WCAG 2.2 Accessible Authentication for Online Elections

A secure online election must ensure that only eligible voters cast a ballot. But when the security process requires a voter to remember a complex password, solve a visual puzzle, or retype a one-time code from memory, the security measure itself becomes a barrier.

For election administrators managing union, credit union, cooperative, or association elections, accessible authentication is not just a technical detail. It is the difference between a voter participating independently and a voter abandoning the process entirely. The Web Content Accessibility Guidelines (WCAG) 2.2 introduced a specific success criterion—Accessible Authentication—to address this exact challenge.

Here is what election teams need to know about WCAG 2.2 accessible authentication, how it differs from earlier standards, and how to verify that your online voting process does not inadvertently block eligible voters before they even see the ballot.

What is WCAG 2.2 Accessible Authentication?

WCAG 2.2 is the current W3C Recommendation for digital accessibility. While the Department of Justice’s ADA Title II rule currently specifies WCAG 2.1 Level AA as the technical standard for covered state and local government digital content, WCAG 2.2 serves as a forward-looking benchmark for organizations aiming to remove practical barriers for voters with cognitive and learning disabilities.

One of the most significant additions in WCAG 2.2 is Success Criterion 3.3.8: Accessible Authentication (Minimum). This Level AA requirement states that a "cognitive function test" cannot be required for any step in an authentication process unless an alternative method or an assisting mechanism is available.

A cognitive function test is a task that requires a user to remember, manipulate, or transcribe information. In an online election context, this typically includes:

• Memorizing a password or unique access code


• Solving a CAPTCHA puzzle (like identifying crosswalks or traffic lights)


• Retyping a one-time passcode (OTP) sent via email or text message


• Performing calculations to prove human identity

If your online voting portal relies solely on these methods without an alternative, an assisting mechanism, or one of the criterion’s narrow explicit exceptions, it creates a significant WCAG 2.2 accessibility risk.

Why Accessible Authentication Matters for Voters

When an election portal requires a cognitive function test, it disproportionately affects voters with memory impairments, dyslexia, dyscalculia, and other cognitive disabilities. It can also create barriers for voters using screen readers or mobile devices, where switching between an email app to read a code and a browser to type it can be disorienting or result in a timed-out session.

Consider a credit union board election. A member receives a voting notice with an access code. They click the link on their phone, but the voting portal requires them to manually type the 12-character alphanumeric code. If the member has a cognitive disability that makes transcription difficult, or if they rely on a password manager that the portal blocks from pasting, they may be unable to log in.

An accessible authentication process ensures that security does not come at the cost of participation.

How to Meet the Accessible Authentication Standard

To comply with WCAG 2.2 Accessible Authentication (Minimum), an online voting platform must provide either an alternative authentication method that does not rely on a cognitive function test, or a mechanism to assist the voter in completing the test.

Support Password Managers and Copy/Paste

The simplest way to support accessible authentication is to ensure your voting portal works seamlessly with password managers and allows users to copy and paste credentials. If your system blocks pasting into the access code or password field (often done under the misguided belief that it improves security), it creates a significant barrier. Allowing voters to copy a code from their email and paste it into the login field reduces the cognitive burden of transcription.

Avoid Inaccessible CAPTCHAs

A visual or audio CAPTCHA should never be the only way into the election. While WCAG contains a limited object-recognition exception, a voter should have a practical accessible path that does not depend on solving a challenge. Consider measures such as rate-limiting, server-side bot detection, or authentication methods that do not require voters to prove they are human through a puzzle.

Simplify One-Time Passcodes (OTPs)

If your election uses two-factor authentication (2FA) or OTPs, ensure the process is accessible. While reading and retyping a code is a cognitive function test, you can provide mechanisms to assist the voter. For example, use standard input fields that allow mobile devices to automatically suggest the code received via SMS, or allow the code to be copied and pasted without formatting restrictions.

Offer Alternative Login Methods

Providing multiple ways to authenticate can help accommodate different needs. For example, allowing voters to log in using an email link (magic link) bypasses the need to remember or transcribe a password entirely. The voter simply clicks the link in their email, and the system authenticates them securely.

Verifying Your Election Workflow

Before launching an online election, it is crucial to test the entire voter journey, starting with the login process. Do not rely solely on automated accessibility scans, as they cannot fully evaluate the cognitive demands of an authentication flow.

Here is a quick checklist to review your election's authentication accessibility:

• Can voters copy and paste their access codes or passwords into the login fields?


• Does the portal support browser-based or third-party password managers?


• Are voters forced to solve a visual or audio CAPTCHA to log in?


• If OTPs are used, can mobile devices automatically suggest the code, or can it be easily copied and pasted?


• Is there a clear, accessible recovery process if a voter forgets their credentials or gets locked out?

Frequently Asked Questions

Does accessible authentication compromise election security?

No. Supporting password managers, enabling copy/paste, and using magic links are widely recognized as secure authentication practices. In fact, blocking password managers often leads to users creating weaker, easier-to-remember passwords, which decreases overall security.

Is WCAG 2.2 compliance required by law for online elections?

The legal requirement depends on your organization type and jurisdiction. For example, the DOJ’s ADA Title II rule for state and local governments currently specifies WCAG 2.1 Level AA. However, WCAG 2.2 is the current W3C Recommendation and provides the best framework for ensuring your election is practically accessible to all eligible voters.

Can we use different authentication methods for different voter groups?

Yes, as long as the methods provided to voters with disabilities are equally secure and do not require more effort than the methods provided to other voters. However, it is generally best practice to design a single, universally accessible authentication process for all voters.

The Bottom Line

An accessible online election starts before the voter ever sees a ballot. By ensuring your authentication process meets WCAG 2.2 standards, you protect both the security of your election and the right of every eligible voter to participate independently.

If you are preparing for an upcoming election and want to ensure your entire voting workflow—from login to confirmation—is secure and accessible, Votem can help. Explore our Platform capabilities, review our Election Operations services, or contact our team to discuss how we support accessible online voting.