10 more ways your app is getting sued (expensive edition)

Part 1 was paperwork. This one is code. And nobody has to notice you: accessibility firms, pixel firms and text-message firms run scanners across the internet and mail demand letters to whatever trips. Small apps get hit because they're cheap to settle.

Two differences from part 1. The items run cheapest to most expensive, and every fix below is a code change or a checkbox, not a document to write.

1. Marketing texts without opt-in

You wired a "we miss you" or "your cart is waiting" SMS into the app with no prior express written consent and no STOP handling. Verification codes are fine. Marketing is not.

$500 per text. $1,500 per text if a court decides it was willful. That's TCPA statutory damages, 47 U.S.C. 227(b)(3), and it's per message, not per user.

Fix: separate transactional from marketing SMS. An unchecked consent checkbox for marketing texts, store the timestamp and IP, handle STOP and HELP in code, and send nothing before 8am or after 9pm local time.

2. No DMCA agent registered

You built user uploads, images, posts, audio, and assumed the platform shield covers you. The safe harbor only applies if you registered a designated agent with the Copyright Office. It costs $6 and takes ten minutes.

Without it, every infringing upload is yours. $750 to $30,000 per work, up to $150,000 if willful, under 17 U.S.C. 504(c).

Fix: register the agent, publish the agent contact on a /dmca page, add a takedown route in the app, renew every three years.

3. User data stored unencrypted

PII in plain text in the database. The open Supabase table from the hacked video. This is what it costs after the breach, paid to the users, not the regulator.

$107 to $799 per California user per incident, no proof of loss required. That's the CCPA private right of action, Cal. Civ. Code 1798.150, and the plaintiffs don't have to show anyone was harmed.

Fix: RLS on, encryption at rest, MFA on your admin, and a written 72-hour notification step. "Reasonable security" is the defense. Keep receipts that you had it.

4. Chatbot with no policy guardrails

You shipped a support bot with a friendly system prompt and nothing stopping it from stating prices, refunds or policies.

Moffatt v. Air Canada, 2024 BCCRT 149. The bot invented a bereavement refund policy. Air Canada argued the chatbot was "a separate legal entity that is responsible for its own actions." The tribunal rejected that and awarded C$812.02 in damages. Small number, but it's a precedent every founder now inherits: what your bot says, you said.

Fix: the system prompt forbids stating prices, refunds, medical, legal or financial claims. Pull policies from a source of truth instead of generating them. Log every conversation. Put a visible "confirm with support" line under the chat.

5. Face ID login without consent form

Face login, voice clone, or an avatar built from a selfie, with no written consent screen. One Illinois user is enough to file.

$1,000 per negligent violation, $5,000 per intentional one, per scan, under Illinois BIPA, 740 ILCS 14/20. Meta paid $650 million. Google paid $100 million. Clearview paid $51.75 million.

Fix: a consent screen before capture that names what you collect, why, and for how long. A published retention and deletion schedule. Never sell or share templates. Can't do that? Don't ship the feature to Illinois.

6. Meta pixel before cookie banner

You pasted the pixel or GA4 tag into the layout file. It fires on every page before the consent banner does anything. Plaintiff firms record the network traffic and mail the letter.

$5,000 per visitor under California's wiretap law, CIPA, Cal. Penal Code 631 and 632. If your site has video, add $2,500 per person under the VPPA, 18 U.S.C. 2710.

Fix: consent management that actually blocks the tag until opt-in, not a banner that hides itself. No pixels on video pages or sensitive flows. Check the Network tab in a private window before every deploy.

7. No alt text on images

No alt text, no focus states, gray-on-gray text, modals you can't close with a keyboard.

Around $20,000 per lawsuit, the typical low-five-figure settlement. That's not a statute, that's the going rate. 3,117 federal website accessibility suits were filed in 2025, up 27%, with state courts on top of that.

Fix: run axe or Lighthouse accessibility, fix everything red, tab through every flow with the mouse unplugged, 4.5:1 contrast. Half a day. Do not buy an overlay. See item 10.

8. No age gate at signup

Email-and-password signup with no age question on an app kids would obviously use.

Up to $53,088 per violation under COPPA, from the FTC's civil penalty schedule at 16 CFR 1.98. Texas adds up to $10,000 per violation under the App Store Accountability Act, in force since June 4, 2026, and lets parents sue you directly.

Fix: a neutral age gate at signup. Block under-13 unless you build the full COPPA consent flow. Wire the Apple and Google age-range APIs if you ship mobile. No behavioral ads to anyone under 18.

9. Emails with no unsubscribe link

A signup form the AI wired straight into a mailing loop with no footer, no postal address, no opt-out. Or you bought a list.

Up to $53,088 per email. Same penalty schedule as item 8, applied through CAN-SPAM, and every message counts on its own.

Fix: one-click unsubscribe and a real postal address in every marketing email, honest from-name and subject, honor opt-outs within 10 business days, never send to a purchased list.

10. "AI-powered" with no proof

The landing page says your app "uses AI to detect / diagnose / guarantee" and the code is a prompt wrapper with no test result behind the claim.

$1,000,000. That's what accessiBe paid in April 2025 for claiming its AI overlay makes sites accessibility-compliant. DoNotPay paid $193,000 for the "robot lawyer" and Workado signed a consent order in the same FTC sweep.

Fix: every capability claim needs a test result you can produce. Say "assists" not "detects" unless you measured it. No accuracy percentages you can't reproduce.

Every one of these is a fifteen-minute fix. The lawsuit is not.

Paste this into Claude

Audit this codebase for: SMS sending without consent tracking, user upload features with no DMCA takedown route, unencrypted personal data at rest, analytics or pixel scripts loading before consent, missing alt text and keyboard handling, signup flows with no age gate, marketing email without an unsubscribe link, chatbot system prompts that let the model state prices, refunds or policies, and any marketing copy claiming AI capabilities. List each finding with file and line.

Sources

All verified September 3, 2026.