The law of what you collect: privacy, consent, and tracking

You arrive from Write your Build Plan and ship with a live link and the three documents from The pre-flight check: secrets, money, data, and the law in place: the privacy page, the terms, the AI disclosure. That floor was enough on ship day, when the only traffic was you and one invited visitor. This chapter covers the duties that switch on as strangers, analytics, and marketing arrive: they attach to what your product collects and what runs on its pages, and which ones bind depends on where your users come from.

Which laws reach you

Scoping starts with two questions, not with a resolve to comply with everything.

• Do you target EU or UK users? Targeting means an EU-language version, euro pricing, or ad campaigns aimed at EU countries. A stray visitor from Berlin does not put you in GDPR's scope; a German-language landing page does. No EU targeting means no EU consent banner, and the effort moves to the US side.
• Which US states can your users come from? For a public URL the honest answer is all of them, so the real question is which state duties bind at your size; most sit behind thresholds a first ship is years from crossing.

A few duties carry no threshold at all and bind a two-person product from its first user: breach notification law in every state; the FTC Act's Section 5, under which your own published privacy policy becomes the standard you are judged against (the theory behind the BetterHelp and GoodRx orders); COPPA, the federal children's privacy rule, the moment a product is child-directed or you know children use it; GDPR the day you target EU users; and California's wiretap statute, which private plaintiffs enforce without ever checking your revenue.

Legal duties attach to what the product does and whose users reach it, never to how big you are.

One caution before the specifics: laws move faster than course text. Every dated fact in this chapter was checked on August 7, 2026, and The Law Library opens with a cheat sheet of what to build and links each law named here to the official endpoint hosting the current text. When you act on any of this, verify at the endpoint, not against our prose.

The US state laws, without the panic

Twenty-four states have enacted comprehensive privacy laws and about twenty are in effect in 2026, but nearly all bind only above thresholds like the data of 100,000 state residents a year, so a first ship is exempt in most states. The exceptions worth remembering: Texas and Nebraska apply to any business too large to count as a small business under the US Small Business Administration's definition, whatever its data volume, and Maryland and Rhode Island set their bars at 35,000 residents. Once you do cross a threshold, one baseline satisfies nearly every state:

• an accurate notice,
• a working rights-request process,
• an opt-out of sale and targeted advertising,
• signed processor agreements,
• and documented assessments for ad targeting and sensitive data.

One technical requirement matters right now, because it is the most-enforced item in this domain: Global Privacy Control, a browser signal that legally counts as an opt-out of sale and targeted advertising in twelve states as of January 1, 2026, honored automatically, no click required. "Sale" rarely involves money; sharing data with an adtech or analytics vendor for value counts in California and most states. Broken signal handling ran through a year of enforcement, from Honda's $632,500 penalty to Tractor Supply's record $1.35 million, and California, Colorado, and Connecticut announced a coordinated sweep in September 2025. The test costs a regulator nothing: a browser extension, your site, and a look at whether the pixels stop. FuelTheFam, our family nutrition app, sits under every state threshold, and we honor the signal anyway: the toggle takes a minute, and the enforcement pattern is banners that say the right thing while the tags keep firing.

Consent that blocks: the test lives in the Network tab

The law behind the banner is not really about cookies. The EU's ePrivacy rule covers any storage or access on the user's device, so localStorage, mobile SDK identifiers, tracking pixels, and fingerprinting all need the same consent, and swapping cookies for a "cookieless" technique changes nothing. The banner doctrine has been settled for years: consent before any non-essential tag fires, a Reject All on the first layer with the same prominence as Accept All, no pre-ticked boxes, no consent inferred from scrolling.

What moved recently is where regulators look. CNIL's Shein fine was for cookies placed before consent and refusal mechanisms that did not work; its American Express fine, 1.5 million euros in November 2025, was for cookies that kept running after users withdrew consent, even though the consent platform had recorded each withdrawal correctly. Both findings came from network traffic, not from the banner's wording.

A consent banner that does not block its tags is a published confession: enforcement happens at the network level, and the banner's own category list names exactly what should have been blocked.

The doctrine compresses into a test you can run in two minutes:

1. Open DevTools on the Network tab and load the page fresh, leaving the banner unanswered.
2. Count the requests to third-party domains. Beyond what is strictly necessary to deliver the page, the number should be zero.
3. Click Reject All, reload, and browse. The count should stay zero.
4. Accept, then withdraw consent in the banner's settings. The tags should stop in the same session, not on your next visit.

A consent platform on a free or ten-dollar tier passes this test when configured to actually block tags; default installs often are not, which is the difference between installing a banner and actually having consent. If you run Google ads or Google Analytics audiences on traffic from the European Economic Area or the UK, Google adds a contractual layer: Consent Mode v2 through a Google-certified consent platform, which passes the user's choice to Google's tags but does not replace the blocking.

Who comes for a small product, in order

The obvious objection: you are two people with a free product, and no regulator will ever look at you. The first half is genuinely right. CNIL and the state attorneys general spend most of their budgets on household names, the thresholds above exempt a small product from most state privacy laws, and a US-only build with no EU targeting will likely never hear from a European authority. The conclusion is still wrong, because regulators are the last arrival in a longer line.

Private plaintiffs come first. They scan for tags, not revenue. Demand letters under California's wiretap statute target session replay (tools that record a visitor's every click and keystroke), third-party chat widgets, and ad pixels, with statutory damages of $5,000 per violation; the suits climbed from about 600 at the start of 2025 past 4,000 by mid-2026, mostly against ordinary small and mid-size businesses, with a demand-letter industry aimed at small e-commerce sites because they settle, and the reform bill meant to curb them was still pending on August 7, 2026. The Healthline settlement, $1.55 million and the largest under California's privacy law to date, shows how wide "sensitive" runs: ad pixels transmitted article titles that implied a reader's medical diagnosis, so the URL itself was the health data.

Platform gates come second. They check everyone: Google's certified-consent requirement guards the ad money, and the app stores' review queues guard mobile distribution. The first enterprise customer comes third, with a questionnaire asking for your processor agreements, subprocessor list, and deletion story before anything signs. Regulators arrive last. Their attention concentrates on the Sheins and the Googles, whose cases set the rules everyone else inherits, though not only on them: the same California agency that fined Tractor Supply reached the menswear retailer Todd Snyder for $345,178 over a broken opt-out flow. At your size, then, enforcement rarely arrives as a regulator; it arrives as a private plaintiff, a platform gate, or a customer's checklist.

For a product this size, enforcement arrives as a private plaintiff or a platform gate long before any regulator knows you exist.

Your side of this is inventory, not panic: know every third party your pages talk to, disclose each one on the privacy page, and keep pixels and replay tools off any flow a plaintiff could call sensitive.

The machinery that keeps the privacy page true

The pre-flight check: secrets, money, data, and the law wrote your retention sentence. Keeping it true takes a little machinery, each piece a page or a feature, none of it a program.

A lawful-basis table. One page mapping each use of personal data to the legal ground it stands on. Consent is usually the worst default, because it must be freely given, unbundled, and revocable, and the processing must stop the day a user withdraws it; contract and legitimate interests fit most product features better. Here is FuelTheFam's:

Deletion and export as real features. A settings button beats a support inbox, but either way: verify identity before releasing anything, log every request with its dates, and make deletion reach the vendors, the backups, and the logs, not just the production table. GDPR gives you a month to respond; the US state laws give 45 days.

A one-page breach plan, written before it is needed. Under GDPR the clock is 72 hours to the authority, counted from awareness, not from finished forensics. California, since January 1, 2026, requires notice to affected residents within 30 days of discovery, with a copy to the attorney general within 15 days after that when more than 500 Californians are affected. The plan fits a page: who declares an incident, when the clock starts, which portals to file in, and a notification template you would rather not draft mid-crisis.

A vendor transfer check. EU user data on US infrastructure needs a legal transfer mechanism, and the usual one is the Data Privacy Framework: check each US vendor's certification at dataprivacyframework.gov. The framework was upheld in court in September 2025 with an appeal pending, so keep each vendor's standard contractual clauses, the EU's fallback contract terms for data transfers, on file too; if the framework falls, that file turns an emergency into paperwork.

The AI edge: transcripts and prompts

Users type things into an AI box they would never put in a form (symptoms, budgets, the names of their kids), and every word travels to your model vendor on each call. That travel has two legal edges. In California, transcripts flowing to a chat vendor's servers are the live theory in the wiretap suits, with the vendor cast as a third party listening in. And in the privacy notice, the pre-flight's travel sentence now needs the vendor's name: "sent to our AI provider" was enough on ship day, but a user who wants to check that vendor's data terms has to know who it is.

FuelTheFam's fridge photos make the same point without a chat box: a photo of a family's fridge records diet, budget, and household size. The public pages now carry ads, so the line that matters is the one the network test checks: no ad or marketing script loads on the upload flow, and the privacy page names the model vendor the photo travels to. The app stores draw the same line from the outside: Apple requires explicit permission before personal data reaches a third-party AI, Google holds the developer responsible for user data sent to model APIs, and The law of what you sell: accessibility, subscriptions, and the app stores takes the stores in full.

What the pros do

At our size the whole practice is a folder and a habit: a generated privacy policy kept honest by hand against what the Network tab shows, a consent platform configured to block, vendors' standard data processing agreements signed as-is, a one-tab records spreadsheet updated at each launch, and counsel hired per event (a demand letter, a breach, health or children's data, an enterprise redline). Large companies run the same duties as a staffed program, with a privacy review gate on every launch and platforms managing consent state and rights requests. The bridge between the two modes is the first enterprise customer's questionnaire, which asks for exactly the artifacts this chapter has you build.

Try it now

The drill takes about 45 minutes. The no-setup path costs nothing; the tooled path costs pennies of tokens. You arrive with the live link and the pre-flight's three documents; you leave with the consent test run and its result recorded, your lawful-basis table, your one-page breach plan, and a complete third-party inventory. The inventory carries forward: the selling chapter reuses it when the app stores' data-safety forms ask who receives what.

No setup: Run the network test on a product you use daily, then on your own build: DevTools open on the Network tab, a fresh load, count the third-party requests before the banner is answered, then again after Reject All. Zero and zero is a pass. While you are there, compare what fired against what the product's privacy page discloses; the gap between those two lists is the gap the Healthline case was built on.

With your tools: Ask Claude Code: "Inventory every third-party request this build makes and every piece of personal data it stores or sends, with the file and line where each is introduced." From those facts, have it draft your lawful-basis table and one-page breach plan, then verify every law you leaned on at its official endpoint from The Law Library. Same moves in Codex or Cursor, from the sidebar chat. If nothing is installed yet, the Setup Clinic gets you running in one sitting.

Chapter Summary

• Legal duties attach to what your product does and whose users can reach it; company size is neither a trigger nor a shield.
• Two questions do most of the scoping: whether you target EU or UK users (language versions, euro pricing, EU ad campaigns), and which US state thresholds you are anywhere near.
• A few duties bind from the first user with no threshold: state breach notification, FTC Act Section 5, COPPA, GDPR when you target the EU, and California's wiretap statute.
• Most US state privacy laws start around 100,000 residents, with Texas and Nebraska binding any business past the federal small-business definition; Global Privacy Control is the most-enforced technical requirement, an automatic opt-out in twelve states.
• EU consent doctrine is settled: no non-essential tag fires before consent, Reject All sits on the first layer with equal prominence, and the choice is enforced in the network, where CNIL caught Shein and American Express.
• The consent test: fresh load with the banner unanswered, zero third-party requests; after Reject All, still zero; after withdrawal, the tags stop in the same session.
• Enforcement at small scale arrives as private plaintiffs, then platform gates, then a customer's procurement checklist; regulators come last and mostly fine the giants whose cases set your rules.
• The machinery behind the privacy page is small: a lawful-basis table, deletion and export with an identity check and a log, a one-page breach plan (72 hours to an EU authority, 30 days to California residents), and vendor transfer checks at dataprivacyframework.gov.
• Whatever your product sends to a model API belongs in the privacy notice with the vendor's name, and no ad pixel belongs on a chat or upload flow.
• The collecting side is now covered; The law of what you sell: accessibility, subscriptions, and the app stores takes the selling side: who must be able to use the product, how you charge, and what the stores demand.

Sources

• CNIL enforcement: Shein fined 150 million EUR for cookies placed before consent and refusal that did not work (September 1, 2025); American Express fined 1.5 million EUR for cookies that kept running after withdrawal (November 2025) (last verified August 7, 2026).
• ePrivacy Directive 2002/58/EC Article 5(3) on device storage and access; EDPB Cookie Banner Taskforce report (January 2023) and CJEU Planet49, C-673/17 (2019), on reject parity and pre-ticked boxes.
• EDPB Guidelines 3/2018 on the territorial scope of the GDPR: the targeting test for non-EU companies.
• EU Digital Omnibus: proposed November 19, 2025; the AI package was adopted in June 2026, while the data-and-cookies package remained in negotiation, with the Council's June 18, 2026 compromise dropping the browser-signal article; nothing on cookies in force (last verified August 7, 2026).
• California enforcement: Honda $632,500 (March 2025), Healthline $1.55 million (July 2025), Tractor Supply $1.35 million and Todd Snyder $345,178 (September 2025); coordinated Global Privacy Control sweep by the CPPA with the California, Colorado, and Connecticut attorneys general (September 2025) (last verified August 7, 2026).
• Global Privacy Control: a legally binding, automatic opt-out signal in twelve states as of January 1, 2026 (globalprivacycontrol.org; state statutes) (last verified August 7, 2026).
• US state comprehensive privacy laws: 24 enacted, about 20 in effect in 2026; thresholds near 100,000 residents, 35,000 in Maryland and Rhode Island; Texas and Nebraska bind any business past the SBA small-business definition (MultiState; IAPP tracker) (last verified August 7, 2026).
• California wiretap (CIPA) litigation: from roughly 600 suits at the start of 2025 to more than 4,000 by mid-2026, mostly against ordinary small and mid-size businesses, $5,000 statutory damages per violation; reform bill SB 690 pending, with Sections 631 and 632 claims untouched in the amended text (Covington; Duane Morris) (last verified August 7, 2026).
• Breach notification: GDPR Articles 33-34 (72 hours from awareness); California SB 446, effective January 1, 2026: residents within 30 days, attorney general copy within 15 days after that when more than 500 Californians are affected (last verified August 7, 2026).
• EU-US Data Privacy Framework: upheld by the EU General Court on September 3, 2025 (Latombe v Commission, T-553/23), appeal pending at the Court of Justice; per-vendor certification checks at dataprivacyframework.gov (last verified August 7, 2026).
• Google EU User Consent Policy: Consent Mode v2 with a Google-certified consent platform required for personalized ads and Google Analytics audiences on EEA/UK traffic (last verified August 7, 2026).
• FTC Act Section 5 privacy enforcement: the BetterHelp ($7.8 million, 2023) and GoodRx orders, built on the gap between policy promises and pixel behavior; COPPA amended rule fully binding since April 22, 2026 (Federal Register, 90 FR 16918) (last verified August 7, 2026).
• App store rules on AI data flows: Apple requiring explicit permission before personal data reaches a third-party AI, Google holding developers responsible for user data sent to model APIs; covered in depth in the selling chapter (last verified August 7, 2026).
• FuelTheFam (fuelthefam.com), our family nutrition app; the lawful-basis table and data-travel practices described are live behavior in the product.