Policy, Compliance & Cybersecurity

Policy, compliance, and cybersecurity guidance — incident response, breach notification, security frameworks (NIST, ISO 27001, SOC 2), and the policy infrastructure that keeps companies defensible.

Founders

Data Breach Response for Startups: State Notification Timelines, FTC Enforcement, and Building an Incident Response Plan

Data breach response for startups: 50-state notification timelines, FTC Section 5 enforcement (including CEO personal liability), breach vs. incident distinctions, NIST incident response lifecycle, and cyber insurance AI exclusions.

Health Tech

When HIPAA Meets AI: A Health Tech Founder's Guide to BAAs, PHI Training, and OCR Enforcement

HIPAA doesn't just apply to hospitals. When your AI health app processes PHI on behalf of a covered entity, the BAA requirement kicks in — and OCR enforcement follows. Here's what health tech founders need to know.

Founders

ADA Website Accessibility Compliance: A Founder's Guide to the 2024 DOJ Rule and Demand Letters

Most founders assume mobile-friendly means accessible. It doesn't — and courts are enforcing WCAG 2.1 AA against DTC brands and SaaS startups with increasing frequency.

Hardware Founders

Export Controls for Hardware Startups: When EAR and ITAR Reach Your Product, Your Engineers, and Your Investors

EAR and ITAR export controls can restrict who hardware startups hire, where they ship, and what they can publish. Here is what Texas founders need to know about deemed exports, semiconductor rules, and BIS enforcement.

In-House Counsel

Board Oversight of AI and Cybersecurity Risk: What Caremark and McDonald's Mean for GCs

After McDonald's and Marchand, Delaware boards face personal liability for failing to oversee AI and cybersecurity risk. Here's how GCs should structure board-level reporting to satisfy Caremark and SEC obligations.

Founders

FTC Click-to-Cancel Rule Compliance: What DTC and SaaS Startups Must Do Now

The FTC's Click-to-Cancel Rule was vacated by the Eighth Circuit, but enforcement hasn't stopped. Here's what DTC brands and SaaS startups must do for subscription billing, free trials, and cancellation flows under ROSCA, state laws, and class action risk.

Founders

Does Your Startup Have a National Security Data Problem? The DSP Compliance Checklist Founders Are Missing

Your privacy program does not cover the DOJ Data Security Program. Since October 2025, the DSP and PADFAA restrict which vendors, investors, and engineers can access your users' data based on ties to Countries of Concern. Here is how to find your exposure.

Health Tech

Genetic Data Privacy for Health Tech: The 2026 Compliance Roadmap

GINA, GIPA, Florida's DNA Privacy Act, Illinois BIPA, Texas HB 130, and FTC enforcement — the operational compliance roadmap for health tech apps that collect, process, store, or share DNA and genetic data in 2026.

Streamers

DMCA Takedowns on Twitch and YouTube: What Streamers Need to Know

Playing copyrighted music on stream isn't fair use — and streamers are learning this the hard way. Here's how DMCA takedowns work on Twitch vs YouTube, the difference between sync and performance licenses, what strikes mean for your channel, and DMCA-safe music alternatives.

Regulatory Compliance & Legal Risk Management

Lootbox Compliance for Game Studios: What Regulators in the EU, UK, and US Actually Require

A jurisdiction-by-jurisdiction compliance roadmap for indie game studios shipping games with loot boxes, gacha mechanics, and randomized reward systems — covering Belgium ban, Dutch consumer protection rules, Germany age rating impacts, UK industry-led guidance, and US FTC enforcement.

Privacy Law

AI in EdTech: FERPA, COPPA, and State Student Privacy Laws When Your App Adds AI Features

When your EdTech app adds AI tutoring, grading, or content generation, three regulatory layers apply at once: FERPA, COPPA's updated 2026 rule, and 100+ state student privacy laws restricting profiling and automated decision-making.

Game Studios

When Players Build: UGC Legal Compliance for Game Studios

Game studios hosting user-generated content face overlapping obligations under Section 230, DMCA safe harbor, COPPA 2025 amendments, and the EU DSA. Here is the compliance framework.

Health Tech

Mental Health App Data Privacy: What Therapy and Wellness Apps Must Do Beyond HIPAA

Most wellness and therapy app founders assume HIPAA is the only privacy framework they need to worry about. It isn't. Mental health data sits under a stricter federal layer, state confidentiality statutes, and FTC enforcement actions that apply even when you're not a covered entity.

Founders

CCPA and CPRA for Consumer App Founders: What Applying to California Users Requires

Most founders assume CCPA only applies to enterprise companies. It doesn't — a consumer app with 100,000 California users is covered regardless of revenue. Here's what the thresholds, six consumer rights, and 2025 CPPA enforcement actions mean for your product.

Technology, AI, & Digital Innovation

AI Training Data and Copyright: Fair Use, Licensing, and Governance for Model Developers

Generative AI is colliding with copyright law in real time. Frontier models are trained on enormous, largely scraped corpora, while authors, artists,…

Lawyer in the Loop

Implementing AI in Law Firms: A Practical Lawyer-in-the-Loop Guide

AI is shifting from “interesting pilot” to everyday infrastructure in law firms and legal departments — intake, research, drafting, and contract review…

EdTech

FERPA Edge Cases for AI Features in K-12 Products

AI-generated risk scores, learner profiles, and behavioral analytics are education records under FERPA. Here's what EdTech founders need to know about the school official exception, directory information limits, consent workflows, and the state laws that go further.

Digital Presence & Online Policies

Who Needs to Care About the FTC’s Endorsement Guides (and Why)

The FTC's Endorsement Guides (16 C.F.R. Part 255) are the rulebook for modern word-of-mouth marketing.

AI Law

AI Startup Legal Compliance: Where Tech Law, Privacy, and IP Intersect

AI-native and data-intensive product design is now the default: LLM features ship behind a toggle, analytics run continuously, and customer data flows…

AI Law

A 90-Day TRAIGA Compliance Plan for Texas Tech Companies

TRAIGA takes effect Jan 1, 2026 with civil penalties up to $200K per violation. Section 546.103 makes substantial NIST AI RMF compliance an affirmative defense. A 90-day, four-phase workplan: Discovery, Governance, Vendor, Operationalization.

AI Law

After McDonald's: Why Chief AI Officers Are Now Personally Liable for Oversight Failures

In re McDonald's (Del. Ch. 2023) extended the Caremark oversight duty to corporate officers within their domain. With 60% of enterprises naming a CAIO, the named officer faces a personal-stakes posture that DGCL § 102(b)(7) does not cover.

AI Law

EU AI Act August 2: A Pre-Deadline Checklist for U.S. Multinationals

EU AI Act high-risk obligations apply 2 August 2026, with penalties up to 7% of worldwide turnover. Article 2(1)(c) reaches U.S. multinationals when AI output is used in the Union. A 10-item pre-deadline checklist for in-scope GCs and CAIOs.

AI Law

The TRAIGA Safe Harbor: Why the NIST AI RMF Is Now a Business Decision

TRAIGA went live January 1, 2026 with $200K-per-violation Texas AG enforcement and an affirmative defense for substantial NIST AI RMF compliance. That converts NIST adoption from a governance preference into a documented business decision.

AI Law

Tech, Privacy, and AI Law: A Product Leader's Guide

Most digital products are now data-driven by default — and increasingly AI-driven in ways that affect users in real time.

Privacy Law

Age Verification Is a Biometric Privacy Minefield: What Discord, IEEE, and Texas HB 1181 Actually Require

Age verification is four legal regimes, not one. What BIPA, Texas CUBI, Washington MHMDA, and Free Speech Coalition v. Paxton actually require of platforms verifying user age in 2026 — plus a build-or-buy matrix.