In March 2026, before SQLsmith had a single customer, I ran a pre-launch audit of sqlsmith.io.
The security scan found no critical or high-severity problems, and 34 of its checks passed. It flagged five medium findings: a DMARC policy set to "none," which let anyone send mail that appeared to come from sqlsmith.io; a CORS wildcard; a content security policy that allowed inline scripts and eval; and a bare domain that resolved outside the CDN. Each was fixed with a settings change.
A security scan does not check whether signup asks for a user's age, whether the launch email carries a postal address, or whether a DMCA agent is on file with the Copyright Office. Those are legal requirements, and most of them cost under $1,000 to fix.
The Eight Item Launch Audit
A funded startup's lawyer usually reviews these eight items before launch. A weekend build skips them because nothing in the build process prompts for them.
What the App Records
Session Replay On by Default
Recording a visitor's screen, clicks, and keystrokes without consent can count as wiretapping under California's Invasion of Privacy Act. Cal. Penal Code 637.2 allows the greater of $5,000 per violation or treble damages, with no proof of actual harm needed. Section 638.51 separately bars a pen register or trap and trace device without a court order or consent.
Google Fonts Loaded From Google's Servers
A German court, LG Munchen I, 3 O 17493/20 (Jan. 20, 2022), awarded one visitor about EUR 100 after a site sent his IP address to Google without consent, under GDPR Article 82, plus an injunction. That exposure reaches an Illinois SaaS only if the app targets users in the European Union.
Signup Never Asks for Age
COPPA sets a civil penalty of up to $53,088 per violation under 16 C.F.R. 1.98(d). The FTC confirmed no inflation adjustment for 2026. The amended COPPA Rule took effect June 23, 2025, with compliance required by April 22, 2026. It requires separate parental consent before any disclosure to a third party, plus a written retention policy. The rule applies when the app is directed to children or when you actually know a user is under 13, so leaving out the age question does not by itself violate it.
What the App Sends
"We Launched" Email With No Unsubscribe Link
CAN-SPAM, 15 U.S.C. 7704(a)(3) and (a)(5), requires a working opt-out honored within 10 business days and a valid physical postal address on every commercial email. The penalty reaches up to $53,088 per email under 16 C.F.R. 1.98.
Texts or Calls With No TCPA Consent
A text message is a "call" under the Telephone Consumer Protection Act. Telemarketing by autodialer or prerecorded message needs prior express written consent under 47 C.F.R. 64.1200(f)(9). Revocation by the words "stop," "quit," "cancel," or "unsubscribe" counts automatically.
Subscription Checkout With No Renewal Terms
Illinois has its own statute here, the Automatic Contract Renewal Act, 815 ILCS 601/10. The renewal terms must appear clearly and conspicuously, in visual proximity to the consent request. You cannot charge the card until the customer consents to those terms. You must send an acknowledgment the customer can keep. A free trial of 15 days or more needs a reminder at least 3 days before the cancellation deadline. An annual plan needs a written renewal notice 30 to 60 days before that deadline. A customer who signed up online must be able to cancel online.
What Users Do on It
No Registered DMCA Agent
The safe harbor under 17 U.S.C. 512(c)(2) applies only if an agent is designated with the Copyright Office under 37 C.F.R. 201.38 and listed on the site. The fee is $6 at copyright.gov, and the designation expires after 3 years unless renewed. Without it, statutory damages for willful infringement reach up to $150,000 per copyrighted work under 17 U.S.C. 504(c)(2).
Not Usable With a Screen Reader
ADA Title III carries its own section below. AI scaffolds routinely produce div based buttons, unlabeled icons, and mouse only modals, which are exactly the barriers alleged in recent Illinois complaints.
Texts, Calls, and the TCPA
This section applies if your app texts users about anything beyond the transaction itself, such as promotions, come-back reminders, or friend invites.
The TCPA, 47 U.S.C. 227(b) and (c), sets damages at $500 per violation, $1,500 if willful. Telemarketing by autodialer or prerecorded voice needs prior express written consent under 64.1200(a)(2). Section 64.1200(d) separately requires an internal do not call list and written procedures. Any SaaS that sends marketing texts needs both the consent and the list.
The FCC tried to tighten this further in 2023, requiring one to one consent for each business named in a consent form, plus a rule that consented to calls stay logically and topically tied to how the consent was given. The Eleventh Circuit vacated that part of the order in Insurance Marketing Coalition v. FCC, decided January 24, 2025. The court held the FCC exceeded its statutory authority, because the TCPA requires only "prior express consent," not that consent plus extra conditions Congress never wrote. A single consent naming multiple businesses is lawful again. The underlying written consent requirement of 64.1200(f)(9) did not change.
Two older cases matter for an "invite your friends" feature. In Cour v. Life360 (N.D. Cal. 2016), the court held that when an app user sends the invite texts, the user made the call, not the platform. Design the invite feature so the user takes the final action that sends the text. In Van Patten v. Vertical Fitness (9th Cir. 2017), the court held that consent is scoped to the context in which the number was given. A number collected at signup does not automatically authorize an unrelated marketing campaign later. Facebook v. Duguid (2021) narrowed what equipment counts as an autodialer, but prerecorded voice calls and do not call claims survived that ruling.
Illinois adds two statutes of its own on top of the federal rule.
| Illinois statute | What it covers | No calls between |
|---|---|---|
| Telephone Solicitations Act, 815 ILCS 413 | Live operator calls | 9 p.m. and 8 a.m. |
| Automatic Telephone Dialers Act, 815 ILCS 305 | Autodialed and prerecorded calls | 9 p.m. and 9 a.m. |
Under the Telephone Solicitations Act, the caller must give a name, business, address, and purpose at the start of the call and honor a do not call request on the spot. A violation carries treble damages and Attorney General enforcement under the Consumer Fraud and Deceptive Business Practices Act.
The Automatic Telephone Dialers Act requires consent before a prerecorded message plays and a disconnect within 30 seconds after the called party hangs up. Violations carry $500 in statutory damages each, on top of treble actual damages. Both acts exempt calls to a person who asked for the call or has a prior business relationship, but the time of day and consent rules still apply to those calls.
Screen Readers and the ADA
Title III of the Americans with Disabilities Act requires places of public accommodation to serve people with disabilities. Whether a website counts as a place of public accommodation is still contested among federal courts, and Illinois has its own recent answers.
| Case | Court and date | Result |
|---|---|---|
| Walsh v. Dania Inc. | N.D. Ill., Feb. 12, 2024 | A website can be a place of public accommodation |
| Cole v. Hobby Town Unlimited | C.D. Ill., July 24, 2026 | Followed Walsh on default judgment |
| Bennett v. Sweet Candy Co. | N.D. Ill., July 2, 2026 | Tester plaintiff dismissed for standing |
| Cole v. Kingsmen Premium | N.D. Ill., July 23, 2026 | Tester plaintiff dismissed for standing |
| Henry v. Omoi | N.D. Ill., Mar. 2026 | Refused a vague consent decree |
The Third, Fifth, Sixth, and Ninth Circuits reject the Walsh view for sites with no physical location, and the Henry court questioned whether the ADA reaches websites at all. Title III does not award damages. A plaintiff can win an injunction and attorney fees, so the exposure is those fees plus the cost of fixing the site.
Apple and Google, Marked Up
An app sold through the App Store or Google Play is also bound by each platform's developer agreement, and both platforms can change those terms without a new signature from you.
"You and Your Applications... may not collect user or device data without prior user consent... Neither You nor Your Application will use any permanent, device-based identifier... for purposes of uniquely identifying a device."
You are responsible for every third-party SDK in the app as well as your own code. Section 3.3.3(A) requires a reasonably conspicuous indicator whenever the app captures video, microphone, screen, or camera recordings.
Apple's June 8, 2026 update rewrote Section 7.9 on App Store Connect information and protection of minors, which ties directly back to COPPA above. The same update clarified Section 10 on indemnification and added Section 3.3.4(A), under which you warrant you have the rights to let users change your content for accessibility, such as subtitles, larger fonts, or different colors. Attachment 14 governs apps in the European Union, effective October 1, 2026. To sell paid apps or in-app purchases, you must accept the latest Paid Applications Agreement in App Store Connect.
Section 14.1 of the Google Play Developer Distribution Agreement, effective as of September 15, 2025, requires you to indemnify Google for your use of the Play Console in violation of the agreement, for any intellectual property infringement in your app, and for any violation of law by you or your app.
Section 8 covers takedowns and appeals, Section 9 covers privacy, and Section 13 covers limitation of liability. Section 15.2 lets Google change the agreement with no sooner than 30 days notice before an existing developer is deemed to have accepted it, except for changes required by law, which apply immediately. Section 16.8 sends disputes to California law and the courts of Santa Clara County.
The Consent and Records Kit
Each feature that collects data or sends messages triggers its own document, and the obligation starts the day that feature ships.
BIPA, 740 ILCS 14/15(b), applies the moment the app uses face login, ID or selfie verification, a voiceprint, or an AI avatar feature. It requires written notice of the collection, the specific purpose, how long the data is kept, and a written release. Electronic signatures count after the August 2, 2024 amendment. Section 15(a) also requires a public retention and destruction schedule. Damages run $1,000 for a negligent violation and $5,000 for an intentional or reckless one, under 14/20, and since the 2024 amendment, repeat scans of the same person by the same method count as one violation, not one per scan.
PIPA, 815 ILCS 530, has no consent form, and this page will not call one a PIPA consent form. It requires reasonable security under 530/45(a), a clause in every vendor contract requiring that vendor's own reasonable security under 530/45(b), breach notice to affected Illinois residents in the most expedient time possible under 530/10(a), and notice to the Illinois Attorney General once a breach affects more than 500 Illinois residents under 530/10(e)(2).
The TCPA consent form needs the phone number, the autodialed or prerecorded telemarketing authorization, the statement that signing is not a condition of purchase, and the revocation keywords, as built out above.
The Illinois renewal block needs the terms beside the button, consent before the first charge, a confirmation the customer can keep, and an online way to cancel, under 815 ILCS 601/10.
Round out the kit with a CAN-SPAM compliant email footer, a DMCA agent page paired with a repeat infringer policy, and a custodian of records designation.
| Record | Retention |
|---|---|
| Renewal consent proofs | Life of the subscription, plus 3 years |
| TCPA consent records and opt-outs | 4 years. Collect a fresh consent every year |
| BIPA releases and destruction log | 7 years. A release is good for the life of the relationship |
| DMCA notices and counter notices | 3 years |
| CAN-SPAM opt-outs | 4 years |
| Breach incident file | Permanently |
| Subpoena and law enforcement log | Permanently |
Name one person as the custodian now, even if that person is you. Ill. R. Evid. 803(6) lets a business record into evidence through the custodian's testimony, or through a written certification under Ill. R. Evid. 902(11). Illinois Supreme Court Rule 236 does the same work in a civil case. The custodian is the person who signs that certification, under oath, if a record ever has to go in front of a judge.
AI Generated Code and Copyright
Code an AI tool writes from your prompt may not be yours to protect. The D.C. Circuit held in Thaler v. Perlmutter, decided March 18, 2025, that the Copyright Act requires a human author, and affirmed the denial of a copyright application that listed an AI system as the sole author. The court also held that the work made for hire provision does not change that result.
The Copyright Office's own guidance does not ban AI assisted work from copyright. It protects what a person contributed, such as your edits, your arrangement of the material, and code you wrote yourself. Material an AI tool generated from a bare prompt, with no further human creative choice, likely falls outside that protection. Keep a record of what you wrote yourself and what the tool generated. If you sell the company, the buyer's attorney will ask which code you wrote and which the tool generated.
What OpenAI and Anthropic Promise About the Code
Both companies give you whatever rights they have in what their tools generate. Neither can give you a copyright the law does not recognize, so each assignment says "if any."
"As between you and OpenAI, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output. We hereby assign to you all our right, title, and interest, if any, in and to Output."
The next paragraph adds that Output "may not be unique and other users may receive similar output." The business version, Section 4.1 of the OpenAI Services Agreement for the API and ChatGPT Business, uses the same ownership language.
"Customer (a) retains all rights to its Inputs, and (b) owns its Outputs... Subject to Customer's compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs."
The Consumer Terms that govern Claude Pro and Max, effective October 8, 2025, contain the same assignment: "we assign to you all of our right, title, and interest, if any, in Outputs."
| Plan | Who owns the output | Defense against IP claims over output |
|---|---|---|
| OpenAI API, ChatGPT Business or Enterprise | You | Yes, under the Service Terms |
| Anthropic API, Claude Team or Enterprise | You | Yes, Section K.1, paid use |
| Personal ChatGPT, Claude Pro or Max | You | Not in the ownership clause; read your plan's terms |
The defense promises carry exclusions that matter for an app. OpenAI's Service Terms exclude Output that "was modified, transformed, or used in combination with products or services not provided by or on behalf of OpenAI." Anthropic's Section K.3 excludes claims arising from "modifications made by Customer to the Services or Outputs" or "the combination of the Services or Outputs with technology or content not provided by Anthropic."
Plan around that from the first commit. Run the work on a paid business plan in the LLC's name, so the defense promise applies to whatever unmodified output you ship. Keep your prompts and your commit history, which show what the tool generated and what you changed. Register the code you wrote yourself, because that is the part the vendor's promise no longer covers and the part a buyer will pay for.
The Audit, the Fix, and the LLC
The $199 audit tells you which of the eight items apply to your app. The $1,250 fix drafts the documents, and the $750 LLC gives you an entity to sign them.
| Missed item | Law | Exposure |
|---|---|---|
| Age gate | COPPA | $53,088 per violation |
| Unsubscribe and address | CAN-SPAM | $53,088 per email |
| Texting consent | TCPA | $500 to $1,500 per text |
| Session replay consent | CIPA (California users) | $5,000 per violation |
| DMCA agent | 17 U.S.C. 512 | $150,000 per work |
| Screen reader support | ADA Title III | Plaintiff's fees plus the fix |
- One live URL, plus signup, checkout, and email flows
- The eight item audit above, run against your actual app
- Accessibility spot checks
- Apple and Google terms review, if the app ships on a phone
- A one page written findings letter and a 30 minute call
- Credited toward the Fix if purchased within 30 days
- Privacy policy and terms of service
- Renewal terms and consent block
- CAN-SPAM footer specification
- DMCA agent filing and policy page
- TCPA consent form, and BIPA release if biometrics are used
- PIPA vendor clause and breach notice skeleton
- Custodian of records sheet
- A written change list for your developer
The Fix does not include writing or changing your app's code. That list goes to your developer. I am licensed in Illinois. If you have California users, call about the CIPA exposure and I will tell you when you need California counsel.
Privacy Launch Audit. One live URL, a findings letter, a 30 minute call.
Privacy Fix. Every document in the kit, drafted and ready to post.
LLC Formation. Articles, operating agreement, EIN, registered agent.
Send me your live URL. On one call, I will tell you whether you need the full Fix or just the Audit, and whether the LLC has to come first.
Talk to an Attorney Before Your Next User Signs Up
Call, text, or book a 30 minute call. I will tell you which of the eight items on this page apply to your app.
Frequently Asked Questions
Further Reading
Sources: 16 C.F.R. 1.98; 15 U.S.C. 7704; 815 ILCS 601/10; 815 ILCS 505/10a(e); Cal. Penal Code 637.2, 638.51; 2026 Cal. SB 690; 17 U.S.C. 512, 504(c)(2); 37 C.F.R. 201.38; 47 U.S.C. 227; 47 C.F.R. 64.1200; 815 ILCS 413; 815 ILCS 305; 740 ILCS 14; 815 ILCS 530; Ill. R. Evid. 803(6), 902(11); Ill. S. Ct. R. 236; Insurance Marketing Coalition Ltd. v. FCC, 127 F.4th 303 (11th Cir. 2025); Thaler v. Perlmutter, No. 23-5233 (D.C. Cir. Mar. 18, 2025); Walsh v. Dania Inc. (N.D. Ill. Feb. 12, 2024); Cole v. Hobby Town Unlimited (C.D. Ill. July 24, 2026); Bennett v. Sweet Candy Co. (N.D. Ill. July 2, 2026); Cole v. Kingsmen Premium (N.D. Ill. July 23, 2026); Henry v. Omoi (N.D. Ill. Mar. 2026); Apple Developer Program License Agreement; Google Play Developer Distribution Agreement, effective Sept. 15, 2025; OpenAI Terms of Use, effective Jan. 1, 2026; OpenAI Services Agreement and Service Terms; Anthropic Commercial Terms of Service, effective June 17, 2025; Anthropic Consumer Terms of Service, effective Oct. 8, 2025.
Book the Pre-Launch Audit
Send me the URL and a line about what the app does. I will tell you whether you need the $750 LLC, the $199 audit, or the $1,250 fix.