Re: Clarification on WCAG Applicability for Absolute Session Timeouts and Suggestion for Future Accessibility Requirements

Hello Dimple,

Thank you for your clear, detailed inquiry.

I invite you to create a new GitHub issue for this in our repository<https://github.com/w3c/wcag/issues>, where the WCAG 2.x Backlog Task Force<https://www.w3.org/WAI/about/groups/task-forces/wcag2x-backlog/> can raise it for discussion. If you don’t have a GitHub account, I’d be glad to create the issue on your behalf.

Cheers,

Adam Page, CPWA
Manager, Accessibility Center of Excellence

Hilton. For the Stay.<http://www.hilton.com/>
From: Dimple Chhabria <dimple.chhabria@gmail.com>
Date: Tuesday, August 4, 2026 at 6:36 AM
To: public-agwg-comments@w3.org <public-agwg-comments@w3.org>
Cc: group-ag-chairs@w3.org <group-ag-chairs@w3.org>
Subject: Clarification on WCAG Applicability for Absolute Session Timeouts and Suggestion for Future Accessibility Requirements

Dear AGWG,

I would appreciate your guidance regarding the applicability of WCAG Success Criteria 2.2.1 (Timing Adjustable) and 2.2.6 (Timeouts) to the following scenario.


Scenario:
A wealth management web application requires users to authenticate before accessing the application.

The application enforces an absolute session timeout, whereby users are automatically logged out after a fixed period of time regardless of whether they are actively interacting with the application. Continuous user activity does not extend the session.

When the session expires, the application logs the user out and displays a message informing them that they have been logged out. However, no advance warning is provided before the session expires, and users are not given an opportunity to extend the session before the logout occurs.


Questions:

  1.  Does this behavior fall under WCAG 2.2 Success Criterion 2.2.1 (Timing Adjustable), and would an absolute session timeout implemented for security purposes qualify for the Essential Exception in SC 2.2.1?
  2.  Does Success Criterion 2.2.6 (Timeouts) apply in this case, given that the logout occurs despite continuous user activity rather than due to inactivity?
  3.  If neither SC 2.2.1 nor SC 2.2.6 applies, would this behavior be considered outside the scope of WCAG, despite the potential accessibility impact of unexpectedly terminating an active user's session?

Suggestion for Future Consideration:
While I understand that absolute session timeouts are often required for security reasons, I have observed that they are commonly implemented in financial, healthcare, and other security-sensitive applications.

From an accessibility perspective, users with disabilities may require additional time to complete complex tasks. If an absolute session timeout expires without any advance warning, users may unexpectedly lose their session and potentially lose unsaved work, even though they have remained continuously active throughout.

Since the current Success Criteria do not appear to explicitly address advance notification for absolute session timeouts, would the Working Group consider introducing a Level AA requirement in a future version of WCAG that requires applications to provide advance notice before an unavoidable absolute session timeout occurs (where security policies permit)? Such a requirement could improve accessibility by allowing users to save their work or prepare for re-authentication, while still enabling applications to enforce necessary security controls.

I would appreciate any clarification on the current interpretation of WCAG, as well as any thoughts on whether this topic has already been discussed or is being considered for future versions of the guidelines.

Thank you for your time and consideration.

Kind regards,
Dimple Chhabria
(Web Accessibility Tester)

________________________________

This transmission is not a digital or electronic signature and cannot be used to form, document, or authenticate a contract. Hilton and its affiliates accept no liability arising in connection with this transmission. Copyright 2026 Hilton Proprietary and Confidential