How do ADA demand-letter firms pick which Shopify stores to target?
They work from lists, not from browsing. Firms build target lists from industry directories, run automated scans over them, and hand the failures to serial plaintiffs. If your store is in a targeted industry, runs a common theme, and fails the same checks everyone fails, you are already shaped like a target.
The list comes first
The targeting process starts with a list of candidate sites, and the lists are easier to build than most store owners imagine. Industry directories, app store listings, trade association member pages, and even "top Shopify stores" roundups give a firm thousands of domains in an afternoon. Some lists are industry-specific: a firm that has settled twenty cases against apparel brands has every reason to keep working the apparel list, because the templates are written and the plaintiff is already retained.
Shopify itself makes the list-building easier. Platform detection is trivial, theme detection is nearly as easy, and app fingerprints are visible to anyone who looks. A firm can filter a list down to "Shopify stores in this industry running this theme version" with commodity tooling. If your store matches a pattern that has produced settlements before, you are not being singled out. You are in the batch.
The scan decides who gets the letter
Once the list exists, the firm runs automated accessibility scans across it. This is the step that turns a list of ten thousand stores into a list of five hundred letters. The scans look for the same high-signal failures every time: missing form labels, images without alt text on key pages, keyboard traps, low-contrast text on the checkout path. These are not subtle issues. They are the issues that show up in the first sixty seconds of any automated test, which is exactly why they are the issues the scan finds at scale.
What this means for your store is uncomfortable but useful: the scan does not care about your brand, your revenue, or your intentions. It cares about the failure list. Two stores with identical failures are identical targets, even if one of them has a remediation plan and the other does not. The plan matters later, in the negotiation. At the targeting stage, only the findings matter.
Why some stores get hit twice
Stores that settle one demand letter often get another, sometimes from a different firm, and the owners read it as bad luck or a vendetta. It is usually neither. Settling puts you on a list of stores that pay, and the scan data does not expire. If the remediation after the first letter was partial, the second firm's scan finds the remaining issues, and the second letter writes itself. The firms do not need to coordinate. They are all running the same scans over the same lists.
The way out is to make the second scan clean. Full remediation after the first letter is not just good practice; it is the thing that removes you from the next batch. The stores that get hit repeatedly are almost always the stores that fixed the specific issues named in the first letter and stopped. The scan finds what is there. Leave nothing there to find.
How to tell if you are shaped like a target
Run the same kind of scan the firms run, on your own store, before they do. The checks are not secret: automated WCAG scans of the homepage, a collection page, a product page, and the checkout path, with attention to the high-signal failures named above. If your store fails those checks, you are shaped like a target in every industry list you appear on. Fix the findings, and you drop out of the batch.
This is also the honest way to prioritize remediation. The findings that matter most are not the ones that bother you aesthetically; they are the ones that appear in every plaintiff firm's scan. Start there, document the fixes, and keep the scan history. A clean scan history does not make you immune, but it changes the negotiation completely. The firm that finds nothing moves on to the next domain on the list.