CCPA audit requirements start with calendar year 2027. Here is who is in scope, when the first CalPrivacy certifications are due, why the audit report can come back to bite you, and what your customers will ask you to sign.
Most US AI rules put the disclosure duty on your customer, not on you. If you added AI features by calling a third-party foundation model, you are a service provider. Here are the three assistance duties you actually owe, the one obligation nobody can make you take on, and the mistake that flips you into controller status.
Six states now make you register as a data broker if you sell or license personal data about people who never dealt with you, and the definition is a lot wider than the reputation. California has already fined S&P Global $62,600 over an administrative error. Here is how to tell if it reaches you.
A good data retention policy makes three promises and backs each one with proof: delete on a schedule, limit who can read customer data, and let the customer verify both. Here is what goes into one that survives a security review.
Last updated: June 27, 2026 Precise geolocation data is location information that pinpoints a person within a radius of about 1,750 feet, and if your mobile app collects it, you are sitting on one of the most heavily regulated categories of personal data in the United States. Here is the
Short answer: security due diligence is the primary bottleneck in enterprise SaaS deals today. The Vendor Security Alliance standardizes the security questionnaire buyers send vendors, letting you prove your security posture once in a trusted format rather than answering a custom questionnaire for every enterprise deal. As a SaaS attorney,
Short answer: the Network Advertising Initiative (NAI) is the self-regulatory body for third-party online advertising, and its Code of Conduct matters to SaaS vendors because it treats data that identifies a device or computer, not just a named person, as regulated. If your product touches third-party ads, tracking, or persistent
App privacy comes down to three things: a clear privacy policy, just-in-time notices for sensitive data, and privacy built into the design. Here is what the FTC, states and app stores expect.
Build privacy into the product from the first design decision, with protective defaults. Where the framework came from, how the FTC uses it, and how it became law under the GDPR.
Short answer: the CarrierIQ takeaways for software vendors come down to two things. In a vendor-plus-platform stack, the party that decides what data to collect and whether to disclose it carries the privacy responsibility. And a too-broad indemnity can put the software vendor on the hook for the platform’s mistakes.
If you run a software or SaaS company, the biggest hole in your security is probably not your code. It is your people. That is the lesson of Kevin Mitnick’s book Ghost in the Wires, and it is why I think every software founder should read it. If you have
Short answer: the FTC’s Negative Option Rule is the federal standard for how you sell subscriptions, free-to-paid trials, and auto-renewals, and the core idea is simple: you cannot treat a customer’s silence as a “yes.” The headline “Click-to-Cancel” version of that rule was struck down by a federal appeals court
Three lessons from the FTC’s Google Buzz case for SaaS vendors: new sharing features default to off, no data use beyond what your policy disclosed, and one person in charge of privacy.
If Google can write a plain English privacy policy, so can you. Simplifying your policies is not dumbing them down.
City of Ontario v. Quon gives software and SaaS employers three durable lessons: a clear technology use policy, a legitimate reason for any search, and no managers rewriting the policy on the fly.
Get started with a free initial consultation. Fill out the form below to connect with our experts today!