Are Your Accessibility Scan Logs Discoverable? A Privilege Primer
Your accessibility audits create a paper trail. Whether that trail helps or hurts in a lawsuit depends on how it was created. The privilege basics every store owner should know.
Every accessibility scan your store runs creates a record: what was found, when, and whether it was fixed. In a demand letter or lawsuit, that record becomes evidence. Kept well, it is your best proof of diligence, a dated trail showing you found issues and fixed them. Kept carelessly, it becomes the other side's exhibit A, a list of barriers you knew about and left in place. The difference often comes down to decisions made before the audit started, about who commissioned it and how the results were shared. This is a plain-language primer, not legal advice. For decisions about your specific situation, talk to an attorney who handles website accessibility cases.
Why your audit history matters
Plaintiffs' firms do not just scan your current site. They ask what you knew and when you knew it. A store with a documented history of regular audits and steady remediation tells a story of good faith, even if some issues remain. A store with a single audit from two years ago, followed by nothing, tells a different story. And a store whose own reports list unfixed critical barriers reads as negligence with a paper trail. The audit log is not neutral. It is a narrative about your diligence, and you are writing it whether you mean to or not.
Privilege, in plain terms
Attorney-client privilege can protect certain communications and analyses prepared for legal purposes, which is why many companies run sensitive audits through outside counsel. The basic idea: if your attorney commissions an accessibility audit to advise you on legal risk, the results may be protected from discovery. If your marketing team commissions the same audit to improve conversion, it probably is not. The protection depends on the purpose and the process, not the file format. This is also why the engagement letter matters: it should state clearly that the audit is being conducted to provide legal advice.
The mistakes that waive protection
Privilege is fragile. The most common ways companies lose it are thoroughly ordinary: forwarding the audit report to people who do not need to see it, discussing findings in all-hands channels, posting a summary on the company blog, or handing the report to a vendor without a confidentiality agreement. Each widening of the circle weakens the claim that the document was a confidential legal communication. None of these are exotic errors. They are what happens when a useful report circulates like any other useful report. Treat audit results as sensitive by default and the mistakes mostly prevent themselves.
What to do before your next audit
Three steps, in order. First, talk to counsel before commissioning the audit, not after receiving the results. Privilege generally needs to attach at creation. Second, define the audit's purpose in writing: legal risk assessment, commissioned by counsel, distributed on a need-to-know basis. Third, separate remediation from reporting. The engineering team needs to know what to fix, which means findings will circulate in some form. Work with counsel on how much detail the fix tickets carry. None of this is complicated, but all of it has to happen before the scan runs, because you cannot retroactively privilege a report that was already emailed to forty people.
Frequently asked questions
Is this article legal advice?
No. It is general information about how audit records are treated in accessibility disputes. Website accessibility law is fact-specific and jurisdiction-specific, and privilege rules vary. Before making decisions about audits, reports, or disclosures, speak with an attorney experienced in digital accessibility matters.
Should we stop running scans so there is no paper trail?
No, that backfires. A store that never audits looks indifferent, and indifference is worse than imperfect diligence. Regular scanning with steady remediation is the strongest narrative you can build. The goal is not fewer records. It is records that show a responsible program, created through the right process.
Who should see our accessibility audit reports?
As few people as necessary: counsel, the person overseeing remediation, and the engineers fixing the specific issues assigned to them. Full reports should not circulate company-wide, and summaries should not be posted publicly. Work with your attorney to draw the distribution lines before the first report lands.
We already shared past reports widely. Is it too late?
Not necessarily, but talk to counsel now. They can assess what was disclosed, advise on handling future audits differently, and help you avoid compounding the issue. What you should not do is try to claw back or delete old reports on your own, which can create far worse problems than the original disclosure.