WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes compliance mandatory for all government websites.

The current working draft of WCAG 2.2 introduces a new success criterion, 3.3.7: Accessible Authentication. This is a level-A criterion, meaning it must be met in order to claim any degree of compliance.

The success criterion has the following definition:

Success Criterion 3.3.7 Accessible Authentication (Level A): If an authentication process relies on a cognitive function test, at least one other method must also be available that does not rely on a cognitive function test.

The definition of a cognitive function test is given in part as:

A task that requires the user to remember, manipulate, or transcribe information... includ[ing]... memorization, such as remembering a username [or] password[;]... transcription, such as typing in chracters;... performance of calculations; [or] solving of puzzles.

What I'm most concerned about is captcha, which appears to be completely barred by this criterion. The standard "wavy text" captcha is barred as "transcription;" the standard "accessible alternative" audio captcha is also "transcription." The historical alternative "math problem" captcha is "performance of [a] calculation." And the modern captcha is almost blatantly called out by the standard as "solving [a] puzzle" ("identifying which images include a particular object").

How can we verify that an agent accessing a system is indeed a human while still complying with WCAG 2.2 criterion 3.3.7?


I don't think it outlaws every form of CAPTCHA based on the current text

Exception: When the cognitive function test is to recognize common objects or content the user provided to the website.


Put bluntly, the standard requires a non-captcha method of access be available because captchas failing to distinguish a person's humanity is an accessibility issue. More to the point, you shouldn't be trying to determine if a visitor is human, but whether they are authorized user.

Practically, this means that you can't gate login on a captcha solve -- which you shouldn't be doing anyway. If you're concerned an attacker might brute-force a user's password, then you should implement a proper second factor rather than a halfway-measure like a captcha.

Implement WebAuthn so people can use USB push-button tokens, and all your problems will be solved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.