Edition #5 — Week of October 31, 2026
The September cooldown, the first widget-share drop, and New York's comeback
First, honestly: the Files took a six-week hiatus — we moved offices, and the ritual broke. The lawsuits didn't. This edition catches the watchlist up on everything that landed while we were unpacking boxes: a September cooldown visible in both major trackers, the first drop in the widget-share series, a third lead change in the state race, and a California privacy law that quietly closed a door. Cadence resumes: next edition Friday, November 6.
The numbers that matter
ADA web lawsuits in September (UsableNet) — down from 432 in August
of September defendants (EcomBack) ran a widget — down from 27.6%, the first drop in the series
of September filings came from New York — back to #1 after the midyear collapse
The September cooldown — on both trackers
UsableNet's tracker counts 360 September suits (from 432 in August), with 78 defendants previously sued for accessibility issues. EcomBack's September recap — a different methodology (200 suits, −28.3% from 279) — agrees on the direction. Their Q3 report puts the quarter at 753 suits, down from 960 in Q2, and the year to date at 2,805 — 9.7% under the same period of 2025. Before anyone relaxes: these counts are the visible tip. Demand letters outnumber suits by an order of magnitude, and EcomBack's own midyear framing applies — the figure is a floor, not a ceiling. A cooldown month is a good month to fix things cheaply, not a signal the wave is over.
The widget number finally wiggles — read it carefully
The series we've tracked since Edition #2 — widget share of sued sites, 24.9% (2025) → 28.2% (July) → 31.0% (August) — broke downward in September on both trackers: UsableNet to ~25.3% (91 of 360), EcomBack to 17.0% (34 of 200, from 27.6%). Two independent methodologies, same break. But read it the honest way: this is one month, and it means fewer sued sites happened to be running widgets — not that widgets started protecting anyone. EcomBack's Q3 widget share is still 24.06% — one in four — and their report's own footnote is the right summary: a widget is not a defense. If the drop holds through Q4, the interesting question becomes whether merchants finally stopped buying them.
New York retook the lead — third lead change this year
September's state table flips the midyear story again: New York led with 77 suits (38.5%) — after losing nearly 40% of its volume at midyear — Florida took second (53, 26.5%), and California nearly halved, 78 → 41. Illinois, the midyear #1, fell to 12. The year-to-date ledger still shows California on top (652), but the pattern that matters is the volatility itself: three different #1 states inside one year means filing volume migrates with plaintiff-firm strategy, not with geography. Where your store is registered tells you almost nothing about your risk; what your store is built on still does — Shopify remained the most-targeted platform in September at 44.5% (45.9% year-to-date).
Concentration keeps climbing
Even in a cooling month, the filing bar concentrated further: just 22 law firms filed all 200 September suits, the top 11 responsible for 86.9% — Gottlieb & Associates led with 45 (22.5%), followed by Manning Law (29) and ADA Legal Team (26). Year to date, 11 firms account for 81.5% of everything, and one plaintiff — Michael Sandoval — has filed 242 suits, 8.6% of the national total, on his own. When the volume drops but concentration rises, what's actually happening is the casual filers left and the professionals stayed. Your exposure didn't drop with the total; it consolidated with the specialists.
CIPA's quiet climb — and SB 690 closes a door
California's privacy second front keeps growing while nobody watches: 345 website CIPA suits so far this year, rising every quarter (94 → 113 → 138), with September adding 31 and the two-firm duopoly finally cracking as new filers enter — 42 cases even moved to federal court. The legislative answer arrived September 30: SB 690 was signed, ending private "pen register" claims for online tracking from January 1, 2027. That closes one of the plaintiff bar's favorite theories — but only one; the cookie-consent theories that pair with accessibility claims remain open. If your banner drops tracking cookies before consent, the six weeks we were away did not make that safer.
From the Phriday desk
We're back, and catching up: the Compliance Halo and the free Cookie Compliance module both shipped while the newsletter was dark — one workspace auditing a site against SOC 2, HIPAA, PCI DSS v4.0, ISO 27001 and the EU AI Act, and a free-forever cookie consent check at phriday.app/cookie-compliance. The weekly ritual is restored from here — next edition lands Friday, November 6. And the 60-second starting point hasn't moved: scan your store free.
One fix before the weekend
Restaurants and food & beverage led September's industry table again (29.5%). If that's you, the single highest-value fix is boring: your menu is probably a PDF, and PDFs are the most-cited barrier in these suits after missing alt text. Screen readers choke on untagged PDFs, they can't reflow on phones, and they're invisible to search. This weekend: rebuild the menu as a real HTML page on your site — headings for sections, a real list for items, prices as text. Keep the PDF as a secondary link if you must, but make the page the menu. One afternoon, and it removes the barrier your customers actually hit.
Sources: UsableNet ADA Lawsuit Tracker (September 2026); EcomBack September 2026 recap and Q3 2026 report (published October 2026). UsableNet and EcomBack totals use different court-coverage methodologies and are not comparable to each other. Phriday Access provides monitoring and remediation guidance, not legal advice.
Know where you stand — free
A 10-issue scan of your store, plain-English report by email. 60 seconds.
Scan my site free →Phriday Access provides monitoring and remediation guidance, not legal advice. Next edition: Saturday, November 7.