Legal Requirements for Websites and Apps: United States

US website obligations depend on the state, the business and the data. Comprehensive state privacy laws often have thresholds or exemptions, while consumer protection, children’s privacy, health-data, marketing and accessibility rules use different scope tests. Do not assume that a new or small product is outside every privacy law. Start with your actual customers, billing model, marketing and sensitive-data features. Priorities depend on those facts; there is no evidence here for a universal ranking of which lawsuit a founder will face first. This is the US chapter of our pre-launch legal checklist — run that prompt sequence first, then apply what's here.

Key takeaways

• Assess each state’s scope, thresholds and exemptions; do not rely on a generic user count.
• COPPA, health-data, biometric and marketing rules have their own triggers.
• Accessibility has public and private enforcement; an automated scan is not certification.
• The FTC’s 2024 negative-option rule was vacated; existing subscription laws still matter.
• Check current court and app-store developments before implementing state age signals.
• Tax, payment security, copyright and affiliate disclosures need separate checks.

Who the state privacy laws actually reach

Do not use a generic 100,000-user threshold. California has alternative revenue, volume and sale/sharing tests; other states use different criteria. Texas generally exempts SBA-defined small businesses but retains a sensitive-data-sale consent duty. Check the current law for each state you serve.

If covered, assess notices, rights requests, targeted-advertising and sale/sharing choices, universal opt-out signals and risk assessments. See the Texas Attorney General’s scope explanation.

The rules with no size threshold

Children. Assess COPPA’s child-directed and actual-knowledge tests, exceptions and parental-consent requirements. Do not collect additional age or identity data merely because a template suggests it.

Truthful claims. FTC Act Section 5 addresses unfair and deceptive practices. Privacy promises, product capabilities and customer testimonials must reflect reality. Paid recommendations need appropriate disclosure.

Recurring billing. ROSCA requires clear material terms, informed consent and a simple cancellation mechanism for covered online negative-option sales. Check applicable state renewal requirements too. The FTC rule page distinguishes the rulemaking from existing duties.

Email and texts. Commercial email and automated marketing calls/texts have different rules. Configure accurate sender information, required contact details, consent where required and working opt-outs. A permission to email is not automatically permission to send marketing texts.

Accessibility. The DOJ treats web access as part of covered public accommodations’ services. Legal scope and remedies depend on context. Combine automated checks with keyboard and assistive-technology testing; see DOJ guidance.

Sensitive data. Illinois biometric requirements and Washington consumer health-data rules can reach activities outside ordinary account data. Washington distinguishes collection/sharing consent from a separate authorization for sale. Check the Washington Attorney General’s guidance before adding health inferences or integrations.

Children, teens and app stores

COPPA focuses on child-directed services and operators with actual knowledge of under-13 collection, subject to its exceptions. A neutral age screen is not a universal safe harbour for a child-directed product. The FTC’s amended rule has an April 2026 compliance milestone; use its current guidance for parental consent, disclosure and retention requirements.

Mobile-store age rules have changing court orders and platform rollouts. Do not treat the original Texas, Utah or Louisiana effective dates as sufficient implementation evidence. Verify the relevant state and current store requirements for your release. See FTC’s COPPA guidance.

If you take money

Sales tax. After Wayfair, states can require out-of-state sellers to collect sales tax once they cross an economic nexus threshold — most commonly $100,000 in sales into that state in a year, with some states also counting transaction numbers. Whether SaaS and digital products are taxable varies by state. This is an accountant question, not a lawyer question, and it's worth asking before you have a problem, not after.

Payments. Use a processor (Stripe, Paddle, Lemon Squeezy or similar) and never touch raw card numbers — that keeps you out of the heaviest PCI DSS obligations. A merchant of record like Paddle also takes on sales tax collection, which is often the right trade for a solo builder.

If users post content

Two things worth doing on day one for any site with user-generated content:

• Register a DMCA agent with the US Copyright Office (a small fee, renewable every three years) and publish the agent's details on your site. Without registration you lose safe-harbour protection from copyright claims over what your users upload.
• Publish clear content rules and a takedown process, and actually follow them. Section 230 still protects platforms from liability for user content in most cases, but your own moderation promises are enforceable against you under Section 5.

The US-specific prompt

Run this after the ten prompts in the main checklist:

Add United States compliance mechanics to this app. Implement each item and report what changed:

1. A "Your Privacy Choices" (or "Do Not Sell or Share My Personal Information") link in the footer of every page, leading to a page where a user can opt out of targeted advertising and of any sale or sharing of their data.
2. Detect the Global Privacy Control browser signal and treat it automatically as an opt-out for that user, without requiring any further action.
3. A privacy request form covering access, correction, deletion and portability, with an internal log recording each request's date, state of residence and outcome.
4. A US state rights section in the privacy policy, written as a general statement of rights rather than naming specific states — leave [[STATE-SPECIFIC DISCLOSURES]] as a placeholder for me to complete.
5. Inventory the intended audience and any age or parental-consent mechanisms. Implement the age flow I have selected after a COPPA scope assessment. Do not treat blocking a self-declared under-13 account as proof a child-directed service is compliant, or collect full birthdates without a need.
6. If we send marketing email: an unsubscribe link in every message, a postal address in the footer, and an unsubscribe that takes effect immediately without requiring login.
7. If we charge a recurring fee: the renewal date and amount shown before purchase and in account settings, plus a cancellation that completes in two clicks with no retention interstitial.

For each item, tell me PASS or explain what blocked it. Do not invent state law citations in any user-facing text.
Copy prompt

Pre-launch checklist — US

• Privacy policy matches an actual data inventory, with a "Your Privacy Choices" link if you do any ad targeting
• Global Privacy Control signal honoured
• Age screening in place; no data collected from under-13s without verifiable parental consent
• Accessibility audited against WCAG 2.1 AA and critical issues fixed
• Subscription terms disclosed before billing; cancellation in two clicks
• Email has unsubscribe plus postal address; no marketing SMS without written consent
• No biometric feature without written notice and consent
• Sales tax thresholds checked with an accountant for the states you sell into
• DMCA agent registered if users can upload content
• Database rules verified so no user can read another user's records

What the build checks establish

Two-click cancellation and consent-first defaults are design choices. Verify legal scope separately and test authorization, rights requests and billing with real test flows. A builder’s PASS does not certify compliance.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• FTC COPPA guidance
• FTC negative-option rule status
• DOJ web accessibility
• Washington health-data guidance

The US isn't one rulebook — it's a map. Start with the pre-launch checklist, run the US prompt above, then compare with the European Union, the United Kingdom, Canada, Australia, Brazil and Israel if you sell there. You can build this.