into the password field, allow browser and password manager autofill, and allow pasting into the SMS code field. Object recognition CAPTCHAs ("select the traffic lights") are an exception at Level AA, but they need an accessible alternative.
These four are not on the WCAG 2.1 AA list that is the EAA's legal reference today. Version 4.1.1 of EN 301 549, published in September 2026, added them; once the European Commission updates the reference, they will be the expected level for sites selling to the EU too.
Source: W3C, W3C WAI, AccessibleEU (European Commission)
Level AAA: not required, but a useful guide
Neither the EAA nor Türkiye's Circular requires Level AAA. Still, these three are a good yardstick for design:
- 2.4.12 Focus Not Obscured (Enhanced): no part of the focused element may be covered.
- 2.4.13 Focus Appearance: the focus indicator must cover an area at least as large as a 2 CSS pixel thick outline, with a contrast of at least 3:1 between the focused and unfocused states.
- 3.3.9 Accessible Authentication (Enhanced): the exceptions for object recognition and personal content ("choose the photo you uploaded") no longer apply.
Source: W3C
Can automated testing find the new criteria?
Mostly not. axe-core's rule list has a rule for 2.5.8 Target Size; the other new criteria are about behaviour, so they need a human check.
| Criterion | How to test | Time (estimate) |
|---|---|---|
| 3.2.6 | Compare the order of help links on the home, product, cart and checkout pages | 5 min |
| 3.3.7 | Complete checkout twice, with different billing and delivery addresses | 10 min |
| 2.4.11 | Tab through each template; then again with the cookie banner open | 10 min |
| 2.5.7 | Use the slider and gallery by clicking only | 5 min |
| 2.5.8 | Automated scan + measure chip and icon buttons in the mobile view | Automated + 5 min |
| 3.3.8 | Try pasting and autofill in the password and code fields | 5 min |
We cover the general limits of automated testing in a separate post.
Source: Deque Systems, GitHub
In what order should a shop work?
- If you sell to the EU: after Level A, bundle the four AA criteria into one theme update; handling them together is cheaper than patching each one separately.
- If you sell only in Türkiye: start with 3.3.7 and 3.2.6 (mandatory under the Circular), then 2.5.8 and 3.3.8 (the biggest impact on mobile sales and the login flow).
- Either way: write WCAG 2.2 AA into the acceptance criteria of your next theme or design change.
Frequently asked questions
When was WCAG 2.2 published?
The W3C published WCAG 2.2 as a W3C Recommendation on 5 October 2023.
Is WCAG 2.2 backwards compatible with WCAG 2.1?
Yes. 2.2 keeps the criteria from 2.1 (except 4.1.1) and adds 9 new ones. A site that meets WCAG 2.2 also meets 2.1.
What does the 24×24 pixel rule mean on mobile?
2.5.8 measures in CSS pixels, not the device's physical pixels. A target smaller than 24 pixels also passes if there is enough space around it so it doesn't touch a neighbouring target.
Is using a CAPTCHA against WCAG 2.2?
Not in itself. 3.3.8 (AA) allows object recognition CAPTCHAs, but a cognitive test must not be the only way through. A visual CAPTCHA needs an accessible alternative (1.1.1 requires this too).
Sources
- WCAG 2.2 · W3C · 5 October 2023 (current version)
- What's New in WCAG 2.2 · W3C WAI · October 2023
- The European accessibility standard EN 301 549 has been updated · AccessibleEU (European Commission) · 7 September 2026
- Presidential Circular No. 2025/10, Official Gazette No. 32933 (in Turkish) · Lexpera · 21 June 2025
- axe-core rule descriptions · Deque Systems, GitHub · current
Related articles
Are your colour chips smaller than 24 pixels?
Enter your store's URL. We list the issues that can be found automatically, including target size, and give you manual check steps for the other new criteria.