You commented LEGAL. Here's the full checklist from the reel: 34 things to sort before your AI-built app goes live, in plain English.
It's written for builders selling anywhere: the US, the UK, the EU and beyond. Each section opens with the laws that apply where, then the items. Most of the 34 hold everywhere. Where the rules differ, the item says how.
Work through it once before launch, then again after any big change. At the end there's a prompt you can paste into Claude Code to check your codebase against it.
1. Privacy & consent
US: no single federal privacy law. California's CCPA and about 20 other state laws apply as you grow, and marketing email falls under CAN-SPAM. UK & EU: GDPR plus the cookie rules (PECR in the UK, the ePrivacy Directive in the EU). Elsewhere: Canada (PIPEDA, CASL), Australia (Privacy Act, Spam Act), Brazil (LGPD) and others follow a similar pattern.
Write a privacy notice in plain English. GDPR requires one, and so does California for any site that collects personal data from Californians. Say what you collect, why, who you share it with and how long you keep it.
Write your terms. They set out what you promise and what users agree to. Without them you're relying on defaults, in every country.
Only set non-essential cookies after people say yes. In the UK and EU, analytics and ad cookies need consent before they load. The US is mostly opt-out: California expects a "Do Not Sell or Share" link and requires you to honour Global Privacy Control signals. Building opt-in once covers both.
Make the reject-all button as prominent as accept. UK and EU regulators don't treat a buried reject link as a real choice, and California's rules say consent won through dark patterns isn't consent.
Put an unsubscribe link in every marketing email. Required in the US (CAN-SPAM, with opt-outs honoured within 10 business days), the UK, the EU and Canada.
Keep marketing consent as its own tick box, unticked. The UK, EU and Canada need opt-in consent for most marketing email. The US allows opt-out email, but marketing texts need prior written consent under the TCPA. A separate unticked box works everywhere.
Save a timestamp of who agreed to what. GDPR says you must be able to prove consent. In the US, consent records are your main defence against TCPA claims. Store when, how and which wording.
2. Your users' data
The same laws, the user-rights side. US: CCPA and the other state laws. UK & EU: GDPR (ICO, European Commission).
Only ask for the data you actually use. Data minimisation is a core GDPR principle, and California's law has the same rule. Every extra field is extra risk.
Decide how long you keep data, then delete it on schedule. GDPR rules out keeping data "just in case", and California wants your retention periods in your privacy notice. Pick a period and automate it.
Let users download their data. It's the right of access in the UK and EU and the right to know in California and most other state laws. A button beats answering requests by hand.
Let them delete their account from settings. The right to erasure (GDPR) and the right to delete (US state laws). Build a real delete, not a hidden flag.
Sign a data processing agreement with every supplier that handles user data. Hosting, email, analytics and payments providers are processors. GDPR requires a written contract with each, and California requires contracts with service providers too.
List those suppliers on a public page. Your privacy notice should say who receives personal data. A sub-processor page is the tidy way to do it.
Check what every analytics script sends home. Tracking pixels are behind a wave of US class actions under wiretap and video-privacy laws, and EU regulators have ruled some Google Analytics setups unlawful. Read the docs and watch the network tab.
3. AI
US: the FTC treats misleading AI claims and quiet data grabs as deceptive, and several states (California, Colorado, Utah) have AI-specific laws. Children: COPPA. EU: the AI Act adds transparency duties on top of GDPR. UK: UK GDPR (ICO guidance).
Don't train AI on user data without asking. The FTC has warned that quietly changing your terms to train on user data can be deceptive, and GDPR needs a lawful basis for any new purpose. Check your AI provider's default settings too.
Tell people when something was made by AI. The EU AI Act requires telling people when they're talking to a chatbot and labelling AI-generated content. California and Utah require disclosure in some situations. Everywhere else it protects trust.
If under-13s can sign up, get a parent's permission first. In the US, COPPA requires verifiable parental consent before collecting data from children under 13. In the UK the age is 13, and in the EU it's 13 to 16 depending on the country. The simplest fix is to set a minimum age and enforce it.
4. Accessibility
US: the ADA. Courts apply it to websites, and thousands of accessibility lawsuits are filed every year. EU: the European Accessibility Act, in force since June 2025. UK: the Equality Act 2010. All three point at WCAG AA as the yardstick.
Make the text readable, with enough contrast. WCAG AA asks for a 4.5:1 contrast ratio for normal text.
Describe every image for screen readers. Add alt text to meaningful images. Mark decorative ones so they're skipped.
Make sure everything works with just a keyboard. If you can't tab to it and press enter, some users can't use it at all, and missing keyboard access is one of the most common points in US demand letters.
5. Pricing & subscriptions
US: the FTC Act, the federal online-subscription law (ROSCA) and state auto-renewal laws, with California's the strictest. UK: the Consumer Contracts Regulations and the DMCC Act 2024. EU: the Consumer Rights Directive (Your Europe guide).
Show the full price up front, with no surprise fees at checkout. The UK's DMCC Act targets drip pricing, California bans hidden mandatory fees for most goods and services, and the FTC has its own fee rules for some industries.
Say clearly when a subscription renews and at what price. ROSCA and California's auto-renewal law require clear terms and express consent before you bill. State the date and amount before the user pays, not in the small print.
Make cancelling as easy as signing up. California requires that anyone who signed up online can cancel online, and the UK and EU are moving the same way. If signing up takes two clicks, don't make cancelling a phone call.
Write a refund policy, and know your cooling-off rules. The UK and EU give consumers 14 days to cancel most online purchases, with specific rules for digital content. The US has no general cooling-off right for online sales, but whatever refund policy you publish, you have to honour. Get the wording checked for your main markets.
6. Honest marketing
US: the FTC requires proof for claims, and its reviews rule (in force since October 2024) carries civil penalties. UK: the CMA under the DMCC Act. EU: the Unfair Commercial Practices Directive.
Kill any countdown timer that secretly resets. A fake deadline is a misleading practice in all three.
Bin any review you didn't earn. The FTC rule and the UK's DMCC Act both ban fake reviews and buying reviews. Incentivised ones need clear disclosure.
Only make claims you can prove. "Fastest", "most secure", "trusted by thousands": the FTC expects the evidence before the claim goes live. Keep it on file.
Don't call yourself SOC 2 certified unless you are. A false compliance badge is a deceptive claim, and it can sink an enterprise deal the moment procurement checks.
Don't promise uptime you can't hit. If you write 99.99%, you need the infrastructure and monitoring to back it up.
Ask before showing a customer's logo. Using someone's logo or name implies endorsement. Get permission in writing.
7. Licences & business details
US: no general website disclosure rule, but CAN-SPAM requires a valid postal address in every marketing email. UK: Companies Act disclosures (GOV.UK). EU: the e-Commerce Directive requires your name, address and registration details on the site (Germany's "Impressum").
Check the licence on every font, image and package. AI-written code pulls in dependencies without telling you. Run a licence scan and check fonts and stock images. Copyright applies everywhere.
Show the company name, number and registered address. UK and EU companies have to show these on the website. In the US, use your legal entity name in your terms and put a postal address in every marketing email.
Give people a real way to reach you. A working email address or contact form that a person reads. It's the first thing a user or regulator looks for.
And whatever you do, don't make anything up. Not your policies, not your stats, not your certifications. If it isn't true yet, don't say it.
The Claude prompt
Paste this into Claude Code from the root of your project. Fill in where your users are first.
You are helping me prepare my app for launch. My users are in: [list countries, and US states if you know them]. Audit THIS codebase and product against the checklist below, with the rules for those markets in mind. For each of the 34 items, tell me: what exists today (with file paths), what is missing or weak, and the smallest change that would close the gap. Do not give legal conclusions or say whether something is compliant. Only report what the code and content show. If you can't tell from the code, list it as "needs a human check".
Privacy & consent: privacy notice; terms; cookies only after consent (and a Do Not Sell or Share link plus Global Privacy Control support if I have California users); reject-all as prominent as accept; unsubscribe link in marketing emails; separate unticked marketing consent (and written consent for marketing texts); consent timestamps.
Users' data: only collect data we use; retention period and scheduled deletion; data export; account deletion from settings; data processing agreements with suppliers; public supplier list; what each analytics script and pixel sends.
AI: no training on user data without consent; AI-generated content and chatbots labelled; parental consent if under-13s (or under the local age) can sign up.
Accessibility: text contrast; alt text on images; full keyboard use.
Pricing & subscriptions: full price up front; renewal date and price stated before payment; cancelling as easy as signing up; refund policy and cooling-off rules for my markets.
Honest marketing: fake or resetting countdown timers; reviews we didn't earn; unprovable claims; any SOC 2 claim; uptime promises; customer logos used without permission.
Licences & business details: licences on fonts, images and packages; company name, registration number and address (postal address in US marketing emails); a real contact route; anything on the site that is made up.
Finish with a prioritised list of gaps, most serious first.It lists gaps. It does not tell you what the law requires of you. That part needs a person.
Not legal advice. Get a lawyer in your main market to review before launch.
Mike
PS. If you run a local business and want customers coming to you instead of the other way round, that's what we do at OptiMAX.