Skip to content
AI-Native PM
Next: After the ship

The law of what you sell: accessibility, subscriptions, and the app stores

Chapter 7 of 8 in Ship and Track · 12 min

The complaint arrives as a PDF on law-firm letterhead, addressed to you as the operator of the site you shipped. It alleges your product violates the Americans with Disabilities Act and cites WCAG success criteria by number, and a search on the plaintiff's name returns dozens of near-identical complaints against other small sites. You forward it to the engineer who found your API key in the bundle, and instead of calling it a shakedown she turns on VoiceOver, blacks out the display with the screen curtain, and hands you the laptop. VoiceOver reads your submit control, an arrow icon with no text, as "button" and nothing else, and Tab jumps from the last input field past it to the footer: with the screen dark, you cannot finish your own product's core flow. Plaintiffs filed 3,117 federal suits like this one in 2025, most settled in five figures, and the demand-letter model works because the failures the template alleges are usually real.

You arrive from The law of what you collect: privacy, consent, and tracking with the data side scoped; this chapter covers the other half: who must be able to use the product, what makes your terms and checkout hold up, what the app stores demand, and what an AI product must visibly do in August 2026. The enforcement pattern from that chapter holds here: you will hear from a private plaintiff like the one behind the letter, a platform gate, or a customer's procurement checklist long before any regulator, while the regulators' cases against the Amazons and Ubers set the rules you inherit.

In the US, the DOJ has never issued a technical standard for private-sector websites, so courts and settlements use WCAG (the Web Content Accessibility Guidelines, the W3C's testable pass-or-fail criteria) at level AA. Enforcement is litigation: filings rose 27 percent last year, most against e-commerce checkouts, and in Missouri one plaintiff with one firm filed every website accessibility suit in the state across two years.

The EU wrote the duty down instead. The European Accessibility Act has applied since June 28, 2025 to e-commerce and consumer services sold into the EU, wherever the company sits, and the first rulings exist: a French court gave Carrefour six months to make its site and app fully accessible under a 500-euro-a-day penalty, holding 71 percent conformance insufficient. Scope the duties the way The law of what you collect: privacy, consent, and tracking taught:

  • US visitors bring litigation exposure at any size.
  • EU sales bring the EAA unless you are under ten people and two million euros in turnover, a services-only exemption you lose once you cross either threshold.

The engineering bar is a single target: every binding text cites WCAG 2.1 AA, and 2.2 AA is a superset, so build to 2.2 AA and you satisfy them all at once.

Meeting the bar cheaply: components, scans, one manual pass

Meeting the bar costs less than the letter suggests if you buy the pieces in the right order.

  • Buy correctness with architecture. Semantic HTML and an accessible component library (Radix, React Aria, or plain native elements) deliver buttons, dialogs, and menus with roles, labels, and focus behavior already correct. AI-written frontends need this most: models trained on the inaccessible web default to click handlers on divs and unlabeled icon buttons.
  • Automate the catchable fraction. Run axe, the standard automated accessibility checker, in CI alongside Lighthouse; they catch roughly a quarter to half of WCAG failures, so a clean scan is necessary and not sufficient.
  • Walk the money path by hand. The failures that generate lawsuits (unlabeled buttons, focus traps, modals a keyboard user cannot escape) fall to one manual pass through the flows a paying user must complete.
The accessibility floor, three layers with costsA card titled the accessibility floor, drawn as three narrowing layers. First, an accessible component library: buttons, dialogs, and forms arrive correct, costing hours, once. Second, automated scans with axe and Lighthouse: they catch roughly a quarter to half of failures, costing minutes in CI. Third, a manual keyboard and screen reader pass on the money path: it catches what actually ships lawsuits, costing about an hour per release. Caption: a clean scan is necessary and not sufficient; the manual pass is where the complaint dies.THE ACCESSIBILITY FLOORACCESSIBLE COMPONENT LIBRARYbuttons, dialogs, and forms arrive correcthours, onceAUTOMATED SCANS (AXE, LIGHTHOUSE)roughly a quarter to half of failuresminutes, in CIMANUAL PASS ON THE MONEY PATHwhat actually ships lawsuitsabout an hour per releaseA clean scan is necessary and not sufficient. The manual pass is where the complaint dies.

Here is the pass the plaintiff effectively ran against you:

The money-path pass (about an hour, free):
1. Keyboard only. Leave the mouse alone. Tab through signup, the
   core feature, and checkout. Every control reachable, focus
   always visible, Tab order matching reading order.
2. Screen reader. VoiceOver (Mac) or NVDA (Windows, free),
   screen curtain on. Same flows. Every button announces its job,
   every meaningful image is described, every error is read aloud.
3. Stop at the first failure, fix it, restart the pass.

FuelTheFam's retake button is exactly what the letter names: an icon with no text. One attribute separates "button" from a control a blind parent can find:

- <button onClick={requestRetake}><RefreshIcon /></button>
+ <button onClick={requestRetake} aria-label="Retake photo"><RefreshIcon /></button>

The last step is paperwork. Publish an accessibility statement with a contact someone monitors: under the EAA a missing statement is itself a violation and the first thing checked, and in the US it is how a complaint reaches you before a law firm does. When a B2B buyer asks for a VPAT, the standard form for reporting WCAG conformance, answer honestly: "Partially Supports" with remarks reads as credible; a blanket "Supports" invites a contract dispute.

Accessibility is cheapest at the component level and most expensive as a retrofit after the complaint arrives.

Terms hold only if the user visibly agreed

Your terms exist for a bad day: the arbitration clause, the liability cap, the line saying generated output can be wrong. Whether a court enforces them depends less on their text than on the moment of agreement. In February 2025 the Ninth Circuit refused to enforce ClassPass's arbitration clause because the sign-up flow lacked conspicuous notice and unambiguous assent: the terms were linked near a button that said something else, and pressing it was not agreement. What reliably survives is clickwrap, an explicit act of agreement beside the linked documents:

☐ I agree to the Terms of Service and the Privacy Policy

[ Create account ]

The box arrives unchecked, the links look like links, and when the user checks it your server writes one row:

{ "event": "terms_accepted", "user": "u_1042", "terms_version": "2026-08-01", "at": "2026-08-19T14:36:05Z" }

That row is what a court asks for when you move to enforce the clause; a material change gets fresh notice and a fresh row, never a silent update.

The obvious objection is that both of these are already handled: an overlay widget (a one-line script sold as making the site accessible automatically) runs on the site, and the terms came from a template, both rational purchases, one line of JavaScript against a five-figure settlement and a ten-dollar document against counsel by the hour. But overlay-equipped sites keep getting sued, complaints cite the widgets as barriers, and the FTC ordered accessiBe, the largest overlay vendor, to pay one million dollars over its compliance claims. ClassPass shows the template's failure at the other end: the terms' text was never the issue; the company lost the motion because the flow never captured assent. Template text is fine; the mechanics around it (labeled controls and a logged agreement) are the part neither purchase gives you.

The day you charge: what the checkout screen must show

FuelTheFam does not charge yet, so treat this as the checklist for the day a price appears. The US federal floor is ROSCA, the 2010 law covering anything that renews by default; with the state laws layered on it, the working checklist is:

  • the material terms (price, renewal frequency, any trial-conversion date) on the checkout screen itself,
  • a separate, express consent to the renewal,
  • cancellation about as easy as signup.

The FTC's click-to-cancel rule was vacated on procedural grounds on July 8, 2025, days before its compliance date, and almost nothing changed: ROSCA and state law already required most of it, the FTC restarted the rulemaking in March 2026, and enforcement kept moving:

  • Amazon settled the Prime case for 2.5 billion dollars in September 2025, over an enrollment flow that buried the decline option and a cancellation path employees called the Iliad Flow.
  • Uber was sued over a cancellation path of up to 23 screens.
  • Cleo AI, an AI cash-advance app, paid 17 million dollars partly for a subscription that was hard to leave.

Build to California, the strictest state, and you cover nearly everyone: since July 2025 its law covers free-to-pay trials and requires affirmative consent to renewal terms with proof kept three years, renewal reminders, and a same-page button that cancels immediately before any retention offer.

Selling to EU consumers adds the withdrawal right: 14 days to a no-reason refund on a digital purchase unless checkout captures the two-part waiver (consent to immediate delivery plus acknowledgment of giving up the right), confirmed by email. Since June 19, 2026, any online sale to an EU consumer must also offer a withdrawal function: a button labeled "withdraw from contract here" or something equally unambiguous, continuously available and prominently displayed. Get the disclosures wrong and the window stretches to 12 months and 14 days. Wherever the buyer sits, the displayed price is the real price: California puts every mandatory fee inside the headline number, the FTC's fee rule binds tickets and lodging, and its general deception authority reaches drip pricing (fees revealed only step by step through checkout) everywhere else.

The five things on the checkout screen the day you chargeA mock checkout card with five annotated rows, each tagged with the rule it satisfies. Total today, six dollars a month, with every mandatory fee included, satisfying honest pricing rules. Renews monthly until you cancel, with the renewal terms and date on the checkout screen itself, satisfying ROSCA. An unchecked consent checkbox reading I agree to the renewal terms, logged with the terms version, satisfying state auto-renewal law. Cancel online anytime as easily as you signed up, the cancellation promise kept, satisfying ROSCA and state law. And a second checkbox, start now and waive the fourteen-day withdrawal right, the two-part waiver for EU customers before instant delivery. Caption: every line is also the evidence you keep.DAY ONE OF CHARGINGTotal today: $6 / monththe displayed price includes every mandatory feeHONEST PRICINGRenews monthly until you cancelrenewal terms and date on the checkout screen itselfROSCAI agree to the renewal termsunchecked box; consent logged with the terms versionSTATE AUTO-RENEWAL LAWCancel online anytime, as easily as you signed upthe cancellation promise, keptROSCA + STATE LAWStart now and waive the 14-day withdrawal rightthe two-part waiver for EU customers, before instant deliveryEU CONSUMER LAWEvery line on the screen is also the evidence you keep.

Marketing the paid thing splits by channel:

  • Email to US users needs no opt-in, but every send carries your postal address and a working unsubscribe honored within ten business days (make it one click, no login).
  • Marketing texts carry a different exposure: standalone written consent before the first message, STOP honored, and 500 to 1,500 dollars per text in statutory damages paid to private plaintiffs.
  • EU recipients are opt-in first, with one carve-out: existing customers whose addresses you collected during a sale may be sent marketing for similar products, with an opt-out in every message.

FuelTheFam's parent list runs under the first and third rules, with EU parents on it only by opt-in.

The app stores review you before your first user does

If the product becomes an app, both stores review it before any user can, against guidelines you accepted in a developer agreement.

  • Your declarations are checked, not filed. Apple's privacy nutrition labels and Google's Data safety form declare what the app collects and shares; Google audits those declarations against the app's actual network traffic, and Apple enforces through review, rejecting over 443,000 submissions for privacy violations in 2025.
  • Tracking asks first. The tracking prompt comes before any cross-app tracking, and a refusal means no tracking, including by fingerprinting.
  • Accounts must be deletable in-app. Deactivation does not count.
  • Both stores tightened their AI rules. Since November 13, 2025 Apple requires explicit permission before personal data goes to a third-party AI, so FuelTheFam's fridge-photo feature as an app would need a consent screen naming our model provider before the first photo leaves the phone; a sentence in the privacy policy does not pass review. Google's July 15, 2026 update makes the developer responsible for user data sent to third-party model APIs, and its AI-Generated Content policy requires preventing restricted content and an in-app button for reporting what the model produces.
  • A child audience changes the rules. Apple rebuilt its age tiers in late 2025 behind a questionnaire every app had to answer to keep shipping updates, and Texas's App Store Accountability Act is live and enforced as of August 2026 while the appeal runs, with age signals from both stores your app must consume.

Rejection is the cheap outcome; removal after launch, with the developer-account termination that can follow, is the expensive one.

The app stores are the strictest regulator most products ever meet, and they review you before your first user does.

What an AI product must visibly do

The AI disclosure you shipped in The pre-flight check: secrets, money, data, and the law, the visible line near the input saying the replies are generated, now has live law behind it: Article 50 of the EU AI Act has applied since August 2, 2026 and requires telling users they are interacting with AI at the first interaction, in the interface rather than in the terms, with fines up to 15 million euros or 3 percent of worldwide annual turnover. A later deadline you may see cited, December 2, 2026, covers only the machine-readable marking of generated content for systems already on the market. More duties sit beside it:

  • Answer "are you a bot?" honestly. Hard-code the answer so no persona prompt can override it: Utah requires disclosure when a consumer clearly asks, and California has required bots that sell to identify themselves since 2019.
  • Notice when you become a companion chatbot. Memory plus a persona can quietly move a general assistant across that line under California and New York law, which carry crisis-protocol and minor-protection duties: a recurring reminder to minors that the companion is AI, and a published protocol routing self-harm signals to crisis services. Scope follows what the product does, not its marketing.
  • Hold test evidence for every marketing claim. DoNotPay's "robot lawyer" claims ended in an FTC order because the company never tested them, and Air AI's autonomous-sales-agent pitch ended in an 18-million-dollar judgment, largely suspended for inability to pay, and a permanent ban on the company and its owners ever marketing business opportunities again.

Every claim your marketing makes about the AI is an advertising claim you must be able to prove with tests you ran before publishing.

Before you run the drill, know that laws move faster than course text. Every date and figure here was checked on August 7, 2026, and The Law Library carries the cheat sheet of both legal chapters and links each law named here to the official endpoint that always hosts the current text. When you act, verify at the endpoint, not against our prose.

Try it now

The drill takes about an hour; the no-setup path costs nothing and the tooled path costs a few cents of tokens. You arrive with the lawful-basis table and breach plan from The law of what you collect: privacy, consent, and tracking; you leave with a money path that passes keyboard and screen reader, a published accessibility statement, and, if charging is planned, drafted checkout disclosures and the assent-log design. All ten strangers in After the ship: watch real use and decide the next move will be able to use what you send them.

No setup: Run the money-path pass printed above on a product you already use, then on your own build: keyboard only through the core flow, then the screen reader with the display dark. Open one real checkout and score it against the day-one list: total price with fees, renewal terms, separate consent, a cancellation promise, and, for EU sales, the withdrawal waiver.

With your tools: Ask Claude Code to run axe against the build and fix the blockers, label every icon button, and draft the one-page accessibility statement with a contact you monitor; publish it beside the privacy page. If charging is planned, have it draft the checkout disclosure block and the assent-log row, then verify each law at its endpoint from The Law Library. Same moves in Codex or Cursor, from the sidebar chat. If nothing is installed, the Setup Clinic gets you running in one sitting.

Chapter Summary

  • In the US, web accessibility is enforced by private lawsuits that use WCAG AA as the benchmark; in the EU, the European Accessibility Act has required it for consumer services since June 2025.
  • Build to WCAG 2.2 AA and you satisfy every text that binds you, because each one cites its predecessor, 2.1 AA.
  • Buy most of the compliance with semantic HTML and an accessible component library, scan with axe in CI, then walk the money path with a keyboard and a screen reader; automated tools catch only a quarter to half of failures.
  • Publish an accessibility statement with a monitored contact, and answer a VPAT with "Partially Supports" plus remarks rather than a blanket "Supports".
  • Overlay widgets and terms templates fail the same way: they buy the look of compliance without its mechanics; suits cite widgets as barriers, and ClassPass lost its arbitration clause to a weak assent flow.
  • Terms bind through clickwrap: an unchecked checkbox or a labeled button beside linked terms, with the assent event logged against a terms version.
  • The day you charge: material terms on the checkout screen, separate consent to renewal, cancellation as easy as signup, the full price with mandatory fees, and for EU buyers the two-part waiver plus the withdrawal button.
  • The app stores treat a mismatch between your declarations and the app's real behavior as a violation (Google audits network traffic; Apple enforces through review), require in-app account deletion, and require explicit permission before personal data reaches a third-party AI.
  • An AI product says it is AI at the first interaction, answers "are you a bot?" honestly, warns at the point of output, and never states your prices or policies without the authoritative source; every marketing claim about it needs test evidence.
  • In After the ship: watch real use and decide the next move you send your link to ten strangers; this chapter made sure the door opens for all ten and, the day a bill exists, the bill is honest.

Sources

  • Seyfarth Shaw, ADA Title III reports: 3,117 federal website accessibility suits in 2025, up 27 percent, with the Missouri single-plaintiff data (last verified August 7, 2026).
  • W3C, WCAG 2.2; the DOJ Title II rule, the HHS Section 504 rule, and EN 301 549 all cite WCAG 2.1 AA (last verified August 7, 2026).
  • European Accessibility Act, Directive (EU) 2019/882, applicable since June 28, 2025; Tribunal judiciaire de Caen ruling against Carrefour, June 4, 2026 (last verified August 7, 2026).
  • FTC final order against accessiBe, one million dollars over compliance claims, finalized April 2025; UsableNet 2025 year-end report on suits against widget-equipped sites (last verified August 7, 2026).
  • Chabolla v. ClassPass, Ninth Circuit, February 27, 2025 (last verified August 7, 2026).
  • ROSCA; Custom Communications v. FTC, Eighth Circuit, July 8, 2025, vacating the click-to-cancel rule; FTC negative-option rulemaking restarted March 2026 (last verified August 7, 2026).
  • FTC v. Amazon, 2.5-billion-dollar Prime settlement, September 25, 2025; FTC v. Uber, filed April 21, 2025; FTC v. Cleo AI, 17 million dollars, March 27, 2025 (last verified August 7, 2026).
  • California AB 2863, effective July 1, 2025; California SB 478, honest pricing, effective July 1, 2024; FTC Rule on Unfair or Deceptive Fees, effective May 12, 2025 (last verified August 7, 2026).
  • Consumer Rights Directive 2011/83/EU; Directive (EU) 2023/2673, the Article 11a withdrawal function, applicable from June 19, 2026 (last verified August 7, 2026).
  • FTC CAN-SPAM compliance guide; TCPA statutory damages of 500 to 1,500 dollars per message (last verified August 7, 2026).
  • Apple App Review Guidelines 5.1.2(i), updated November 13, 2025, and 1.2; Apple 2025 transparency figures on privacy rejections; Google Play Data safety, AI-Generated Content policy, and the July 15, 2026 User Data update (last verified August 7, 2026).
  • Texas App Store Accountability Act, SB 2420, in force January 1, 2026 and enforced as of August 2026 after the Fifth Circuit stayed the district-court injunction, with an expedited appeal pending (last verified August 7, 2026).
  • EU AI Act, Article 50, applicable August 2, 2026, with fines up to 15 million EUR or 3 percent of worldwide turnover and the December 2, 2026 marking date for systems already on the market; Utah AI Policy Act; California Business and Professions Code 17941; California SB 243, January 1, 2026; New York GBL Article 47, November 5, 2025 (last verified August 7, 2026).
  • FTC final order against DoNotPay, February 2025; FTC v. Air AI, 18-million-dollar judgment (largely suspended) and a permanent business-opportunity marketing ban, March 24, 2026 (last verified August 7, 2026).
  • Moffatt v. Air Canada, 2024 BCCRT 149; Walters v. OpenAI, Gwinnett County Superior Court, May 19, 2025 (last verified August 7, 2026).
  • ITI VPAT template and Section508.gov guidance on Accessibility Conformance Reports (last verified August 7, 2026).
Reaching the end does this for you.
Next upAfter the ship: watch real use and decide the next moveChapter 8 of 8 · 7 min
Take with you
The Law Library· Artifact
↑ The Builder’s StackThe Fundamentals map →