Questions this topic answers
- Do we need an AI use policy?
- What do we owe customers after a breach?
- Is our website legally compliant?
Articles
- Website Disclosures for Small BusinessesOriginal
-
Privacy Policy, DecodedOriginal
An interactive comparison of privacy policies across three tiers, from most to least protective of user data. Toggle between versions to see how specific language changes, and click highlighted phrases to see what they mean in privacy law.
-
Terms of Service, DecodedOriginal
An interactive walkthrough of a sample SaaS Terms of Service. Click any section to reveal the legal language, then click highlighted words and phrases to see plain-language explanations of what each term legally does.
-
EdTech and Privacy: Navigating State & Federal Laws
A plain-language walkthrough of the overlapping federal and state privacy rules that apply when schools and EdTech vendors handle student data, with practical notes on FERPA, COPPA, and the newer state student-privacy statutes.
-
Fair Use and AI Training: Two Recent Decisions Highlight the Complexity of This Issue
Whether training an AI model on copyrighted content qualifies as fair use is being decided case by case and courts are not reaching consistent answers. Skadden analyzes two recent decisions and explains what factors courts are weighing. This article is essential reading for any company building AI products.
-
COPPA 2.0: What EdTech Providers Need to Know About the FTC's Updated Children's Privacy Rule
An attorney-written summary of the FTC's 2025 update to the Children's Online Privacy Protection Rule, focused on how the changes affect EdTech providers that collect data from students under 13.
-
CISA Known Exploited Vulnerabilities Catalog
The Cybersecurity and Infrastructure Security Agency keeps a continuously updated catalog of vulnerabilities being actively exploited "in the wild." Federal agencies are required to patch these on a fixed schedule and while state and local governments are not legally bound, this list is the practical standard for what to prioritize first.
-
CCPA 2026: Navigating the Expanded Consumer Privacy Compliance Requirements for Businesses
California's privacy law added new requirements on January 1, 2026 addressing automated decision-making rules, cybersecurity audit obligations, and risk assessments. If your business has California customers, which most with an online presence do, this is a practical checklist of what changed and what you need to do.
-
2026 Is a Pivotal Year for Privacy
California and Colorado are among states leading in privacy legislation. BDO walks through California and Colorado changes, what the thresholds are, and what compliance steps businesses should be taking now.
-
Payments and Fintech Regulation: What's on the Radar for 2026
New compliance deadlines, instant payment mandates, and regulations for AI in credit scoring are all converging on fintech companies in 2026. The Paypers maps what's in effect, what's coming, and how the industry is responding so that businesses can avoid late payment charges and manage operational risk.
-
What the EU's New AI Code of Practice Means for Labeling Deepfakes
Starting August 2026, the EU AI Act requires machine-readable marking of AI-generated content and platforms must remove deepfakes within 48 hours of a valid request. This piece explains what the GPAI Code of Practice actually requires, who it applies to, and what the compliance timeline looks like.
-
The Rising Tide of ADA Website Accessibility Litigation: 2025 Insights
Over 5,000 ADA website accessibility lawsuits were filed in 2025 — concentrated in New York and California, with the same defendants repeatedly targeted. Key finding: accessibility overlay widgets have not been accepted by courts as WCAG compliance. This piece covers who is being targeted and what a real compliance program looks like versus a widget that creates only the appearance of compliance.
Tools & Resources
Privacy Policy, Decoded
Compare privacy policy language across three tiers and see what each phrase means.
Terms of Service, Decoded
Walk through a sample SaaS Terms of Service with plain-language explanations.
Laws
Laws live on their federal, state, and international pages in the Resource Library. These are the ones tagged to this topic.
Federal
Privacy & user data
Federal
Children's Online Privacy Protection Act
COPPA — 15 U.S.C. §§ 6501–6506
Prohibits unfair or deceptive practices in the online collection of personal information from children under 13. Requires parental consent before collecting, using, or disclosing a child's data. Enforced by the FTC through the COPPA Rule (16 CFR Part 312), which specifies notice, consent, security, and data retention obligations for operators of child-directed websites and services.
Federal
DOJ Bulk Sensitive Data Rule
Implements Executive Order 14117 restricting the bulk transfer of Americans' sensitive personal data to countries of concern (China, Russia, Iran, North Korea, Cuba, Venezuela). Effective April 2025. Covers genomic data, biometric data, precise geolocation, health data, financial data, and certain government-related data. Tech companies handling large-scale personal data should evaluate whether their data flows implicate these restrictions.
Federal
Electronic Communications Privacy Act
ECPA — 18 U.S.C. §§ 2510–2522
Governs how the government and private parties can access electronic communications and stored data, covering real-time interception, stored records, and metadata collection. It is the primary federal statute protecting the privacy of digital communications. Applies to any entity that intercepts, accesses, or stores electronic communications.
Federal
FTC Act Section 5
FTC Act — 15 U.S.C. § 45
Section 5 prohibits unfair or deceptive acts or practices in commerce and serves as the FTC's primary authority for regulating deceptive AI claims, unfair automated systems, and problematic data practices. It applies broadly to technology companies making representations about AI capabilities, automation, security, personalization, or algorithmic decision-making.
Federal
Fair Credit Reporting Act
FCRA — 15 U.S.C. §§ 1681–1681x
Regulates the collection, use, and sharing of consumer credit and background information. Applies to any company using background checks, credit reports, or algorithmic consumer evaluations for employment, housing, or credit decisions.
Federal
Gramm-Leach-Bliley Act
GLBA — 15 U.S.C. §§ 6801–6809
Requires financial institutions to explain their information-sharing practices and protect sensitive customer data. The Safeguards Rule mandates specific administrative, technical, and physical data security measures.
Federal
Health Information Technology for Economic and Clinical Health Act
HITECH — 42 U.S.C. §§ 17931–17954
Strengthened HIPAA enforcement and extended HIPAA obligations directly to business associates. Introduced tiered civil penalties and required HHS to conduct periodic audits of covered entities and business associates. Relevant to any tech company that is or may become a HIPAA business associate.
Federal
Health Insurance Portability and Accountability Act
HIPAA — 42 U.S.C. §§ 1320d–1320d-9
Any tech company building health apps, handling patient records, operating as a business associate of a covered entity, or processing protected health information must understand HIPAA. The Privacy Rule, Security Rule, and Breach Notification Rule each impose distinct obligations. HIPAA's definition of "covered entity" and "business associate" is broader than most tech founders assume — a SaaS platform that processes health data on behalf of a hospital is a business associate and must have a signed BAA. HHS Office for Civil Rights actively enforces, particularly against tech companies following data breaches.
Federal
Privacy Act of 1974
Privacy Act — 5 U.S.C. § 552a
Governs federal agency collection, maintenance, use, and dissemination of personal information. Applies to information the government holds about individuals — relevant to tech companies whose products interact with federal agencies or whose data may be in government systems.
Federal
Video Privacy Protection Act
VPPA — 18 U.S.C. § 2710
The VPPA restricts the disclosure of personally identifiable information relating to a consumer's video viewing history without consent. Although originally enacted for video rental records, it is increasingly invoked in litigation involving online video platforms, embedded video content, tracking pixels, analytics tools, and advertising technologies that share user viewing activity with third parties.
Cybersecurity & breach response
Federal
Computer Fraud and Abuse Act
CFAA — 18 U.S.C. § 1030
The federal anti-hacking statute. Criminalizes unauthorized access to computer systems and creates a civil cause of action companies use against former employees and competitors who misuse credentials or exceed authorized access.
Federal
Cyber Incident Reporting for Critical Infrastructure Act
CIRCIA — 6 U.S.C. §§ 681–681g
Requires critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. CISA is developing final implementing rules. Applies to entities in the 16 critical infrastructure sectors — including IT, communications, financial services, and energy. Tech companies operating critical infrastructure or providing services to those that do should monitor CISA's rulemaking.
Federal
Federal Risk and Authorization Management Program
FedRAMP — 44 U.S.C. §§ 3607–3616
A government-wide program establishing security assessment standards for cloud services used by federal agencies. Not a law but effectively mandatory if you want to sell cloud services to the federal government. Authorization is expensive and time-consuming but creates a significant competitive moat — relatively few cloud providers have full authorization. Managed by GSA. Authorization levels: Low, Moderate, High corresponding to sensitivity of data processed.
Federal
NIST Cybersecurity Framework 2.0
NIST CSF
A voluntary framework — not a law — but practically functions as a de facto compliance standard. Referenced in state breach notification laws (Tennessee), required or strongly encouraged for federal contractors, and used by courts and regulators to assess reasonableness of cybersecurity programs. CSF 2.0 released February 2024 adds a new "Govern" function to the original five (Identify, Protect, Detect, Respond, Recover). Any tech company should understand this framework before claiming to have "reasonable" security.
Artificial intelligence
Federal
Communications Decency Act Section 230
Section 230 — 47 U.S.C. § 230
Section 230 provides significant immunity to online platforms for third-party content posted by users. It is particularly relevant to AI chat systems, social platforms, marketplaces, moderation systems, and products involving user-generated or AI-assisted content, although important limitations and ongoing legal challenges exist.
NIST AI Risk Management Framework
NIST AI RMF
The NIST AI Risk Management Framework provides a widely used structure for identifying and managing AI-related risks, including bias, reliability, explainability, and governance concerns. Although voluntary, it is increasingly referenced in enterprise contracts, cybersecurity reviews, and government procurement — making it practically important for any company selling AI-powered products to larger organizations or government agencies.
View Guide
Federal
TAKE IT DOWN Act
TAKE IT DOWN Act — Pub. L. 119-10
Federal law criminalizing the nonconsensual publication of intimate deepfake images and requiring platforms to remove such content within 48 hours of a victim's request. Applies to any platform hosting user-generated content.
Website & platform compliance
Federal
ADA Title II Web Accessibility Rule
ADA Title II — 42 U.S.C. §§ 12131–12165
The U.S. Department of Justice's 2024 rule under Title II of the Americans with Disabilities Act requiring state and local governments to make their websites and mobile apps accessible to people with disabilities. It adopts WCAG 2.1 Level AA as the technical standard and sets phased compliance deadlines based on population size. It applies to public entities including state agencies, cities, counties, public colleges, and K–12 school districts — as well as to third-party EdTech and software vendors whose content or services are offered through those entities.
Federal
Americans with Disabilities Act Title III
ADA Title III — 42 U.S.C. §§ 12181–12189
Prohibits discrimination on the basis of disability by places of public accommodation. Courts are split on whether websites qualify, but plaintiffs continue to pursue website accessibility claims — the practical standard is WCAG 2.1 AA.
Federal
CAN-SPAM Act
CAN-SPAM — 15 U.S.C. §§ 7701–7713
Sets rules for commercial email and gives recipients the right to opt out. Requires honest subject lines, clear sender identification, a functional unsubscribe mechanism, and a valid physical postal address in every commercial message.
Federal
Digital Millennium Copyright Act
DMCA — 17 U.S.C. § 512
Establishes safe harbors for online service providers against liability for user-uploaded infringing content, provided they implement notice-and-takedown procedures. Critical for any platform hosting user-generated content.
Federal
Electronic and Information Technology Accessibility (Section 508)
Section 508 — 29 U.S.C. § 794d
Requires federal agencies to make their electronic and information technology accessible to people with disabilities. Directly applicable to any tech company selling to the federal government — your product must meet Section 508 standards or you cannot win federal contracts. Standards align with WCAG 2.1 AA for web content. Enforced through the Access Board and federal procurement requirements.
Federal
Freedom of Information Act
FOIA — 5 U.S.C. § 552
Gives any person the right to request access to federal agency records. Heavily used by businesses, law firms, and lawyers to obtain government data about competitors, regulatory proceedings, enforcement actions, and agency decision-making. Official portal: foia.gov.
Federal
Open Source Licensing Frameworks
OSS Licenses
Not a single law but a critical compliance area. Open source licenses create legally binding obligations when you use, modify, or distribute open source software. Key license families: Permissive (MIT, Apache 2.0, BSD — few obligations, allow proprietary use); Weak Copyleft (LGPL, MPL — share-alike requirements apply only to the licensed component); Strong Copyleft (GPL, AGPL — require distributing source code of the entire combined work). AGPL is particularly significant for SaaS companies — network use may trigger copyleft obligations even without distributing software. Every tech company needs an open source policy.
Marketing & communications
Federal
Telephone Consumer Protection Act
TCPA — 47 U.S.C. § 227
Restricts telemarketing calls, auto-dialed calls, prerecorded voice messages, and unsolicited text messages. It requires prior express consent for most automated contacts and maintains the National Do Not Call Registry. Applies to any business that contacts consumers by phone or text, making it one of the most heavily litigated consumer protection statutes in the country.
Payments
Federal
Bank Secrecy Act
BSA — 31 U.S.C. §§ 5311–5332
Requires financial institutions (broadly defined to include many fintechs and money services businesses) to keep records, file reports, and maintain customer identification programs to assist in detecting money laundering and financial crime.
Federal
Dodd-Frank Wall Street Reform and Consumer Protection Act
Dodd-Frank — 12 U.S.C. § 5301 et seq.
Sweeping financial reform law that created the Consumer Financial Protection Bureau and imposed new obligations on fintech companies, payment processors, and any business offering consumer financial products.
Federal
Electronic Fund Transfer Act
EFTA — 15 U.S.C. §§ 1693–1693r
Governs electronic fund transfers involving consumer accounts — ACH, debit cards, and digital wallets. Sets disclosure requirements, error resolution procedures, and liability limits for unauthorized transactions.
States
ArizonaCaliforniaColoradoConnecticutDelawareFloridaIllinoisIndianaIowaKentuckyMarylandMinnesotaMontanaNebraskaNew HampshireNew JerseyNew YorkOregonRhode IslandTennesseeTexasUtahVirginiaWashington
International
AustraliaBrazilCanadaCross-BorderEuropean UnionFranceGermanyIndiaIrelandIsraelItalyJapanMexicoNetherlandsNew ZealandPolandSingaporeSouth KoreaSpainSwedenUnited Arab EmiratesUnited Kingdom