Legal Compliance Checklist

CAN-SPAM requires a working unsubscribe mechanism in every commercial email you send.

Fix: Add a one-click unsubscribe link to the footer of every marketing email.

A PO Box counts. A real mailing address must appear in every commercial email.

Fix: Add your PO Box or registered business address to the email footer.

Canadian law requires explicit opt-in before sending commercial emails. Pre-checked boxes don't count.

Fix: Use a clear opt-in checkbox (unchecked by default) and store the consent timestamp.

Loading Google Fonts from fonts.googleapis.com sends visitor IP addresses to Google without consent.

Fix: Use next/font, download fonts locally, or use a CDN you control.

Recording user sessions without consent is considered wiretapping in California.

Fix: Only load session replay after the user consents via a cookie banner.

GA4, Meta Pixel, and other tracking scripts need consent before loading for EU visitors.

Fix: Add a cookie consent banner. Only load tracking scripts after the user opts in.

Required by GDPR, PIPEDA, CCPA, and most app store policies.

Fix: Create a /privacy page. Link it in the footer of every page.

If you collect any personal data (emails, names), you must state a minimum age. Under-13 data is especially dangerous.

Fix: Add "You must be [age]+ to use this service" to your Terms page.

If you have user accounts, a date-of-birth or age checkbox is the minimum.

Fix: Add an age confirmation checkbox or DOB field to your signup flow.

If a subscription auto-renews, the renewal terms, price, and cancellation method must be visible at point of purchase.

Fix: Show "Renews at $X/month. Cancel anytime." directly next to the payment button.

Users must know HOW to cancel before they subscribe. "Email us" is not enough in some jurisdictions.

Fix: Provide a cancel button or clear instructions visible from account settings.

Without a registered agent ($6), you have no safe harbor if copyrighted content appears on your platform.

Fix: Register at copyright.gov/dmca-directory. $6, takes 30 minutes, lasts 3 years.

Protects you legally by establishing rules users agree to by using the site.

Fix: Create a /terms page. Link it in the footer.

If your site uses AI to generate content, multiple laws now require visible disclosure.

Fix: Add visible "AI-generated" or "AI-assisted" labels near AI content.

The EU AI Act requires machine-readable markers (meta tags, C2PA) on AI-generated content.

Fix: Add meta tags or schema.org markup indicating AI-generated content.

GDPR, PIPEDA, and CCPA all require that users can request their data be deleted.

Fix: Implement a data deletion process (even if it's manual via email for now).

Don't collect data you don't need. If you only need email, don't ask for name, phone, address.

Fix: Audit your forms — remove any fields you don't strictly need.