If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally.
[1] https://www.businessnewsdaily.com/10900-ada-website-requirem...
They even have a compliance tester.
To be illegal the website must be run by a business which employs 15 or more full-time employees. Or the business is some form of public accommodation like a hotel. From what I have read.
Of course it would be better to make sure the website is accessible, but I'm mostly commenting on the statement that it is illegal.
https://www.businessnewsdaily.com/10900-ada-website-requirem...