Website and App Launch IP Toolkit: The Pre-Ship Legal Stack

By Casey Scott McKay · 2024-03-28

This toolkit is the curated route through everything Marksy publishes on getting a website or mobile app legally ready to ship, organized as the nine workstreams a product team has to clear and the three clocks that run underneath them. It explains why a launch is not one legal project but a set of loosely coupled ones — brand and domain, ownership of the code, enforceable terms, privacy and data, hosted user content, copyright filings, advertising claims, accessibility, and the docket you leave behind — and routes each workstream to the Marksy article that explains the doctrine, the guide that sequences the work, and the checklist you run with the matter open. Every cross-reference is annotated with what the document covers, who it is for, and the point in the launch calendar when you should reach for it, and a branching reading path sorts founders, in-house counsel, outside counsel inheriting a shipped product, and platforms hosting user content into different sequences. A consolidated table of primary authorities collects the statutes, rules, and cases that decide these questions, from 17 U.S.C. § 512(c)(2) to Berman on browsewrap assent, Fourth Estate on registration timing, and Robles on accessibility. Forms, templates, and the neighboring toolkits are annotated at the end, and the recurring theme is that almost every expensive launch failure was a cheap filing or a one-day engineering task nobody owned.

IP and Technology > Internet | Toolkit | Published 28 March 2024 - Updated 27 September 2024 | Casey Scott McKay - marksy.us

Summary. This is the curated route through everything Marksy publishes on getting a website or mobile app legally ready to ship. It is organized around the nine workstreams a product team has to clear — brand and domain, ownership of the code, enforceable terms, privacy and data, hosted user content, copyright filings, advertising claims, accessibility, and the post-launch docket — and the three clocks running underneath all of them. Each workstream is routed to the Marksy article that explains the doctrine, the guide that sequences the work, and the checklist you run with the matter open, and every cross-reference is annotated with when in the calendar to reach for it. A branching reading path sorts founders, in-house counsel, outside counsel inheriting a shipped product, and platforms hosting user content into different sequences, and a consolidated authorities table collects the statutes, rules, and cases that decide these questions.

Keywords: website launch toolkit · app launch legal stack · pre-ship legal review · trademark clearance · intent-to-use application · contractor ip assignment · open source license audit · clickwrap assent · terms of service enforceability · privacy policy data map · dmca designated agent · section 512 safe harbor · repeat infringer policy · wcag accessibility audit · ftc endorsement guides · rosca subscription flow · copyright group registration · launch filing calendar · domain acquisition · section 230

Start Here

Launching software is one of the few moments in a company's life when a very small amount of legal work permanently changes what the company is worth. A six-dollar filing preserves a safe harbor worth eight figures. A one-page assignment signed before a contractor writes a line of code prevents a three-week hole in a Series A. A sentence above a button decides whether your arbitration clause exists. None of it is difficult, almost all of it is time-barred, and every item gets cheaper the earlier you do it.

This toolkit is for whoever owns that work: the founder doing it alone, the general counsel shipping a second product, the outside lawyer asked to "review the terms" two weeks before launch, and the litigator who inherits the consequences three years later. It answers three questions.

What has to be true before we ship? Not what would be nice — what creates a rights forfeiture, a strict-liability exposure, or a defense you cannot rebuild later.
In what order, and against which clock? Some of this has a statutory deadline, some has a practical deadline that arrives earlier, and some has none and therefore never gets done.
Where is the Marksy document that does each piece? Doctrine, sequencing, and a working checklist per workstream, plus the neighboring clusters — trade secrets, generative AI, fair use, keyword advertising, publicity rights — that a launch reaches into without anyone planning for it.

If you read only one thing, read the Website and App Launch Legal Checklist. Ten phases and roughly 110 actions, each a filing, a document, a configuration change, or a record you will have to produce in litigation. It carries the rule, the fee, and the trap for every phase and consolidates every deadline into one table. If you have thirty minutes instead of ten, read The Legal Layers of a Website first, because it tells you why each item is on the list — and a checklist you understand gets run, while a checklist you don't gets skimmed.

This is a launch toolkit, not a privacy program, a security program, or an enforcement plan. It points at all three, because each begins with something you did or did not do before shipping.

The Terrain: Nine Workstreams and Three Clocks

The common mistake is treating a website or app as a single legal object with a single deliverable — usually "the terms." It is a stack of loosely coupled workstreams, each answering to a different body of law, each with its own failure mode, and each capable of failing while the others are fine.

What you own. Software is a literary work under 17 U.S.C. § 102(a)(1), but protection thins fast when the dispute is about non-literal similarity rather than copied source. Your interface is product design, so it can never be inherently distinctive as trade dress and always needs secondary meaning, Wal-Mart Stores, Inc. v. Samara Bros., 529 U.S. 205, 212-16 (2000), and it still has to clear functionality under TrafFix Devices, Inc. v. Marketing Displays, Inc., 532 U.S. 23, 32-33 (2001). Your database is worth more than any of it, and copyright gives it almost nothing after Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340, 361 (1991). Software patents survive Alice Corp. v. CLS Bank International, 573 U.S. 208 (2014), only when the claim is about how the machine works; design patents under 35 U.S.C. § 171 cover graphical interfaces and animated icons and are badly underused.

Who owns it. Copyright vests in the author, 17 U.S.C. § 201(a), and contractors are authors. Software is not one of the nine enumerated work-made-for-hire categories in § 101, so a contract calling contractor code "work made for hire" without a present-tense assignment transfers nothing. Community for Creative Non-Violence v. Reid, 490 U.S. 730, 751-52 (1989), decides who is an employee; what you call them does not.

What you promise. The terms of service is the most-copied and least-tested document on the internet, and it is worthless if no contract formed — a question answered by screen design, not drafting quality.

What you collect. Roughly twenty states have comprehensive privacy statutes, the GDPR reaches extraterritorially under Article 3(2), and the fastest-growing category of website privacy litigation runs on wiretapping and video-rental statutes written decades before the web.

What you host. If users can post anything, you face strict-liability copyright claims unless you qualify for the § 512(c) safe harbor — gated by a six-dollar registration and a repeat-infringer policy you actually run. Section 230 covers a narrower set of claims than people assume.

What you say. Section 5 of the FTC Act, 15 U.S.C. § 45(a), now reaches interface design; the Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405, governs any subscription flow; and the Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. pt. 465, is a rule rather than guidance and carries civil penalties.

Whether everyone can use it. Title III of the ADA, 42 U.S.C. § 12182(a), has no private-sector web regulation behind it, which is exactly why WCAG 2.1 Level AA became the operative standard by convergence.

What is inside your build. AGPLv3 § 13 treats network interaction as triggering source disclosure, and Jacobsen v. Katzer, 535 F.3d 1373, 1380-83 (Fed. Cir. 2008), makes open source terms conditions on the scope of the license — so violating them is infringement, not breach.

What you leave behind. A permanent docket: the three-month copyright window, the three-year DMCA agent renewal, the Statement of Use ladder, the annual privacy notice refresh, and the § 8 and § 9 filings five and ten years out.

Underneath all nine run three clocks, which is why sequencing matters more than thoroughness.

| Clock | Rule | What starts it | What you lose | |---|---|---|---| | Forfeiture | 35 U.S.C. § 102(a)-(b); 17 U.S.C. § 412 | First public disclosure, offer for sale, or publication | Patent and design patent rights outright; statutory damages and fees for anything infringed before registration | | Priority | 15 U.S.C. §§ 1051(b), 1057(c) | Somebody else's filing or first use | Nationwide constructive-use priority, which an intent-to-use filing buys today for a filing fee | | Evidence | Practical, not statutory | Ship date | The ability to prove what your sign-up screen looked like, what tags were firing, and who signed what |

The evidence clock is the one that surprises people. Two years after launch, a defendant must prove that this plaintiff saw that version of the terms on that date. A screenshot taken by counsel while drafting the motion proves nothing. What wins is a versioned terms repository, a per-user assent record with timestamp and version identifier, and archived renderings of the sign-up screen — none creatable retroactively, all costing about one engineering day before launch.

For calibration: a bootstrapped launch runs roughly $7,000 to $26,000 in legal fees plus $4,000 to $60,000 in government and vendor costs, most of the latter being domains. A funded launch with outside counsel running the stack runs $65,000 to $150,000. The four-problem launch dissected in the lead article cost $526,000 in settlements and defense.

Workstream One: Brand and Domain

Two separate questions get conflated here: whether the name is protectable and whether it is available. A fanciful mark can be unavailable; a descriptive mark can be perfectly available and worth nothing.

Choosing a Strong Trademark: The Distinctiveness Spectrum is the protectability half. It is short, and it exists to stop the naming workshop from converging on something descriptive because descriptive names test well with customers. Read it at the whiteboard stage, before anyone commissions a logo, and apply its self-test: would a competitor need this word to describe their own product?

Availability is a different exercise. Trademark Clearance Searching: What a Knockout Search Can and Cannot Tell You explains why the free USPTO search you already ran is a screen, not clearance — the structural asymmetry that makes a knockout produce reliable nos and unreliable yeses, constructive notice under 15 U.S.C. § 1072, and the willfulness exposure a careless search creates against the good-faith shield a careful one creates after Romag Fasteners, Inc. v. Fossil, Inc., 590 U.S. 212 (2020). Read it before deciding how much clearance to buy.

When you decide to do it properly, Running a Full Trademark Clearance Search is the protocol: fixing the mark and the identification before any query runs, the phonetic and translation variant set, a ninety-minute knockout screen, the common-law sweep no federal database reaches, a five-axis triage rubric sorting references into fatal, negotiable, and noise, and model language for every section of the opinion letter. That is the document for whoever produces the opinion, and it includes a rush protocol. Its companion, the Trademark Clearance Search Checklist, is the twelve-phase tick-list sequenced against the six-month Paris Convention window, carrying one matter through in seventeen days for roughly $16,450 against a $400,000 rebranding exposure. Run the checklist with the matter open; read the guide once, properly, before your first one.

Then file. Intent-to-Use Applications explains why a § 1(b) filing is the highest-return move most founders make: the filing date becomes nationwide constructive-use priority on registration under 15 U.S.C. § 1057(c), which across a six-month build cycle is worth several times the fee. It also explains what the verified statement of bona fide intent commits you to, and how a padded identification voids an application the applicant otherwise deserved. Read it the week you settle on the name.

The Nice Classification System is worth twenty minutes before filing, because software companies routinely file Class 9 for downloadable software when they sell a Class 42 hosted service and end up with a registration that does not cover the product. The drafting mechanics are in Drafting an Identification of Goods and Services, with the tick-list in the Goods and Services Identification Checklist; reach for both when you are actually typing the application. Before submitting, run the Pre-Filing Trademark Application Checklist — deliberately short, and valuable because it forces you to confirm the applicant's exact legal name and calendar the deadlines.

Domains and handles are the same workstream and get treated as an afterthought. If someone has taken the .com in bad faith, Cybersquatting and the ACPA orients you to the statutory route under 15 U.S.C. § 1125(d), and UDRP vs. Federal Lawsuit explains that the two routes are not interchangeable — different remedies, different proof, wildly different cost. If you take the UDRP, Filing a UDRP Complaint to Recover a Domain and the UDRP Complaint Checklist run the proceeding. Handle this at T-165, not after the launch email, because a squatter who reads your press release prices accordingly.

Trap. Registering the domain in a founder's personal registrar account is the most common chain-of-title defect in early-stage diligence. Free to fix in month one, awkward in month thirty, particularly if that founder has left.

Workstream Two: Owning What You Built

The contractor problem — a fast, cheap, excellent developer who signed nothing but an invoice and therefore owns the front end — is the most common latent defect in early-stage technology companies. It surfaces in diligence, never before, at exactly the moment you have no leverage.

Who Owns the Work: Employees, Contractors, Joint Authors, and Work Made for Hire is the doctrine: the two exclusive routes to work-made-for-hire status, the common-law agency test from Reid, why commissioned software and logos fail the enumerated-categories route entirely, and the joint authorship problem when a co-founder who wrote no code claims to have contributed expression. Read it once and you will never again accept "we put work-for-hire language in the contractor agreement" as an answer.

The paperwork that works is in Transfers, Licenses, and Termination Rights — model employee IP clauses with the state invention-assignment statutes that constrain them, contractor assignments combining work-for-hire recitals with a present-tense assignment, the § 204(a) signed-writing mechanics, and the register-then-record sequence that makes § 205(c) constructive notice attach. Use it while drafting. Use the Copyright Ownership and Chain-of-Title Checklist while auditing what you already have, because it builds the works register from accounts payable rather than the contracts folder — the only method that finds the freelancer nobody remembers hiring.

Two adjacent problems live here. Trade secrets: your database, ranking model, and customer list are protected by everything except copyright. Trade Secrets and the DTSA covers the two statutory elements under 18 U.S.C. §§ 1836-1839 and what courts count as reasonable measures — which matters at launch because the measures must predate the misappropriation to help you. Building a Trade Secret Program That Survives Litigation is the build manual, including model language for the 18 U.S.C. § 1833(b) whistleblower notice that must appear in contractor agreements if you want exemplary damages and fees. The Trade Secret Protection and Departure Checklist is what you run the day someone with repository access resigns.

Generative AI in the build: if a contractor used a code assistant or marketing generated hero images from a prompt, ownership gets stranger. Who Owns What the Machine Made traces the human-authorship requirement through Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), and the Copyright Office's guidance, 88 Fed. Reg. 16,190 (Mar. 16, 2023); the practical consequence is that a visual identity generated entirely from prompts may be unownable, leaving a competitor free to ship something nearly identical. Deploying Generative AI Without Losing Your IP sets policy before the habit forms, and the Generative AI IP Compliance Checklist is the eleven-phase audit whose best move is capturing the human authorship record at creation rather than reconstructing it under a discovery deadline.

Open source belongs here too. The doctrine — permissive versus copyleft, the AGPL network-interaction problem, and enforcement from Jacobsen through Neo4j, Inc. v. PureThink, LLC, 58 F.4th 1055 (9th Cir. 2023) — sits inside The Legal Layers of a Website. The operational version, a software bill of materials generated at build time with copyleft flagged before it enters the tree, is Stage 5 of Launching a Website or App Without Legal Debt.

Workstream Three: Terms That Actually Bind

Every arbitration clause, class waiver, limitation of liability, content license, and anti-scraping prohibition depends on one prior question: did a contract form? That is answered by the sign-up screen, which is why a beautifully drafted terms of service loses to a mediocre one presented correctly.

The doctrine is Layer Two of The Legal Layers of a Website, which runs from Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002), through Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1178-79 (9th Cir. 2014), and Meyer v. Uber Technologies, Inc., 868 F.3d 66, 78-79 (2d Cir. 2017), to the two-part test of Berman v. Freedom Financial Network, LLC, 30 F.4th 849, 856-57 (9th Cir. 2022) — reasonably conspicuous notice plus an unambiguous manifestation of assent, with the hyperlink obviously looking like a hyperlink. It carries the table telling you what browsewrap, sign-in wrap, clickwrap, and scrollwrap are each worth. Read it before your designer finalizes the registration flow.

The construction spec is Stage 6 of Launching a Website or App Without Legal Debt, with Stage 7 walking the terms clause by clause. Phase 3 of the Website and App Launch Legal Checklist is the same work as tick-boxes, including the per-user evidence record that decides arbitration motions.

Practice tip. Unilateral-amendment clauses effective on posting are close to worthless and can make the whole agreement look illusory. Structure changes as prospective only, with email or in-product notice and re-acceptance for material changes, and preserve version history. It costs nothing at drafting time and is unrecoverable later.

Workstream Four: Privacy, Data, and the Script Nobody Told You About

This is where a small company's exposure is least proportional to its size, and the reason is arithmetic. Cal. Civ. Code § 1798.150 provides $100 to $750 per consumer per incident for breaches of unencrypted personal information caused by unreasonable security, so 200,000 users produce a nine-figure demand before anyone proves harm. The California Invasion of Privacy Act pen-register theory, Cal. Penal Code § 638.51, prices at $5,000 per violation and the Video Privacy Protection Act, 18 U.S.C. § 2710, at $2,500 — both aimed at advertising pixels and session-replay scripts a growth engineer installed without a ticket.

Marksy consolidates privacy rather than scattering it, because for a launch team it is one workstream. Layer Five of The Legal Layers of a Website maps the whole regime set — CCPA/CPRA thresholds including the 50%-of-revenue prong that catches ad-supported startups with no revenue, the state comprehensive statutes, GDPR Article 3(2) extraterritoriality, Washington's My Health My Data Act, BIPA, COPPA, and the wiretapping theories — in one table of triggers, enforcers, and exposure. Read it to learn which regimes you are actually in.

Then work in order. Stages 8 through 10 of Launching a Website or App Without Legal Debt run the sequence that matters: map the data before writing the policy, configure consent tooling that actually blocks tags rather than displaying a banner over them, honor Global Privacy Control, and paper the vendors with data processing agreements and a transfer mechanism. Phase 4 of the Website and App Launch Legal Checklist is the tick-box version and includes the script inventory: open DevTools on four pages, capture every outbound call, reconcile against the notice. The most valuable item in this workstream is free — most privacy policies are inaccurate because marketing added four tags after counsel finished, and an inaccurate policy is a § 5 deception claim waiting for a plaintiff.

Workstream Five: Hosting User Content

If users can post anything — comments, reviews, photos, avatars, a bio — you host third-party material and can be sued for infringement you did not commit, because direct copyright infringement is strict liability. The answer is 17 U.S.C. § 512(c), gated by two conditions that are both cheap and both routinely blown.

The DMCA Safe Harbor: How Section 512 Shields Platforms and Binds Rights Holders is the architecture: four harbors under § 512(a)-(d), the § 512(i) threshold conditions gating all of them, red-flag knowledge and willful blindness after Viacom International, Inc. v. YouTube, Inc., 676 F.3d 19, 31-35 (2d Cir. 2012), the right-and-ability-to-control prong, the repeat-infringer cases that have cost providers hundreds of millions, § 512(f) misrepresentation, and the narrow § 512(h) subpoena. It also carries the current posture of the Cox litigation, where the contributory-infringement standard has moved; check it before relying on a secondary-liability formulation from an older case. Read it if you are building a platform, or if you are a rights holder gauging how much leverage a notice really gives you.

The registration is trivial; the failure to make it is not. Section 512(c)(2) and 37 C.F.R. § 201.38 require designating an agent, publishing the contact information, and registering the designation electronically with the Copyright Office. Six dollars, expiring every three years. A takedown address on your contact page does not satisfy the statute, and Ellison v. Robertson, 357 F.3d 1072, 1080 (9th Cir. 2004), shows how a mail-routing change alone can defeat reasonable implementation. Stage 11 of Launching a Website or App Without Legal Debt is the registration plus the workflow behind it, and Phase 5 of the Website and App Launch Legal Checklist makes it a launch blocker for any product with user-generated content — correctly.

When notices start arriving in both directions, Sending and Fighting a DMCA Takedown is fifteen stages covering both chairs: whether a § 512 notice is the right instrument at all, fixing chain of title and authority to sign, documenting the Lenz fair use look, drafting each of the six statutory elements, then counter-notice triage, the consent-to-jurisdiction trap, and the ten-to-fourteen business day put-back window. It also covers platform mechanics for YouTube Content ID, marketplaces, code hosts, and app stores, which is where real disputes live. The DMCA Takedown Notice Checklist is the eleven-phase version for a live matter, and its Phase 11 builds the platform-side repeat-infringer program that survives discovery — implement it before you need it.

Trap. The safe harbor is copyright-only. It does nothing for a trademark in a user-uploaded logo, a right-of-publicity claim over a celebrity photo, defamation in a review, or patent infringement. Providers routinely answer trademark complaints with "file a DMCA notice," which is wrong and occasionally expensive. Section 230, 47 U.S.C. § 230(c)(1), covers much of the remainder — but not claims arising from your own promises, your own product design, or federal intellectual property. Layer Four of The Legal Layers of a Website draws those lines.

Workstream Six: The Copyright Filings Nobody Makes

The three-month window after first publication is the most valuable deadline in a content business, and nearly everyone misses it.

What Copyright Registration Actually Buys You explains the two gates: 17 U.S.C. § 411(a), which bars suit on a U.S. work until the Register acts, Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019); and § 412, which cuts off statutory damages and fees for infringement commencing before the effective date of registration, subject to the three-month grace window from first publication. Its worked example runs identical facts across five filing dates and produces a $148,000 spread. Read it once and the filing calendar stops feeling optional.

Registering a Copyright is the operational manual, and the two stages a launch team needs are the publication determination — the hardest field on the application and the one you cannot change later — and the deposit rules, including the four trade-secret alternatives for source code at 37 C.F.R. § 202.20(c)(2)(vii) that let you register without publishing your code. It also covers the thirteen group options at 37 C.F.R. § 202.4, which is how a content-heavy site registers fifty blog posts for a single $65 fee. The Copyright Registration Checklist is the eleven-phase working version, and its first phase is the triage nobody does first: has anyone already infringed, and is the work published, because those two answers decide what the filing is worth before a field gets typed.

For a launch the queue is short: the shipped application code on a Standard application with a redacted deposit; the marketing site and blog as a group registration for short online literary works; original photography through the group photograph options; and a design patent application under 35 U.S.C. § 171 if the interface is genuinely distinctive — filed before launch if possible, because the one-year grace period is a US concept and most of the world requires absolute novelty.

If someone copies the product, Proving Copyright Infringement walks originality, the § 102(b) filtration doctrines, copying in fact through access plus probative similarity, and the abstraction-filtration-comparison method that decides software cases. Read it before deciding whether your UI claim is worth bringing.

Workstream Seven: What You Say About the Product

Marketing generates more launch liability than engineering, and faster.

The regime map is in The Legal Layers of a Website under dark patterns, subscriptions, and endorsements: ROSCA's pre-billing disclosure, express informed consent, and simple-cancellation requirements; the Endorsement Guides at 16 C.F.R. pt. 255 reaching employee posts and affiliate links; the Reviews Rule at 16 C.F.R. pt. 465, which carries civil penalties; CAN-SPAM's ten-business-day opt-out; and the Telephone Consumer Protection Act, 47 U.S.C. § 227, at $500 to $1,500 per message. Stage 13 of Launching a Website or App Without Legal Debt turns that into a claims matrix and a subscription-flow test you run on a real phone.

Three neighboring clusters get pulled in by ordinary launch marketing. If the growth plan includes bidding on a competitor's brand, Buying a Competitor's Name is the doctrine — use in commerce after Rescuecom Corp. v. Google Inc., 562 F.3d 123 (2d Cir. 2009), and the collapse of initial interest confusion into an ordinary labeling-and-sophistication inquiry — and the Keyword Advertising Compliance and Enforcement Checklist is what you hand whoever runs the ad account, because the liability lives in the ad copy, not the keyword. Comparison charts, compatibility claims, and integration logos are governed by Descriptive and Nominative Fair Use, which sets out when you may use another's mark and how to do it without implying sponsorship; reach for it when the launch page says "works with" anything. Founder photos, testimonials, influencer campaigns, and any synthetic voice in a demo run into Your Face Is Not Public Domain, a state-by-state right with post-mortem variations and no federal floor, with the Name, Image, and Likeness Clearance Checklist as the release-and-license worklist to run before the launch video is edited. If that video has music, the Music Clearance Checklist exists because a sixty-second product film needs both a sync and a master license, and "we bought it from a stock site" is not a clearance.

Copying anything under a fair use theory — a competitor's screenshots, a reimplemented interface, a training corpus — should go through Running a Fair Use Analysis, with the Fair Use Risk Assessment Checklist as the documentation trail. Write the analysis down, because Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508 (2023), recentered factor one on the specific purpose of the use, and a contemporaneous memo is far better evidence of purpose than testimony three years later. Fair Use After Warhol is the doctrinal companion.

Workstream Eight: Accessibility and the Interface You Might Own

Two unrelated things happen at the same layer, and the front-end team decides both.

Accessibility is a legal standard with no private-sector regulation behind it. Robles v. Domino's Pizza, LLC, 913 F.3d 898, 905-07 (9th Cir. 2019), cert. denied, 140 S. Ct. 122 (2019), applied Title III to a website and app with a nexus to physical restaurants and rejected the argument that the absence of DOJ web rules made the duty vague. The circuits disagree about whether a nexus is required at all, and California's Unruh Civil Rights Act, Cal. Civ. Code §§ 51, 52(a), supplies a $4,000 statutory minimum per violation — which is why California generates most of the roughly four thousand website accessibility suits filed each year. The circuit table and the overlay-widget trap are in The Legal Layers of a Website; the audit sequence is Stage 12 of Launching a Website or App Without Legal Debt and Phase 7 of the Website and App Launch Legal Checklist, which sensibly puts the audit at T-55 so remediation has somewhere to go.

Ownable design. If the interface is genuinely distinctive, Trade Dress and the Functionality Doctrine explains why a trade dress theory is hard — product design always needs secondary meaning, and a layout chosen because it converts better is by definition functional — and why a design patent is usually the better answer for a screen. Read it before spending money on a "look and feel" claim, and early enough that the one-year bar under 35 U.S.C. § 102 has not run.

Workstream Nine: The Docket You Leave Behind

A launch hands off a calendar, and the failure mode is that nobody owns it. Stage 15 of Launching a Website or App Without Legal Debt contains the handoff table, and the Deadlines at a Glance table in the Website and App Launch Legal Checklist is the version to paste into a docketing system. Docketing Deadlines: Never Miss a Renewal is the short orientation to the discipline, worth handing to whoever inherits the calendar.

The trademark side has its own documents. What Happens After You File: The Examination Timeline sets expectations for the year after filing; The 3-Month Office Action Deadline explains the shortened response period that catches applicants still budgeting six months; and the Office Action Response Checklist runs the response. When the notice of allowance arrives, From Notice of Allowance to Registration walks the six-month clock and thirty-six-month outer limit under 15 U.S.C. § 1051(d), and the Statement of Use Filing Checklist handles specimens, dates, and the fork between filing, extending, deleting goods, and dividing. Software specimens fail more often than anything else, which is why Specimen Refusals belongs in the launch file — capture launch-day screenshots showing the mark in the actual purchasing interface, not a mockup.

Further out: Filing a Section 8 Declaration of Continued Use and the Section 8 & 9 Renewal Checklist for years five through ten, Section 15 Incontestability once you have five years of continuous use, the Annual Trademark Portfolio Review Checklist on the first anniversary, and Building and Managing a Trademark Portfolio when one mark becomes six.

Monitoring closes the loop. Trademark Watch Services: What to Monitor covers what a watch should catch, and the reason to buy one at launch rather than at the first problem is that you want to learn about a conflicting application while opposition is still available. When something turns up, Sending an Effective Cease-and-Desist Letter and Responding to a Cease-and-Desist Letter are the two sides of the first exchange, Trademark Infringement: Proving Likelihood of Confusion is the standard you are actually asserting, and the Pre-Litigation Enforcement Checklist is what you run before spending real money.

A Suggested Reading Path

A. Founder, pre-launch, doing this alone. (1) Choosing a Strong Trademark at the naming stage. (2) Trademark Clearance Searching to decide how much clearance to buy. (3) Intent-to-Use Applications plus the Pre-Filing Checklist, then file. (4) The Legal Layers of a Website end to end, in one sitting, before you write any policy. (5) The Website and App Launch Legal Checklist as your project plan. (6) If money runs out, the closing triage list in Launching a Website or App Without Legal Debt tells you what to cut and in what order.

B. In-house counsel, ninety days out. Start with Launching a Website or App Without Legal Debt and work backward from its launch-day go/no-go table to find what you have missed. Then run the Website and App Launch Legal Checklist with named owners per phase. Add the Copyright Ownership and Chain-of-Title Checklist if anyone outside the company built part of the product, and the Generative AI IP Compliance Checklist if any of it came from model output.

C. Outside counsel inheriting a shipped product. Triage in this order, because these are still curable: register the DMCA agent today; audit assent-screen design and the per-user record against Layer Two of The Legal Layers of a Website; check the § 412 three-month window against first publication using the Copyright Registration Checklist; pull the contributor list and paper the gaps with Transfers, Licenses, and Termination Rights; run the script inventory and conform the privacy notice.

D. Building a platform that hosts user content. The DMCA Safe Harbor first, in full. Then Phase 11 of the DMCA Takedown Notice Checklist for the repeat-infringer program and Sending and Fighting a DMCA Takedown for the workflow your trust-and-safety team will run. Then Layer Four of The Legal Layers of a Website for Section 230's real boundaries, and Your Face Is Not Public Domain for the claims neither § 512 nor § 230 touches.

Primary Authorities

| Authority | Holding or rule | |---|---| | 17 U.S.C. § 512(c)(2); 37 C.F.R. § 201.38 | The safe harbor requires an agent designated and electronically registered with the Copyright Office; $6, renewable every three years | | 17 U.S.C. § 512(i)(1)(A) | Every safe harbor is conditioned on adopting, reasonably implementing, and informing users of a repeat-infringer termination policy | | Ellison v. Robertson, 357 F.3d 1072 (9th Cir. 2004) | An abandoned designated-agent email address can defeat reasonable implementation of the notice system | | BMG Rights Mgmt. (US) LLC v. Cox Commc'ns, Inc., 881 F.3d 293 (4th Cir. 2018) | A repeat-infringer policy on paper but not in practice forfeits the safe harbor entirely | | 47 U.S.C. § 230(c)(1) | No provider is treated as the publisher or speaker of information provided by another content provider | | Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014) | A conspicuous footer hyperlink near the action button is not, without more, constructive notice of terms | | Berman v. Freedom Fin. Network, LLC, 30 F.4th 849 (9th Cir. 2022) | Enforceable online terms require reasonably conspicuous notice plus an unambiguous manifestation of assent | | 17 U.S.C. § 411(a); Fourth Estate Pub. Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019) | No suit on a U.S. work until the Register acts on the application | | 17 U.S.C. § 412 | No statutory damages or fees for infringement commenced before registration, subject to a three-month grace window from first publication | | 17 U.S.C. §§ 101, 201(b), 204(a); Cmty. for Creative Non-Violence v. Reid, 490 U.S. 730 (1989) | Contractors own their work absent a signed transfer; software is not an enumerated work-for-hire category | | 15 U.S.C. §§ 1051(b), 1057(c) | An intent-to-use filing date becomes nationwide constructive-use priority upon registration | | 15 U.S.C. § 1125(d) | The ACPA reaches bad-faith registration of a domain confusingly similar to a mark | | Wal-Mart Stores, Inc. v. Samara Bros., 529 U.S. 205 (2000); TrafFix Devices, Inc. v. Mktg. Displays, Inc., 532 U.S. 23 (2001) | Product design is never inherently distinctive, and functional features are absolutely barred from trade dress | | 35 U.S.C. §§ 102(a)-(b), 171 | Design patents cover ornamental interface designs; rights are barred one year after first disclosure, offer, or public use | | 15 U.S.C. § 45(a); 15 U.S.C. §§ 8401-8405 | Deceptive practices are prohibited, and negative-option billing requires pre-billing disclosure, express consent, and simple cancellation | | 42 U.S.C. § 12182(a); Robles v. Domino's Pizza, LLC, 913 F.3d 898 (9th Cir. 2019) | Title III reaches a website with a nexus to a physical place; the absence of a DOJ web rule is no defense | | Cal. Civ. Code § 1798.150 | A private right of action for breaches of unencrypted personal information, $100-$750 per consumer per incident | | Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008) | Open source terms are conditions on the scope of the license, so violation is copyright infringement | | 37 C.F.R. § 2.62(a); 15 U.S.C. § 1051(d) | Three months to answer an office action; six months from the notice of allowance to file a Statement of Use, capped at thirty-six |

Forms and Templates

The Marksy templates a launch actually consumes, in the order you reach for them.

Trademark Assignment Agreement — Template — moves a mark from a founder's personal name, a predecessor entity, or an acquired domain seller into the operating company. Use it at formation and again whenever diligence finds a title gap; the recordal side is the Trademark Assignment Recordal Checklist.
Trademark License Agreement — Template — for the reseller, white-label, or affiliate deal that appears two months after launch. Quality-control provisions are not boilerplate; the difference between licensing and assigning is in Assignments vs. Licenses.
Trademark Coexistence Agreement — Template — the negotiated exit when clearance finds a senior user in an adjacent field and neither side wants to litigate. Reach for it at the triage stage, not after a complaint is filed.
Response to Office Action — Template — the skeleton for the three-month deadline that arrives four to eight months after filing.
Request for Extension of Time to File a Statement of Use — Template — keeps an intent-to-use application alive when the ship date slips, which it will.
Trademark Cease-and-Desist Letter — Template — the first enforcement instrument, and the one most often sent too fast. Pair it with the guide before adapting it.
UDRP Complaint — Template — for the typosquatter who appears the week you launch.
Section 8 Declaration — Template — the year-five maintenance filing, submitted with a specimen you should have captured on launch day.
Trademark Portfolio Inventory — Template — turns one registration into a managed portfolio, and it is the artifact an acquirer asks for first.

Related Toolkits and Checklists

Trademark Clearance and Brand Selection Toolkit — the deep version of Workstream One, arranged in the order clearance work happens: distinctiveness, knockout, full search, opinion, filing. Go here when the naming decision is contested or the budget question is live.
Startup and Founder Brand Toolkit — the trademark decisions of the first twenty-four months, from the naming workshop to the Series A data room. The company-level companion to this product-level toolkit.
Online Brand Protection Toolkit — what to do once the product is live and abuse arrives on six surfaces at once; it compares the UDRP, the URS, and an ACPA action side by side.
Copyright Fundamentals Toolkit — ownership, registration, duration, and scope for the reader who needs the whole copyright picture rather than the launch slice.
Copyright Enforcement Toolkit — the escalation ladder from a takedown through a demand letter to a federal complaint, and where the Copyright Claims Board fits.
AI, Content, and IP Toolkit — training data, generated works, and the ownership gap, for any product with a model in it or a design team using one.
Trade Secret Protection Toolkit — programs, departures, and DTSA litigation, which is where your data asset actually lives.
Keyword Advertising, SEO, and Search Marketing Toolkit — the acquisition-channel companion, written for the growth team rather than the product team.
Fair Use and Permissions Toolkit — one place to clear copyright, trademark, and publicity rights in content, which is what a marketing site is made of.
Trade Dress and Product Design Toolkit — for the team that believes its interface is ownable and wants to know whether it is.
Trademark Application and Prosecution Toolkit — everything between the filing-basis decision and the certificate, including the refusals your application may draw.
IP Due Diligence Toolkit for Mergers, Financings, and Asset Sales — the exam your launch file will eventually sit for; reading it before launch tells you which records to keep.
Brand Enforcement Toolkit — watching, warning, and escalating, once the watch service starts producing hits.
The Solo and Small Firm IP Practice Toolkit — for the lawyer running launches for several clients who needs the work to be repeatable.