Artifact · last verified August 7, 2026
The Law Library
The companion page to The law of what you collect and The law of what you sell. The cheat sheet below is the short version of both chapters; the library under it links every law they name at the official endpoint hosting the current text. Laws move faster than course text, so before you act on any row, read the endpoint.
Scope before you read
Answer the trigger questions first: whose users can reach the product, what it collects, what it charges, and where it ships. Then skip every section your answers rule out. A US-only free product with no analytics needs a fraction of this page.
The cheat sheet
The two chapters in one table: the thing you build, the law behind it, and when it binds you. Each group matches a section of the library below, where the linked text lives.
What you collect
| Build this | The law behind it | When it binds you |
|---|---|---|
A privacy page that matches real behavior What you collect, where each piece sits, the model vendor named, a retention sentence someone can check. | FTC Act Section 5; GDPR Articles 12 to 14 | Always, from the first user |
A lawful-basis table One page mapping each use of personal data to contract, legitimate interests, or consent. | GDPR Article 6 | When you target EU or UK users |
Deletion and export as features An identity check, a request log, and deletion that reaches vendors, backups, and logs. | GDPR Articles 15 to 22; US state privacy laws | EU targeting always; US states once over their thresholds |
A one-page breach plan Who declares an incident, when the clock starts, which portals to file in, a notification template. | GDPR Articles 33 and 34; every state's breach law; California SB 446 | Always; the clocks are 72 hours to an EU authority and 30 days to California residents |
A vendor transfer file Each US vendor's Data Privacy Framework certification checked, standard contractual clauses kept on file. | GDPR Chapter V; the EU-US Data Privacy Framework | When EU user data lands on US infrastructure |
What runs on the page
| Build this | The law behind it | When it binds you |
|---|---|---|
A consent banner that actually blocks No non-essential tag before consent, Reject All at equal prominence, withdrawal that stops tags in the same session. | ePrivacy Directive Article 5(3); GDPR consent standards | When you target EU or UK users |
Global Privacy Control honored The browser signal counts as an automatic opt-out of sale and targeted advertising. | CCPA and eleven other state laws | US states once over their thresholds; the most-enforced item on this sheet |
A third-party inventory Every pixel, replay tool, and chat vendor your pages talk to, disclosed on the privacy page and kept off sensitive flows. | California wiretap statute (CIPA); FTC Act Section 5 | Always for California traffic; no threshold |
Consent Mode v2 through a certified CMP Passes the user's consent state to Google's tags; does not replace the blocking. | Google EU User Consent Policy (a contract, not a statute) | When you run Google ads or Analytics audiences on EEA or UK traffic |
Who must be able to use it
| Build this | The law behind it | When it binds you |
|---|---|---|
WCAG 2.2 AA on the money path An accessible component library, axe in CI, and one manual keyboard-plus-screen-reader pass per release. | ADA through litigation; European Accessibility Act; EN 301 549 | US: any size. EU sales: above ten people or two million euros in turnover |
An accessibility statement How the product meets the bar, with a contact someone monitors. | European Accessibility Act | EU sales; in the US it routes complaints to you before a law firm |
A VPAT, answered honestly The conformance report enterprise and government buyers request; Partially Supports with remarks beats a blanket claim. | Section 508; buyer procurement | When you sell to enterprises, education, or government |
What you charge
| Build this | The law behind it | When it binds you |
|---|---|---|
Clickwrap with an assent log An unchecked checkbox beside linked terms; the event logged with the terms version. | US contract case law (Chabolla v. ClassPass) | The day you have terms worth enforcing |
A checkout that shows the whole deal Total price with mandatory fees, renewal terms and date, separate renewal consent with proof kept. | ROSCA; California AB 2863; California SB 478 | The day you charge; California is the high-water mark |
Cancellation as easy as signup A same-page online cancel that works immediately, before any retention offer. | ROSCA; state auto-renewal laws | Any subscription or free-to-pay trial |
The EU withdrawal waiver and button The two-part waiver before instant delivery, and a working withdrawal function. | EU Consumer Rights Directive | When you sell to EU consumers |
Marketing consent by channel US email: postal address and a working unsubscribe. Texts: standalone written consent. EU: opt-in first. | CAN-SPAM; TCPA; ePrivacy Article 13 | The day you send marketing |
Where you ship it
| Build this | The law behind it | When it binds you |
|---|---|---|
Truthful store declarations Privacy labels and the Data safety form matching the app's actual network traffic. | App Store Review Guidelines; Google Play policies | Every app submission |
In-app account deletion Full deletion started inside the app; deactivation does not count. | App Store Guideline 5.1.1(v); Play account-deletion policy | Any app with accounts |
An AI consent screen Explicit permission, naming the model provider, before personal data leaves for a third-party AI. | App Store Guideline 5.1.2(i); Play User Data policy | Any app sending user data to a model API |
What the AI must say
| Build this | The law behind it | When it binds you |
|---|---|---|
An AI disclosure at first interaction A visible line in the interface, not a sentence in the terms. | EU AI Act Article 50; California SB 243; New York GBL Article 47 | Any chatbot or assistant reaching EU users; companion traits add duties in California and New York |
An honest answer to "are you a bot?" Hard-coded, so no persona prompt can override it. | Utah AI Policy Act; California bot disclosure law | Any consumer-facing bot |
A claims evidence file Test results backing every accuracy or capability claim, kept from before publication. | FTC Act Section 5 (Operation AI Comply) | Any AI claim in your marketing |
Grounded prices and policies, warnings at output The bot quotes the authoritative source or declines, and the accuracy warning sits at the point of output. | Moffatt v. Air Canada; Walters v. OpenAI | Any bot that speaks for your business |
What you collect
Several rows here have no size threshold; they bind from the first user.
GDPR
the EU's data protection law: lawful basis, user rights, 72-hour breach notice to the authority; binds any product targeting EU users, no size threshold.
UK GDPR and the ICO
the UK's parallel regime plus registration and the annual data protection fee; binds any product targeting UK users.
CCPA and its regulations
California's privacy law: notices, opt-outs, deletion, sensitive data; binds businesses above its revenue or volume thresholds with California users.
US state privacy laws
24 states enacted, nearly all binding only above thresholds like 100,000 state residents; scope by the states your users come from.
IAPP tracker a tracker, not an official text
Texas Data Privacy and Security Act (HB 4)
consumer privacy duties with no volume threshold; binds any business too large to count as a small business under the federal SBA definition.
COPPA
parental notice and verifiable consent before collecting from under-13s, as amended in 2025; binds child-directed services and any operator with actual knowledge of child users, any size.
FTC Act Section 5
unfair and deceptive practices, the rule behind every broken privacy promise; binds every US business from day one.
State breach notification
all 50 states plus DC require notice after a breach, many on 30-to-60-day clocks; applies to everyone, no threshold.
IAPP chart a tracker, not an official text
California SB 446
breach notice to residents within 30 days and to the attorney general within 15 days after that when more than 500 Californians are affected; in force since January 1, 2026.
EU-US Data Privacy Framework
the legal basis for EU personal data on US infrastructure; check each US vendor's certification here before relying on it.
What runs on the page
One caveat: the EU's Digital Omnibus proposal would change the cookie rules, but it is a proposal in negotiation, not law. Build to the current regime.
ePrivacy Directive
consent before any non-essential storage or access on the device: cookies, localStorage, SDK identifiers, pixels; applies to any site reaching EU users.
EDPB cookie banner guidance
the settled EU banner doctrine: Reject All as prominent as Accept All, no pre-ticked boxes, consent technically enforced.
CNIL cookie enforcement
the French regulator tests consent at the network level; its Shein decision (tags firing before consent, a refusal that did not work) is the fact pattern to avoid.
Google EU user consent policy
Consent Mode v2 plus a Google-certified CMP; contractually binds anyone running Google ads or Google Analytics audience features on EEA or UK traffic.
Global Privacy Control
the browser signal that counts as a legal opt-out in 12 states as of January 1, 2026, and the most-enforced technical requirement in the section.
California wiretap statute (CIPA, Penal Code 631)
the statute behind demand letters over session replay, third-party chat transcripts, and ad pixels; enforced by private plaintiffs, no threshold.
Who must be able to use it
Enforcement is litigation in the US and regulation in the EU; both point at WCAG.
WCAG 2.2
the working engineering bar for web accessibility; every binding text below cites 2.1 AA, and 2.2 AA covers them all.
EN 301 549
the European standard that carries WCAG into EU law; applies to products in European Accessibility Act scope.
European Accessibility Act
accessibility duties for e-commerce and consumer services sold into the EU, wherever the company sits, applying since June 28, 2025; microenterprise exemption for services only.
ADA web guidance
the Department of Justice's position on web accessibility for businesses open to the public; enforcement runs through private litigation.
ADA Title II web rule
WCAG 2.1 AA for state and local government sites and apps; binds public entities and shows where US doctrine is heading.
Section 508
accessibility requirements in US federal procurement; binds anyone selling software to the federal government.
VPAT
the template behind the accessibility conformance report B2B buyers request; answer honestly, "Partially Supports" with remarks beats a blanket claim.
What you charge
These rows switch on the day you charge or send marketing.
ROSCA
the US federal floor for subscriptions and trials: material terms on the checkout screen, express consent, cancellation as easy as signup; no threshold.
FTC Negative Option Rule
the click-to-cancel rule, vacated on procedural grounds in July 2025 with rulemaking restarted in 2026; build to it anyway, since ROSCA and state law already require most of it.
California automatic renewal law (AB 2863)
the strictest US subscription regime: free-to-pay conversions covered, consent proof kept three years, renewal reminders, immediate online cancellation; binds anyone charging California consumers.
EU Consumer Rights Directive
the 14-day withdrawal right, the two-part digital-content waiver, and since June 19, 2026 a working online withdrawal function; binds anyone selling to EU consumers.
California honest pricing (SB 478)
the advertised price must include mandatory fees; covers sales to California consumers.
FTC fees rule
total price up front with mandatory fees included; covers live-event tickets and short-term lodging in the US.
CAN-SPAM
the marketing email floor: physical address in the footer, a working unsubscribe honored promptly; no opt-in required in the US.
TCPA
marketing texts and calls need prior express written consent, with revocation honored in any reasonable manner; private plaintiffs collect $500 to $1,500 per message.
EU marketing consent (ePrivacy Article 13)
email marketing needs opt-in, with a soft opt-in carve-out for existing customers; applies to marketing sent to EU users.
Where you ship it
Store policy is private law: it binds by contract and is enforced by review before your first user arrives.
App Store Review Guidelines
Apple's rulebook, including 5.1.2(i)'s explicit permission before personal data goes to third-party AI; binds every iOS app.
App privacy details
the privacy nutrition label, audited against actual network behavior; required for every App Store submission.
App Tracking Transparency
ask before tracking across apps and honor a denial completely, fingerprinting included; binds every iOS app that tracks.
Apple third-party SDK requirements
privacy manifests for listed SDKs so the label matches the traffic; applies to apps shipping those SDKs.
Google Play Developer Program policies
Google's rulebook for Android apps; binds every Play submission.
Google Play Data safety
the disclosure form Google verifies against network traffic; required for every Play app.
Google Play account deletion
in-app account deletion plus a web deletion path; deactivation does not count.
Google Play AI-generated content policy
output filtering and in-app reporting for generated content; applies to AI apps on Play.
Google Play July 2026 policy update
the developer is responsible for data sent to model APIs, with consent duties for third-party AI; applies to AI-integrated Play apps.
Texas App Store Accountability Act (SB 2420)
age verification and parental consent signals, in effect and enforced as of 2026; binds the stores and, through them, developers with Texas minor users.
Play Age Signals API
the age signals developers must consume under the app store age laws; Apple's Declared Age Range API is the counterpart.
What the AI must say
EU AI Act
the EU's AI regulation; its transparency tier reaches anyone whose AI product serves EU users.
Article 50 transparency FAQ
the Commission's guidance on the duties applying since August 2, 2026: tell users they are talking to AI at the first interaction, mark generated media.
EU marking code of practice
how to mark and label AI-generated content in a machine-readable way under Article 50.
California AI Transparency Act (SB 942, amended by AB 853)
provenance marks on generated media plus a free public detection tool; binds generative AI providers over one million monthly users, in force since August 2, 2026.
California SB 243
companion chatbot safeguards: disclosure, crisis protocol, minor protections; binds chatbots with companion traits (memory, persona, sustained relationship) reaching California users.
California bot disclosure law (B&P 17941)
an honest answer when a user asks whether they are talking to a bot, in sale and vote contexts; binds bot operators reaching California users.
New York GBL Article 47
AI companion safeguards: disclosure and a crisis protocol; binds companion-trait chatbots reaching New York users.
Utah AI Policy Act (SB 149)
disclose that a consumer is talking to AI when clearly asked, up front for regulated professions; binds generative AI used with Utah consumers.
Texas TRAIGA (HB 149)
prohibited AI uses with design intent as the liability trigger; binds anyone whose AI reaches Texas residents, with exclusive attorney general enforcement.
Colorado SB 26-189
the replacement for the Colorado AI Act, a notice-and-explanation statute effective January 1, 2027; applies to AI systems reaching Colorado consumers.
FTC AI claims enforcement
every AI capability claim in marketing is an advertising claim the FTC can demand test evidence for; Operation AI Comply is the running sweep.
How to use this page
The chapters carry the reasoning: The law of what you collect: privacy, consent, and tracking and The law of what you sell: accessibility, subscriptions, and the app stores teach the patterns, the enforcement reality, and the moves. The cheat sheet compresses them, and the library points at the text that governs when you make them. The one-line summaries here are pointers, and this page's date is the limit of what they know.