Website and App Launch Legal Checklist: IP, Terms, Privacy, and Compliance

By Casey Scott McKay · 2025-02-28

This checklist takes a website or mobile app from naming to the post-launch docket in ten phases and roughly 110 concrete actions, each one a filing, a document, a configuration change, or a record you will have to produce in litigation two years later. It covers brand clearance and the domain and handle sweep; contractor and employee IP assignments plus the software bill of materials and the AGPL decision; assent-screen design to the Berman and Meyer specification, with the per-user evidence record that decides arbitration motions; the script inventory, the data map, the privacy notice, consent tooling that actually blocks tags before consent, and vendor data processing agreements; the six-dollar DMCA designated-agent registration and the repeat-infringer workflow behind it; claim substantiation, the FTC Endorsement Guides and the Reviews Rule, and the ROSCA subscription flow; a WCAG 2.1 Level AA audit; a vulnerability disclosure policy and a two-track incident runbook; the copyright, design patent, and Statement of Use filing calendar; and the monitoring, docketing, and enforcement program you leave behind. Every phase carries the governing rule, the fee, the trap, and a worked example — Brindle Labs, Inc. shipping NINEBAR on 15 April 2025 — so you can see what finished looks like. Deadlines are consolidated in a single table, and a Common Mistakes section collects the failures that recur across launches.

IP and Technology > Internet | Checklist | Published 28 February 2025 - Updated 18 October 2025 | Casey Scott McKay - marksy.us

Summary. Ten phases, roughly 110 actions, from the first knockout search to the docket you hand over after launch. Brand and domain; ownership and open source; terms and assent design; privacy and data; DMCA and platform exposure; advertising and claims; accessibility; security; IP filings; post-launch monitoring. Each item states the move, and where it matters, the rule that requires it, the fee, and the specific way teams get it wrong. One worked example — Brindle Labs, Inc. shipping NINEBAR on 15 April 2025 — runs through every phase, with dollar figures and dates, so you can tell a finished item from a checked box. The deadlines are consolidated in one table at the end. The doctrine is in the companion article; the sequencing, model clauses, and cost ranges are in the companion guide.

Keywords: website launch checklist · app launch legal checklist · trademark clearance · intent-to-use application · contractor ip assignment · open source license audit · clickwrap assent design · terms of service · privacy policy data map · global privacy control · dmca designated agent · repeat infringer policy · wcag 2.1 aa accessibility · rosca subscription disclosure · ftc endorsement guides · copyright group registration · vulnerability disclosure policy · incident response plan · trademark watch service · launch docket

What this checklist is for, who should use it, and what to have open

What it is. A pre-ship gate for a consumer or business website or mobile app. Every item is either a filing, a signed document, a configuration change, or a record you will have to produce in a deposition. Work it top to bottom and you will finish the job.

Who should use it. Founders and product leads shipping a first version; in-house counsel at a company that has outgrown terms it copied in 2021; and outside counsel running a launch as a fixed-scope matter. It assumes a US-incorporated company, mostly US users with some EU or UK traffic, at least one contractor, and at least one place in the product where a user can type something into a box.

What this is not. It is not the doctrine. Why browsewrap loses, why the § 512 conditions bite, and what Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), leaves you in a database are covered in The Legal Layers of a Website. The model clauses, decision trees, and cost ranges — including the belt-and-braces grant for authors in civil-law countries and the ROSCA pre-billing block — are in Launching a Website or App Without Legal Debt. This is the operational distillation of both.

Have these open before you start.

The certificate of incorporation. You will need the exact legal name at least three times, and "close enough" fails in the Copyright Office directory.
A list of every human who has written code, drawn a pixel, or written a paragraph for this product, with their engagement documents attached.
Repository access and the ability to run a build, so you can generate a software bill of materials.
Publish rights to the tag manager container, or the name of the person who has them. It is usually growth, not engineering.
The pricing page, the product roadmap, and the launch marketing calendar.
A docket, a matter file, and a named owner for each phase. An unowned item is an item that does not happen.

The worked example. Brindle Labs, Inc., a Delaware corporation, shipped NINEBAR — a brew-log and subscription app — on 15 April 2025. Every phase below closes with what Brindle actually did, what it cost, and what it filed. Total legal and filing spend across the whole launch: $38,400, of which $21,000 was a domain.

| Phase | What it settles | Window | Blocks launch? | |---|---|---|---| | 1. Brand and domain | Whether you can keep the name | T-180 to T-150 | Yes | | 2. Ownership and open source | Whether you own what you built | T-150 to T-110 | Yes | | 3. Terms and assent design | Whether your contract exists | T-100 to T-90 | Yes | | 4. Privacy and data | Whether your disclosures are true | T-90 to T-75 | Yes | | 5. DMCA and platform | Whether you have the safe harbor | T-60 to T-45 | Yes, if users can post | | 6. Advertising and claims | Whether marketing can run | T-30 to T-14 | Yes | | 7. Accessibility | Your exposure to the most predictable demand letter | T-55 to T-10 | Risk call | | 8. Security | What happens when something goes wrong | T-21 to T-7 | Risk call | | 9. IP filings | What you own on paper | T-7 to T+90 | No | | 10. Post-launch monitoring | Whether any of it survives year two | T+1 onward | No |

Phase 7 sits where it does because remediation is the long pole: start the accessibility audit at T-55, in parallel with Phase 5, and expect to still be fixing focus indicators at T-10.

Phase 1 — Brand and domain (T-180 to T-150)

[ ] Run a knockout search in the USPTO Trademark Search system for the exact mark, plurals, hyphenated forms, dropped vowels, phonetic equivalents, and foreign-language equivalents, filtered to the classes you will actually use plus adjacent classes.
- Why. To kill bad names in an afternoon before a designer bills for a logo.
- Trap. Treating a clean knockout as clearance. It cannot see common-law users, design-only marks, or state registrations. See Trademark Clearance Searching.
[ ] Sweep the common-law sources: state trademark registers, Secretary of State registries in your top five states, the App Store, Google Play, GitHub, npm, PyPI, domain WHOIS, Instagram, X, TikTok, Crunchbase, and quoted Google searches.
- Authority. United Drug Co. v. Theodore Rectanus Co., 248 U.S. 90, 100-01 (1918) — the unregistered senior user can enjoin you in its trading area.
[ ] Order a full vendor search covering federal, state, common law, domains, and design marks for each mark you are still considering.
[ ] Get a written clearance opinion applying the DuPont factors for registrability and your circuit's confusion test for infringement, dated and saved to the matter file.
- Authority. In re E.I. du Pont de Nemours & Co., 476 F.2d 1357, 1361 (C.C.P.A. 1973); AMF Inc. v. Sleekcraft Boats, 599 F.2d 341, 348-49 (9th Cir. 1979).
- Why. Enhanced damages and fee awards under 15 U.S.C. § 1117(a) turn on culpability. A contemporaneous reasoned opinion is the cleanest evidence that adoption was not willful.
[ ] Score the name on the distinctiveness spectrum before you fall in love with it, and reject descriptive candidates outright.
- Authority. Abercrombie & Fitch Co. v. Hunting World, Inc., 537 F.2d 4, 9 (2d Cir. 1976); refusal ground at 15 U.S.C. § 1052(e)(1). See Choosing a Strong Trademark.
[ ] Clear the logo, the app icon, and the tagline as separate searches, and read the font EULA before the designer outlines the type.
- Trap. Most licensed typefaces exclude use in a logo or trademark. You cleared the word and licensed the wrong thing.
[ ] Register the .com, the two or three typo variants a squatter would take, and the country codes for markets you will actually enter.
[ ] Turn on auto-renew, put a card on file that does not expire within twenty-four months, enable registrar lock and two-factor authentication, and move every registration into an account owned by the entity rather than a founder's personal email.
- Trap. More domains are lost to expired credit cards than to cybersquatters.
[ ] Reserve handles on every platform you might use, and create the App Store Connect record to hold the app name. Calendar Apple's reservation window; Google Play does not reserve names before publication.
[ ] Decide the taken-domain question with a framework, not a mood: buy through a broker with escrow; take .app or a get- prefix; or, if the registration postdates your rights and the registrant holds a portfolio of similar names, file a UDRP complaint.
- Authority. UDRP ¶ 4(a) requires all three of confusing similarity, no rights or legitimate interests, and registration and use in bad faith. WIPO's fee is $1,500 for a single panelist covering one to five domains. Mechanics in Filing a UDRP Complaint to Recover a Domain and the UDRP Complaint Checklist.
- Trap. If the domain registration predates your first use by years you lose the UDRP, because bad faith is measured at registration. Compare routes in UDRP vs. Federal Lawsuit; the statutory alternative is Cybersquatting and the ACPA, 15 U.S.C. § 1125(d), with statutory damages of $1,000 to $100,000 per domain under § 1117(d).
[ ] Say nothing publicly about the name until the assets are in the entity's accounts.
- Trap. A job posting or a pitch deck in a Slack channel is enough for a portfolio registrant to take the .com overnight, and the price triples once they know you need it.

NINEBAR, Phase 1. BREWNOTE died in an afternoon against a live Class 9 registration for BREWNOTES covering software for tracking beverage preparation. CREMA was descriptive of a coffee product's subject matter. NINEBAR — nine bars is the standard pressure for espresso extraction — is suggestive, registrable without secondary meaning, and cleared against one Class 43 registration for bar services in Denver. Search $980, opinion $2,200, eleven days. ninebar.com cost $18,500 plus a 12% broker commission; five defensive domains cost $214 together; handles on six platforms took ninety minutes.

Phase 2 — Ownership and open source (T-150 to T-110)

[ ] Build the contributor list from the repository's commit authors, the design tool's seat list, and accounts payable — not from memory.
[ ] Get a signed present-tense assignment from every contractor, agency, and freelancer, using "hereby irrevocably assigns" rather than "agrees to assign."
- Authority. 17 U.S.C. § 204(a) requires a signed writing for a transfer. Board of Trustees of the Leland Stanford Junior University v. Roche Molecular Systems, Inc., 563 U.S. 776, 785-87 (2011), turned on exactly that difference in wording.
- Why. Software is not one of the nine enumerated work-made-for-hire categories in 17 U.S.C. § 101, and neither is a logo, so a contractor owns what she wrote unless she assigns it. Community for Creative Non-Violence v. Reid, 490 U.S. 730, 751-52 (1989), settles that "employee" means common-law employee.
- Trap. "My standard terms give you a license." A license is not title; it produces a diligence finding, a holdback, and a delay.
[ ] Make the signed assignment a condition precedent to repository access and to the first payment. Not a covenant — a gate.
[ ] Add a Schedule B to every contractor agreement identifying third-party material, open source components with their licenses, and anything generated in substantial part by an AI tool, naming the tool.
- Authority. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence, 88 Fed. Reg. 16,190 (Mar. 16, 2023); Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025). You cannot make the disclaimer at registration if nobody logged it at creation. See the Generative AI IP Compliance Checklist and Who Owns What the Machine Made.
[ ] For authors in civil-law jurisdictions, add an exclusive grant of rights of use, a covenant not to exercise moral rights, and an express consent to modification and to omission of attribution.
- Why. German copyright is not transferable inter vivos; French droit moral is perpetual and inalienable; Polish personal rights are unlimited in time. The assignment clause alone leaves a hole.
[ ] Execute a proprietary information and inventions assignment agreement with every employee, with a prior-inventions schedule and the required statutory carve-out notice.
- Authority. Cal. Lab. Code § 2870 excludes inventions developed entirely on the employee's own time without employer resources and unrelated to the business; § 2872 requires notice of the limitation. Washington, Delaware, and Illinois have close analogues.
- Trap. An overbroad clause can be unenforceable where a narrow one would have held.
[ ] Sweep the strays: the roommate's logo, the agency's one-page SOW, the stock illustration licensed for editorial use only, the Figma file in a personal Google account, the domain in a founder's registrar login.
- Run the Copyright Ownership and Chain-of-Title Checklist against the full asset list and paper the gaps using Transfers, Licenses, and Termination Rights. The doctrine, including joint authorship and the § 203 termination window, is in Who Owns the Work.
[ ] Generate a software bill of materials at build time in SPDX or CycloneDX format, wired into CI so it stays current.
[ ] Triage every license into green (MIT, BSD, Apache-2.0, ISC), yellow (MPL-2.0, EPL-2.0, LGPL), and red (GPL-2.0/3.0, AGPL-3.0, SSPL, BUSL, Commons Clause, CC BY-NC), and enforce the tiers with a pipeline gate that fails the build.
[ ] Resolve every AGPL package in the core service before launch: replace it, buy the commercial dual license, isolate it on written advice, or rip it out.
- Authority. AGPLv3 § 13 treats network interaction as triggering the source-disclosure obligation. Jacobsen v. Katzer, 535 F.3d 1373, 1380-83 (Fed. Cir. 2008), holds open source terms are conditions on the scope of the license, so exceeding them is infringement — injunction and statutory damages, not a contract claim for zero. Neo4j, Inc. v. PureThink, LLC, 58 F.4th 1055 (9th Cir. 2023), forecloses stripping an added restriction and redistributing the result as pure open source.
[ ] Ship the attribution notices: generate a NOTICES file at build and surface it at /licenses on the web and in an Acknowledgements screen in the app.
- Trap. Shipping an Electron or mobile binary with no notices file at all is the single most common trivial violation in software, and it is the first thing a diligence scan finds. See the IP Due Diligence Toolkit.
[ ] Read the developer terms of every third-party API you ingest, before the integration ships.

NINEBAR, Phase 2. Nine contributors, seven of them contractors. Two had never signed anything; both signed before the next sprint, one for $0 and one for a $1,500 true-up. The Warsaw front-end author from the prior product got the belt-and-braces grant. The first SBOM run found an AGPL-3.0 charting library in the analytics service; the team replaced it in three engineer-days at T-118. Cost: $4,100 in counsel time, $0 in tooling.

Phase 3 — Terms and assent design (T-100 to T-90)

[ ] Put the assent notice above the action button, in body-text size, in a color with real contrast.
- Authority. Berman v. Freedom Financial Network, LLC, 30 F.4th 849, 856-57 (9th Cir. 2022), rejected small gray text beneath the call-to-action.
[ ] Make the hyperlink look like a hyperlink — blue, underlined, or otherwise obviously clickable.
- Authority. Berman, 30 F.4th at 857: "the fact that a hyperlink is present must be readily apparent."
[ ] Write the notice so it says what the click means: "By tapping Create account, you agree to the Terms of Service and acknowledge the Privacy Notice."
- Trap. A button labeled "Continue" with a link nearby is the Nguyen fact pattern. Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1178-79 (9th Cir. 2014), held that even a conspicuous hyperlink on every page, close to the buttons users must click, is not constructive notice without more.
[ ] Strip the sign-up screen of anything competing for attention, and confirm the whole notice is visible in one view without scrolling on the smallest supported device.
- Authority. Meyer v. Uber Technologies, Inc., 868 F.3d 66, 78-79 (2d Cir. 2017); Oberstein v. Live Nation Entertainment, Inc., 60 F.4th 505, 515-17 (9th Cir. 2023).
[ ] Use a separate, unchecked checkbox for anything you actually need enforced — the arbitration agreement, the class waiver, the broad content license.
- Why. Clickwrap is enforced nearly always. The conversion cost is small; the litigation delta is not.
[ ] Re-prompt for assent at the point of transaction if the flow is fast.
- Authority. Sellers v. JustAnswer LLC, 73 Cal. App. 5th 444, 476-81 (2021) — context bears on what notice is reasonable, and consumers funneled quickly into a purchase are not bound the way considered account creators are.
[ ] Build the versioned terms repository: every published version gets an immutable ID, an effective date, and a stored rendering of the full document.
[ ] Write a per-user assent record on every acceptance capturing user ID, timestamp with timezone, terms version ID, privacy notice version ID, the interface element clicked, the A/B variant identifier, IP address, and user agent.
- Why. Two years later you must prove this user saw that version on that date. A screenshot taken by counsel while drafting the motion proves nothing. Validity of the electronic record is not the fight — E-SIGN, 15 U.S.C. § 7001, and state UETA enactments settle that. Proof is the fight.
- Trap. Testing sign-up variants without logging the variant. You will have proven that a screen existed, not the one the plaintiff saw.
[ ] Archive a dated DOM capture or screenshot of the sign-up screen at every release, stored outside the product database, and identify by name the engineer who can lay the foundation for those records in a declaration.
[ ] Draft the change-of-terms clause as prospective-only, with email and in-product notice at least thirty days before the effective date, an archive of prior versions, and an express statement that changes to the arbitration agreement do not reach disputes already noticed.
- Authority. Douglas v. U.S. District Court for the Central District of California, 495 F.3d 1062, 1066 (9th Cir. 2007) (per curiam) — you cannot amend by posting and hoping the customer checks the site.
[ ] Separate the documents by function: Terms of Service for use of the product; Terms of Sale if you sell goods; a EULA for a downloadable client; and a Privacy Notice, which is a disclosure and does not belong inside the contract.
[ ] Draft the user content license broadly enough to run the product — worldwide, non-exclusive, royalty-free, sublicensable, transferable, covering hosting, reformatting, derivative works, display, performance, and distribution, surviving deletion as to backups.
- Trap. A content license is not a publicity release. Using a user's face or name in advertising needs separate, specific consent; see Your Face Is Not Public Domain and the Name, Image, and Likeness Clearance Checklist.
[ ] Write acceptable-use enforcement as discretionary, never as a promise.
- Authority. Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1107-09 (9th Cir. 2009), let a promissory estoppel claim past 47 U.S.C. § 230 because an employee promised to remove content.
[ ] Make the warranty disclaimer conspicuous and the limitation of liability survivable: cap at fees paid in the preceding twelve months, exclude consequential damages, and carve out what cannot lawfully be excluded.
- Authority. U.C.C. § 2-316(2) (conspicuousness), § 1-201(b)(10) (definition); Cal. Civ. Code § 1668 voids exculpation for fraud, willful injury, and violations of law. An unlimited exclusion invites a court to strike the whole clause.
[ ] Put the anti-scraping and API terms behind the login, and require an API key for programmatic access.
- Why. After Van Buren v. United States, 593 U.S. 374 (2021), and hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), your leverage against scrapers is contractual, which means it depends entirely on whether the scraper assented. Terms that bind logged-in users may not reach data collected logged out.
[ ] Add an informal-resolution period and a small-claims carve-out to the dispute clause, and have counsel pressure-test any mass-arbitration batching protocol for one-sidedness before you adopt it.
- Authority. Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024), refused to enforce an unconscionable mass-arbitration protocol — and with it the whole clause. A protocol that gives the company all the control is worse than none.

NINEBAR, Phase 3. The sign-up screen went from a footer link to notice above the button in 15px #1B1B1B with a blue underlined link, plus a separate unchecked box for the arbitration agreement. Engineering added an assent_events table with eight columns and a nightly export to cold storage. Two-person sign-off before every release. Cost: one engineer-week and $6,400 of drafting.

Phase 4 — Privacy and data (T-90 to T-75)

[ ] Run the script inventory first: clean browser profile, DevTools open, record every outbound request on the homepage, a product page, the sign-up flow, and checkout. Cross-reference the tag manager container.
[ ] Interview whoever holds publish rights to the container and capture, for every tag: vendor, purpose, fields transmitted, destination country, contract in place, and whether it fires before consent.
[ ] Build the data map — one row per processing activity: what data, from whom, collected how, why, on what legal basis, shared with whom, stored where, retained how long, and who internally can reach it.
- Why. Required in substance by GDPR Article 30, it is the input to every state-law disclosure and answers most of any enterprise security questionnaire you will see in year one.
[ ] Only then write the privacy notice, and write it to the California specification because it is the most granular: categories collected, sources, business and commercial purposes, categories disclosed, categories sold or shared, retention period per category, rights and at least two methods to exercise them, and treatment of sensitive personal information.
- Authority. Cal. Civ. Code §§ 1798.100, 1798.130(a)(5); 11 C.C.R. §§ 7011-7012.
- Trap. Per-category retention periods are the requirement most often omitted, and the easiest for a regulator to spot from the outside.
[ ] Add the GDPR Articles 13-14 elements if you have EU or UK users: controller identity, EU representative, legal basis with a documented legitimate-interest assessment where you rely on one, recipients, transfer mechanism, retention, and the right to lodge a complaint with a supervisory authority.
[ ] Write the notice at a level of generality that survives the next three features. "We use analytics providers to understand product usage" stays true; "We use Provider X" is false in six weeks, and a false privacy notice is a deception claim under 15 U.S.C. § 45(a) and every state UDAP statute.
[ ] Configure the consent platform for prior blocking, then verify it the way a regulator would: clean profile, click Reject, and confirm in DevTools that nothing fired.
- Authority. Directive 2002/58/EC art. 5(3); Case C-673/17, Planet49 GmbH (pre-ticked box is not consent).
- Trap. A consent platform installed in notice-only mode displays a banner while the tags load anyway. This is the most common privacy defect in shipped products.
[ ] Make "Accept All" and "Reject All" equally prominent and equally easy.
- Authority. 11 C.C.R. § 7004 (symmetry in choice). Three clicks to reject what one click accepts is the paradigm dark pattern.
[ ] Honor the Global Privacy Control signal and test it with a browser extension before launch.
- Authority. Cal. Civ. Code § 1798.135; 11 C.C.R. § 7025. The California Attorney General's 2022 Sephora resolution — $1.2 million plus injunctive terms — was substantially about failing to process GPC.
[ ] Log consent records: signal received, timestamp, jurisdiction inferred, banner version, categories accepted, and mechanism. Consent you cannot prove is not a defense.
[ ] Build the rights-request workflow, with an intake route, identity verification, a response clock, and an internal appeal path.
- Authority. Cal. Civ. Code § 1798.130(a)(2) — respond within 45 days, extendable once by another 45 with notice. GDPR art. 12(3) — one month, extendable by two further months. Several state acts require an appeal route for denied requests.
[ ] Engineer around the two product-specific traps before launch: remove advertising pixels from any page that serves video, or build a separate VPPA consent; and mask all input fields in session replay, disabling capture entirely on payment and account pages.
- Authority. 18 U.S.C. § 2710 (Video Privacy Protection Act), $2,500 per violation, with § 2710(b)(2)(B) requiring consent "distinct and separate" from any other legal or financial obligation; Cal. Penal Code §§ 631(a), 638.51 for the wiretap and pen-register theories now driving session-replay demand letters.
[ ] Decide the COPPA question on the facts, not on your terms.
- Authority. 15 U.S.C. §§ 6501-6506; 16 C.F.R. pt. 312. "Directed to children" is judged by subject matter, visual content, characters, music, and advertising. A stated minimum age of 13 in the terms is not a defense.
[ ] Execute a data processing agreement with every vendor that touches personal data, containing the Article 28(3) required contents and the CCPA service-provider restrictions.
- Authority. GDPR art. 28(3); 11 C.C.R. § 7051 — the contract must identify limited and specified business purposes, prohibit selling or sharing, prohibit retention or use outside the direct business relationship, prohibit unpermitted combination, grant you remediation rights, and require notice if the vendor can no longer comply.
[ ] Pick and document a transfer mechanism for EEA and UK data, using the correct Standard Contractual Clauses module and the UK addendum, with a transfer impact assessment in the file.
- Authority. Commission Implementing Decision (EU) 2021/914; Case C-311/18, Data Protection Commissioner v. Facebook Ireland Ltd. Choosing the wrong module is the most common execution error.
[ ] Publish a sub-processor list with an email subscription and a notice period before additions.
[ ] Record every vendor that refuses to sign anything in a written risk register with a named owner. Undocumented is the only wrong answer.
[ ] Set the access controls, confidentiality legends, and offboarding steps that constitute "reasonable measures" for the data and models copyright will not protect.
- Authority. Defend Trade Secrets Act, 18 U.S.C. §§ 1836-1839. See Trade Secrets and the DTSA and the Trade Secret Protection and Departure Checklist.

NINEBAR, Phase 4. The inventory found eleven tags; four were unknown to engineering, and one was a session-replay script left over from the prior product — the script that produced a $60,000 CIPA defense. Brindle removed it, self-hosted analytics, moved conversion tracking server-side with hashed identifiers, and cut the vendor list from eleven to five. The data map took nine days; the notice took four. That ratio is correct.

Phase 5 — DMCA and platform exposure (T-60 to T-45)

[ ] Decide whether users can post anything at all — comments, reviews, profile photos, file uploads, display names. If yes, this phase blocks launch.
[ ] Register a designated agent in the Copyright Office's DMCA Designated Agent Directory and pay the $6 fee.
- Authority. 17 U.S.C. § 512(c)(2); 37 C.F.R. § 201.38. The electronic system is the only accepted route; paper designations have not been accepted since December 2016.
- Why. Without it there is no § 512(c) safe harbor, and direct infringement is strict liability — up to $150,000 per work for willful infringement under 17 U.S.C. § 504(c)(2).
[ ] Enter the service provider's full legal name exactly as it appears on the certificate of incorporation, and file a separate designation for every related legal entity. A parent's registration does not cover a subsidiary.
[ ] Enter every alternate name the public might search: each d/b/a, product name, app name, and URL.
- Trap. If the entity is "Brindle Labs, Inc." and the product is NINEBAR, a photographer searching the directory for NINEBAR must find you. This is the field teams leave blank.
[ ] Name a role, not a person: "Copyright Agent, [Entity]," with a monitored address such as dmca@yourdomain.com, a street address (the Office does not accept a P.O. box absent approval), and a phone number that is answered.
[ ] Publish the identical agent information on the site, linked from the footer of every page and from every page that displays user content.
- Authority. § 512(c)(2) requires the information to be available through the service, not only in the federal directory.
[ ] Docket the three-year renewal twice — at thirty-three months and thirty-five months — and note that any amendment restarts the clock.
- Authority. 37 C.F.R. § 201.38(c). Ellison v. Robertson, 357 F.3d 1072, 1080 (9th Cir. 2004), cost AOL summary judgment over an agent email address that neither forwarded nor bounced.
[ ] Publish a repeat-infringer policy and inform users of it.
- Authority. 17 U.S.C. § 512(i)(1)(A) conditions every safe harbor on adopting, reasonably implementing, and informing users of a termination policy. Perfect 10, Inc. v. CCBill LLC, 488 F.3d 1102, 1109-13 (9th Cir. 2007), defines reasonable implementation.
[ ] Build the strike log — user, notice, date, outcome, termination decision — and run it.
- Trap. BMG Rights Management (US) LLC v. Cox Communications, Inc., 881 F.3d 293, 301-05 (4th Cir. 2018): a thirteen-strike policy on paper and immediate reinstatement in practice forfeited the safe harbor entirely. A policy you publish but do not execute is worse than no policy, because it proves you knew.
[ ] Write the takedown triage against the six statutory elements: signature, identification of the work, identification of the material with enough specificity to locate it, contact information, a good-faith-belief statement, and a statement under penalty of perjury of authority to act.
- Authority. 17 U.S.C. § 512(c)(3)(A). Substantial compliance is the standard, and a notice missing an element can still trigger a duty to seek the missing information.
[ ] Set an internal removal target of one business day and log every timestamp. "Expeditiously" is undefined; timestamps are the evidence.
[ ] Calendar both ends of the counter-notice window: restore the material not less than 10 nor more than 14 business days after receipt, unless the claimant first gives notice of a court action.
- Authority. 17 U.S.C. § 512(g)(2)(B)-(C). Restoring early and restoring late are both defects.
[ ] Instruct the trust team in writing to consider fair use before sending any takedown of your own.
- Authority. Lenz v. Universal Music Corp., 815 F.3d 1145, 1151-54 (9th Cir. 2016); misrepresentation liability at 17 U.S.C. § 512(f), judged subjectively under Rossi v. Motion Picture Ass'n of America Inc., 391 F.3d 1000, 1004-05 (9th Cir. 2004). See Sending and Fighting a DMCA Takedown and the DMCA Takedown Notice Checklist.
[ ] Build a separate legal@ or trust@ intake with a triage rule that routes non-copyright complaints away from the DMCA queue.
- Trap. The § 512 safe harbor is copyright-only. It does nothing for a trademark in a user-uploaded logo, a right-of-publicity claim over a photograph, defamation in a review, or patent infringement. The architecture is mapped in The DMCA Safe Harbor.
[ ] Audit your own product surfaces for the two things that cost Section 230 immunity: forms and dropdowns that materially contribute to unlawful content, and written commitments your trust team makes and does not keep.
- Authority. 47 U.S.C. § 230(c)(1); Fair Housing Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1167-68 (9th Cir. 2008) (en banc); Barnes, 570 F.3d at 1107-09.

NINEBAR, Phase 5. Registration took twenty minutes. Legal name "Brindle Labs, Inc."; alternate names NINEBAR, ninebar.com, ninebar.app, Brindle Labs, and Brindle & Co.; agent "Copyright Agent, Brindle Labs, Inc."; dmca@ninebar.com routed to two people; $6 paid 12 February 2025; renewals docketed for 12 November 2027 and 12 January 2028. A test notice sent from a personal address on launch morning was acknowledged in eleven minutes.

Phase 6 — Advertising, claims, and the subscription flow (T-30 to T-14)

[ ] Build a claims matrix: every objective claim on the site and in the app store listing, in one column, with the substantiation in hand in the next, signed off before anything runs.
- Why. Comparative claims also carry Lanham Act exposure to competitors under 15 U.S.C. § 1125(a)(1)(B); standing after Lexmark International, Inc. v. Static Control Components, Inc., 572 U.S. 118, 129-32 (2014), turns on the zone of interests and proximate cause, not direct competition.
[ ] Require material-connection disclosure in every influencer agreement — same medium, at the start of the caption or within the first three seconds of video, not buried among hashtags and not relying on platform-generated labels.
- Authority. 16 C.F.R. pt. 255 (Endorsement Guides, revised 2023). They reach employees posting about their own employer.
[ ] Ban seeded reviews, insider reviews, purchased followers, and legal threats aimed at suppressing negative reviews, and put the ban in the marketing team's written policy.
- Authority. 16 C.F.R. pt. 465 (Rule on the Use of Consumer Reviews and Testimonials, effective October 2024). It is a rule, not guidance, so violations carry civil penalties under 15 U.S.C. § 45(m)(1)(A) at a per-violation figure adjusted annually and now above $50,000.
- Trap. "Have the team leave five-star reviews" is a penalty exposure, not a growth tactic.
[ ] Place the subscription disclosure immediately above the payment fields, in body text and not in a tooltip: trial length, the exact charge date, the amount, the renewal cadence, and how to cancel.
- Authority. Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 — clear and conspicuous disclosure of all material terms before obtaining billing information, express informed consent, and a simple cancellation mechanism.
[ ] Add a separate unchecked checkbox reading "I agree to the recurring charge described above."
[ ] Cancel your own subscription on a real phone, with a stopwatch. If it takes more than two screens, routes to chat, or throws three retention offers before the cancel button, fix it now.
- Authority. The FTC's Negative Option Rule, 16 C.F.R. pt. 425, was vacated by the Eighth Circuit in July 2025 on procedural grounds. Nothing underneath changed: ROSCA is a statute, § 5 of the FTC Act is a statute, and Cal. Bus. & Prof. Code § 17600 et seq. imposes its own online-cancellation requirement with its own remedies.
[ ] Confirm every commercial email carries accurate headers, a functioning opt-out honored within ten business days, and a physical postal address.
- Authority. CAN-SPAM, 15 U.S.C. §§ 7701-7713; 16 C.F.R. pt. 316.
[ ] Verify prior express written consent for every phone number on the launch SMS list, and export the consent records before the send.
- Authority. 47 U.S.C. § 227; statutory damages of $500 per message, trebled to $1,500 for willful violations. A 40,000-message blast to a purchased or stale list is not a compliance problem; it is an extinction event.
[ ] Clear every third-party mark in comparison charts, compatibility claims, and integration pages against the nominative fair use factors, and document the analysis.
- See Descriptive and Nominative Fair Use and the Trademark Fair Use Audit Checklist.
[ ] Review the paid-search plan before the first bid, and build the monitoring and complaint routine rather than relying on the doctrine.
- See Buying a Competitor's Name and the Keyword Advertising Compliance and Enforcement Checklist.
[ ] Clear the launch video's soundtrack and any quoted, sampled, or remixed content, and put the written analysis in the file before publication.
- See the Music Clearance Checklist and the Fair Use Risk Assessment Checklist.
[ ] Reconcile the app store privacy labels with the privacy notice, line by line, before submitting the build.
- Trap. Labels that contradict the notice are a § 5 deception theory sitting in a public database.

NINEBAR, Phase 6. Nineteen claims went into the matrix; three came out ("the fastest brew log," "used by most specialty roasters," and a savings claim) for want of substantiation. The pre-billing block above the card fields read: fourteen-day trial, $9.00 per month charged 29 April 2025, cancel in Settings → Subscription in two taps, no phone call. Cancellation took eleven seconds on an iPhone SE. Six influencer agreements carried the disclosure clause.

Phase 7 — Accessibility (audit T-55, remediation through T-10)

[ ] Adopt WCAG 2.1 Level AA as the written standard and say so in the engineering definition of done.
- Why. There is still no Title III private-sector regulation, which is precisely why the operative standard is judicial: WCAG 2.1 AA is what consent decrees require and what courts order. DOJ's 2024 Title II rule adopted it for state and local government at 28 C.F.R. pt. 35.
- Authority. 42 U.S.C. § 12182(a); Robles v. Domino's Pizza, LLC, 913 F.3d 898, 905-07 (9th Cir. 2019), cert. denied, 140 S. Ct. 122 (2019) — and the absence of a regulation is not a vagueness defense.
[ ] Wire an automated scanner (axe-core, Lighthouse, WAVE, or pa11y) into CI so accessibility regressions fail the build.
- Trap. Automated tooling catches roughly a third of real issues. Anyone selling you more than that is selling an overlay.
[ ] Run a keyboard-only pass with the mouse unplugged, completing sign-up, search, the core task, checkout, and cancellation using Tab, Shift-Tab, Enter, and Space. Log focus traps, invisible focus indicators, and missing skip links.
[ ] Run a screen reader pass on the same flows: NVDA with Firefox and VoiceOver with Safari at minimum.
[ ] Test zoom and reflow at 200% and 400%, and check contrast at 4.5:1 for body text and 3:1 for large text and UI components.
[ ] Fix the big five first: low contrast, missing image alternatives, missing form labels, empty links and buttons, and missing document language. They account for the overwhelming majority of automated failures and of demand-letter allegations.
[ ] Publish an accessibility statement naming the standard, the date of the last audit, a contact method, and a response commitment — then honor it, because written commitments are enforceable promises under Barnes.
[ ] Keep a dated remediation roadmap with owners.
- Why. It is the difference between "we ignored this" and "we are executing a plan," and it is worth real money in settlement posture against roughly four thousand federal website suits a year plus a heavy California state docket where the Unruh Civil Rights Act supplies a $4,000 statutory minimum per violation, Cal. Civ. Code § 52(a).
[ ] Refuse the overlay widget.
- Trap. Overlays fail on exactly the interactive components that generate complaints, and installing one creates a compliance representation you cannot substantiate. You end up with an advertising problem on top of an accessibility problem.

NINEBAR, Phase 7. Twenty-two templates, axe-core in CI from T-52. The automated scan found 340 issues across four rule families; the manual pass found the four that mattered, all in the checkout modal — a focus trap, an unlabeled card-number field, a 2.9:1 contrast ratio on the primary button, and a cancel control reachable only by mouse. Remediation ran six engineer-days and finished at T-9. Audit cost $7,800.

Phase 8 — Security, disclosure, and the incident plan (T-21 to T-7)

[ ] Publish a vulnerability disclosure policy and a security.txt file at /.well-known/security.txt.
- Authority. RFC 9116. The policy costs an hour and converts a hostile disclosure into a managed one.
[ ] Include an authorization and safe-harbor paragraph telling good-faith researchers you will not pursue legal action and will make the authorization known if a third party does.
- Why. The Department of Justice's 2022 charging policy directs prosecutors to decline Computer Fraud and Abuse Act charges for good-faith security research, and the Librarian of Congress has repeatedly renewed a § 1201 exemption for it, 37 C.F.R. § 201.40(b). Written authorization removes the argument that the researcher exceeded it.
[ ] Write the incident runbook to hours, not to intentions: declare and open a channel at hour 0; engage outside counsel within the first hour so counsel retains forensics; preserve and image by hour 2; contain and scope by hour 6; identify obligations and notify the cyber insurer by hour 24.
[ ] Structure the forensics engagement on two tracks — an ordinary-course business investigation and a separate counsel-directed investigation for legal advice — in the engagement letters, before anything happens.
- Authority. In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), held a forensic report discoverable where the engagement looked like the pre-existing business relationship; Wengui v. Clark Hill, PLC, 338 F.R.D. 7, 10-13 (D.D.C. 2021), rejected the single-track structure.
[ ] Calendar the notification clocks inside the runbook: GDPR art. 33 requires notification to the lead supervisory authority within 72 hours of awareness where the risk threshold is met; several state statutes impose a 30-day outer limit and an attorney general notice above a resident threshold.
[ ] Implement the controls that are also the elements of the defense: encryption at rest and in transit, MFA everywhere, least privilege, and retained logs.
- Authority. Cal. Civ. Code § 1798.150 gives a private right of action for breaches of unencrypted, unredacted personal information caused by a failure to maintain reasonable security, at $100 to $750 per consumer per incident. For 200,000 users that is nine figures before anyone proves harm.
[ ] Bind cyber liability and technology errors-and-omissions coverage with a retroactive date that predates your first customer, and check the sublimits for regulatory defense and PCI assessments.
[ ] Stand up the trade secret program the same week: inventory, access tiers, confidentiality legends, and an offboarding script with a forensic hold.
- See Building a Trade Secret Program That Survives Litigation.

NINEBAR, Phase 8. The VDP went live at T-19; the first researcher email arrived at T-4 reporting an IDOR in the shared-recipe endpoint, was acknowledged in three hours, and was fixed in two days. Counsel and a forensics firm signed two-track engagement letters at T-14. Cyber and tech E&O bound at $4,200 for the year.

Phase 9 — IP filings (T-7 to T+90)

[ ] File the intent-to-use application before launch if you have not already, in every class the business actually occupies.
- Authority. 15 U.S.C. § 1051(b); on registration, § 1057(c) treats the filing date as constructive use nationwide. Base fee $350 per class as of 18 January 2025, with a $100 per-class surcharge for missing information, $200 per class for free-form wording instead of the ID Manual, and $200 per additional 1,000 characters. Verify the current schedule at filing.
- Trap. Filing Class 9 for downloadable software when you sell a Class 42 hosted service. A hosted app with a downloadable client needs both. See The Nice Classification System and the Goods and Services Identification Checklist.
[ ] Put three documents in the file proving bona fide intent before you sign the declaration: a roadmap naming the mark, a dated design or development artifact bearing it, and an internal decision memo.
- Authority. M.Z. Berger & Co. v. Swatch AG, 787 F.3d 1368, 1375-76 (Fed. Cir. 2015), affirmed refusal for want of documentary evidence of intent. Ten minutes now; dispositive in an opposition three years later. Run the Pre-Filing Trademark Application Checklist before submitting.
[ ] Capture launch-day specimens the day you ship: a screenshot of the download or purchase page showing the mark, the price or ordering mechanism, and a URL and date visible in the capture.
- Authority. 37 C.F.R. § 2.56; TMEP § 904.03(i) (webpage specimens for goods must show a means of ordering); TMEP § 1301.04 (service mark specimens must show the mark in direct association with the services); TMEP § 1215.02 (a domain name used merely as an address is not use as a mark).
- Trap. Retroactive specimens. A screenshot taken eight months later shows a redesigned page, and specimen refusals eat weeks. See Specimen Refusals: Why the USPTO Rejected Your Proof of Use.
[ ] Consider a design patent application for the distinctive interface, and file before public disclosure if you can.
- Authority. 35 U.S.C. § 171 covers ornamental designs including graphical user interfaces and animated icons; the § 102 statutory bar runs one year from first public disclosure, offer for sale, or public use, and Helsinn Healthcare S.A. v. Teva Pharmaceuticals USA, Inc., 586 U.S. 123 (2019), confirms a confidential commercial offer starts the clock. The US grace period is not available in most of the world.
- Why. Interface trade dress is product design: never inherently distinctive under Wal-Mart Stores, Inc. v. Samara Bros., 529 U.S. 205, 212-16 (2000), and vulnerable to functionality under TrafFix Devices, Inc. v. Marketing Displays, Inc., 532 U.S. 23, 32-33 (2001). See Trade Dress and the Functionality Doctrine and the Trade Dress Protection Checklist.
[ ] If the app icon animates or the brand uses a sound, decide whether to file it as a motion or sound mark, with the drawing and description the format requires.
- Authority. TMEP § 1202.13 (motion marks); TMEP § 1202.03 (ornamentation refusals for marks used decoratively). See the Non-Traditional Trademark Application Checklist.
[ ] Register copyright in the shipped source code within three months of first publication, using the trade-secret deposit options if the code contains secrets.
- Authority. 17 U.S.C. § 412 — no statutory damages or attorney's fees for infringement beginning before registration unless registration follows within three months of first publication. Deposit options at 37 C.F.R. § 202.20(c)(2)(vii): blocked-out portions, or first and last ten pages with nothing blocked, or object code with a request for special relief. Standard application $65.
[ ] Group-register the marketing site and blog: up to fifty short online literary works of 50 to 17,500 words each, by the same author, published within a three-calendar-month window, for $65 total.
- Why. It is the highest-value copyright filing most content businesses never make. The arithmetic is in What Copyright Registration Actually Buys You; the mechanics are in Registering a Copyright and the Copyright Registration Checklist.
- Trap. You cannot sue at all until the Register acts on the application. Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296, 301-03 (2019).
[ ] Register the launch photography and illustration through the group photograph options.
[ ] Record any assignment of the mark from a founder or predecessor entity to the operating company, and confirm the chain of title matches the applicant of record.

NINEBAR, Phase 9. ITU filed 14 November 2024 in Classes 9 and 42, $700 base with ID Manual wording and no surcharges. Launch-day specimens captured 15 April 2025 at 09:12 Pacific and saved to Matter 2024-114. Source code registered 3 June 2025 with the first-and-last-ten-pages deposit; twenty-eight blog posts group-registered 9 July 2025 for $65, six days inside the § 412 window. One design patent application on the brew-timer screen filed 8 April 2025, a week before disclosure.

Phase 10 — Post-launch monitoring (T+1 onward)

[ ] Put every deadline from the table below into a real docket with a named owner and two reminders, not into a calendar invite.
- See Docketing Deadlines: Never Miss a Renewal.
[ ] Start a trademark watch on the mark and its close variants so you learn about a conflicting application while the opposition window is still open.
- Authority. 37 C.F.R. § 2.102 governs extensions of time to oppose; the initial period is thirty days from publication. See Trademark Watch Services.
[ ] Record the mark in the Trademark Clearinghouse once it registers, for Sunrise access and Claims notices in new gTLDs.
[ ] Diarize the office action clock the day the application publishes to examination: three months from issuance, with one three-month extension for $125.
- Authority. 37 C.F.R. § 2.62(a). See The 3-Month Office Action Deadline, the Office Action Response Checklist, and, for a likelihood-of-confusion refusal, Responding to a §2(d) Likelihood-of-Confusion Refusal.
[ ] Track the Notice of Allowance to the Statement of Use: six months, five successive extensions, a thirty-six-month outer cap.
- Authority. 15 U.S.C. § 1051(d). See the Statement of Use Filing Checklist and From Notice of Allowance to Registration.
[ ] Re-run the script inventory quarterly and reconcile it against the privacy notice, and refresh the notice at least every twelve months.
- Authority. Cal. Civ. Code § 1798.130(a)(5).
[ ] Re-run the SBOM and license gate on every release, and keep the attribution file current.
[ ] Re-test the consent banner and the GPC signal after every marketing tooling change. The banner that worked in April fails in August because someone added a tag.
[ ] Run a quarterly review of the strike log and the takedown SLA, and confirm the DMCA agent mailbox is still monitored by two people.
[ ] Re-audit accessibility annually and after any redesign, and update the accessibility statement's audit date.
[ ] Set an escalation ladder for the first infringement you find: evidence capture, a demand letter, platform and registrar complaints, then litigation.
- See Sending an Effective Cease-and-Desist Letter, the Trademark Cease-and-Desist Letter — Template, the Pre-Litigation Enforcement Checklist, and the Online Brand Protection Toolkit.
[ ] Calendar the maintenance filings the day the registration issues: Section 8 in years five to six, Section 15 any time after five years of continuous use, and Sections 8 and 9 in years nine to ten and every ten years after.
- See Filing a Section 8 Declaration of Continued Use, Section 15 Incontestability, and the Section 8 & 9 Renewal Checklist.
[ ] Book the first-anniversary portfolio review now.
- See the Annual Trademark Portfolio Review Checklist.

NINEBAR, Phase 10. The watch service flagged a Class 42 application for NINE BAR LABS in week seven. Brindle filed a thirty-day extension of time to oppose, wrote to the applicant, and settled on an amended identification and a consent agreement for $3,200 — roughly a tenth of what an opposition would have cost.

Common Mistakes

Registering the DMCA agent under the entity name only. The photographer searches for your product name. Enter every d/b/a, app name, and URL as alternate names, and file separately for each legal entity.
Letting the DMCA designation lapse at month thirty-seven. It expires every three years, and nothing warns you. Two docket entries, at thirty-three and thirty-five months.
Publishing a repeat-infringer policy and not running it. BMG v. Cox is the fact pattern: a written policy plus a practice of reinstatement forfeited the entire safe harbor.
Terms behind a footer link. Nguyen has been the rule since 2014, and it is still the single most common defect in shipped consumer products.
No per-user assent record. You will be asked to prove which version this plaintiff accepted and on what date. Screenshots made during briefing prove nothing.
Amending terms by posting. Douglas forecloses it. Prospective changes, notice, thirty days, archived versions.
Writing the privacy policy before the script inventory. The policy then describes a product that does not exist, which is a deception claim rather than a drafting error.
A consent banner in notice-only mode. It displays choice while the tags fire on load. Test it in a clean profile and watch the network tab.
A content license mistaken for a publicity release. Putting a user's face in an ad needs specific consent, and § 230 will not help.
Clearing the word and not the logo, icon, tagline, or typeface license.
Filing Class 9 when you sell a Class 42 service — a registration that does not cover your business.
Capturing specimens after the fact. Take them on launch day, with the URL and date visible.
Missing the three-month copyright window. After it closes you keep the right to sue and lose statutory damages and fees, which is most of the leverage.
Buying an accessibility overlay. It does not fix the components that generate complaints, and it manufactures a claim you cannot substantiate.
A cancellation flow longer than the signup flow. ROSCA survived the vacatur of the click-to-cancel rule, and so did California's automatic renewal law.
Auditing open source once. The audit that counts is the one an acquirer runs against the tree on the day of diligence. Put the gate in CI.

Deadlines at a Glance

| Deadline | Authority | Clock | Consequence of missing | |---|---|---|---| | Copyright registration for statutory damages and fees | 17 U.S.C. § 412 | 3 months from first publication | Actual damages only; usually near zero | | Right to file suit at all | Fourth Estate, 586 U.S. 296 | Register must act on the application | Complaint dismissed or stayed | | DMCA counter-notice restoration | 17 U.S.C. § 512(g)(2)(B)-(C) | Not less than 10 nor more than 14 business days | Loss of the § 512(g) shield; user claim | | DMCA designated agent renewal | 37 C.F.R. § 201.38 | Every 3 years; amendment restarts it | Safe harbor lapses silently | | Design patent / patent statutory bar | 35 U.S.C. § 102(a)-(b) | 1 year from first disclosure, offer, or public use | Rights barred outright | | Office action response | 37 C.F.R. § 2.62(a) | 3 months, one 3-month extension for $125 | Abandonment | | Extension of time to oppose | 37 C.F.R. § 2.102 | 30 days from publication, extendable | Opposition window closes | | Statement of Use | 15 U.S.C. § 1051(d) | 6 months from Notice of Allowance; five extensions; 36-month cap | Application dies; priority lost | | Section 8 declaration | 15 U.S.C. § 1058 | Years 5-6, with a 6-month grace period | Cancellation | | Sections 8 and 9 renewal | 15 U.S.C. §§ 1058-1059 | Years 9-10, then every 10 years | Registration expires | | Section 15 incontestability | 15 U.S.C. § 1065 | Any time after 5 years of continuous use | Forgoes incontestability | | Privacy notice refresh | Cal. Civ. Code § 1798.130(a)(5) | Every 12 months | Statutory violation; deception exposure | | Consumer rights request response | Cal. Civ. Code § 1798.130(a)(2) | 45 days, one 45-day extension on notice | Enforcement action | | Data subject request response | GDPR art. 12(3) | 1 month, extendable by 2 further months | Supervisory authority complaint | | Breach notification, EU | GDPR art. 33 | 72 hours from awareness | Article 83 fine exposure | | Breach notification, US states | State statutes | Commonly 30 days outer limit; AG notice above thresholds | Penalties; multistate investigation | | CAN-SPAM opt-out | 15 U.S.C. § 7704(a)(4) | Honored within 10 business days | Per-message penalties | | Data Privacy Framework re-certification | DPF program rules | Annually | Removed from the list; transfers unsupported |