10 ways your app is breaking the law (2026 edition)

The sued list needed somebody to hire a lawyer. These don't. Every one of them has a regulator and a form, and three of them have a portal where a stranger can report you.

Ordered by the date the law went live, oldest first, because the newest ones are the ones your AI has never heard of. Half this list did not exist when its training data stopped.

1. Stock image with no license

You asked the AI for a landing page and it dropped in a "placeholder" hero image that is somebody's Getty or Shutterstock photo. Or you grabbed one off Google Images at 2am. Nobody has to notice you: reverse-image bots, Pixsy and Getty's own, crawl the web and mail four-figure demand letters at whatever they match.

$750 to $30,000 per image, up to $150,000 if a court calls it willful. That's 17 U.S.C. 504(c) statutory damages, and it's per image, not per site. Law: 1976.

Fix: every image in /public has a license file next to it or a link to where it came from. Unsplash, Pexels, your own camera. Delete anything you can't source. Ten minutes.

2. Cookie banner with no reject button

You installed a cookie banner component with "Accept all" as the only button, or Accept in a big button and "Manage preferences" in grey text three clicks deep. The non-essential cookies fire either way.

Up to €20,000,000 or 4% of worldwide revenue, whichever is higher. On January 6, 2022, France's CNIL fined Google €150 million and Facebook €60 million for exactly this: refusing was harder than accepting. Law: 2018.

Fix: reject is the same size and the same number of clicks as accept. Nothing non-essential loads until someone clicks accept. Test it in a private window with the Network tab open.

3. Posts with no report button

You shipped comments, posts, reviews or uploads with no way for a user to flag something as illegal, no contact point, and terms that don't say how moderation works. The DSA applies to non-EU companies the moment one EU user signs up.

Up to 6% of global turnover. Article 16 of the Digital Services Act requires a notice and action mechanism on every piece of user content, and it has been in force for everyone, not just the big platforms, since February 17, 2024.

Fix: a Report button on every piece of user content that goes to a queue you actually read, an email address on a /legal page as the point of contact, and one paragraph in the terms on what gets removed and how to appeal.

4. Health fields sent to analytics

Your app has a symptom field, a mood log, a period tracker, a "fitness goal" tag or precise location, and the analytics SDK ships every event including those. Mixpanel, the Meta pixel, GA4, PostHog. Washington's definition of consumer health data covers anything that reveals health status, including location near a clinic.

Up to $7,500 per violation from the attorney general, and My Health My Data has a private right of action, so users sue you directly for actual damages, trebled, with fees. The first class action, Maxwell v. Amazon, was filed February 10, 2025, over an SDK harvesting location inside other people's apps. Law: March 31, 2024.

Fix: an allowlist of event properties that may leave the app, so anything health-shaped is stripped before the SDK sees it. A separate consent screen before you collect a health field at all. A published consumer health data policy.

5. User posts, no risk assessment

Any service where users can post to other users, with UK users on it, and no written illegal-content risk assessment sitting in a folder. Ofcom asks for it and you have nothing to send.

Up to £18,000,000 or 10% of qualifying worldwide revenue, whichever is greater. The first Ofcom fine under the Online Safety Act landed on October 13, 2025: 4chan, £20,000 plus £100 a day for not replying. Law: March 17, 2025.

Fix: write the risk assessment. Ofcom publishes a template for small services. Keep it with your legal docs, and make sure the report button from item 3 exists so the assessment isn't fiction.

6. Countdown timer that resets

You pasted in an "Offer ends in 09:59" component that restarts on refresh, an "only 3 spots left" that is a hard-coded string, or a "12 people are viewing this" widget fed by Math.random().

Up to 10% of global turnover, imposed by the CMA directly, no court. They opened their first eight investigations under the new powers this year. The FTC treats the same thing as deceptive in the US. The UK just put a bigger number on it. Law: April 6, 2025.

Fix: every urgency number reads a real value out of the database with a real end time. Delete the ones that can't.

7. Chatbot doing therapy

The system prompt says "you are a warm, supportive therapist," the landing page says "AI therapy for $9 a month," and no licensed human is anywhere in the loop.

Up to $10,000 per violation. Illinois HB 1806 banned offering therapy or psychotherapy through AI to the public unless a licensed professional conducts it, and the ban names "individual, corporation or entity," so being one guy doesn't exempt you. Law: August 1, 2025.

Fix: the words therapy, therapist, counseling and treatment come out of the prompt and the marketing. Call it journaling or coaching and mean it. Block Illinois or put a licensed clinician in the loop. Keep the self-harm protocol from the sued list.

8. User-data pricing, no label

You built "smart pricing" or a "personalised discount" where the price someone sees depends on their history, their device or their location.

Up to $1,000 per violation, no cap, no proof of harm. New York requires the exact sentence THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA next to that price. A retail trade group challenged the law and lost. Law: November 10, 2025.

Fix: if price depends on any per-user signal, render the disclosure string beside it. Or make the price the same for everyone and key your discounts to codes instead.

9. Uploads with no 48-hour takedown

Image or video uploads, or an AI image generator, with a support email as the only way to complain.

Up to $53,088 per violation, off the same FTC penalty schedule at 16 CFR 1.98. The TAKE IT DOWN Act requires a clear notice-and-removal process for non-consensual intimate images, AI forgeries included, removal within 48 hours of a valid request, and removal of known copies. The FTC opened a public portal where anyone can report a platform that doesn't have one. Law: May 19, 2026.

Fix: a /report-image route that takes a link, a signature and a statement of non-consent, writes a ticket with a 48-hour SLA, and hashes the file so re-uploads are blocked. Half a day.

10. AI output with no AI label

A chat feature that never says it's AI. An image or voice generator whose files carry no machine-readable AI mark. A "hear it in your own voice" feature with no deepfake label.

Up to €15,000,000 or 3% of worldwide turnover, whichever is higher. Article 50 of the EU AI Act went live five weeks ago and the Digital Omnibus did not delay it. The only grace left is until December 2, 2026, for machine-readable marking on systems that were already on the market before August 2. Law: August 2, 2026.

Fix: a persistent "you're talking to an AI" line in the chat UI, C2PA or equivalent metadata on every generated file, and a visible AI-generated label on anything that shows a real person.

11. No 24-hour exploit report

The closer, and it switches on today. You ship a mobile app or a downloadable client to EU users with no security contact, no vulnerability intake, and no way of knowing you're being exploited in the first place.

Up to €15,000,000 or 2.5% of worldwide turnover. From today, manufacturers of products with digital elements get 24 hours from learning of an actively exploited vulnerability to file an early warning with ENISA, 72 hours for the full notice, 14 days for the final report. Pure SaaS is mostly outside the Cyber Resilience Act. An app in the stores is inside it. Law: September 11, 2026.

Fix: a security.txt with an address someone reads, error monitoring that pages you, dependency alerts on, and a one-page runbook that says who files the ENISA report and where the portal is.

The sued list needed a plaintiff. These have a portal, so run the audit below before a stranger runs it on you.

Paste this into Claude

Audit this codebase for: images in the repo or public folder with no license record, cookie consent components where reject is harder than accept or where non-essential scripts load before consent, user-generated content with no report or flag route, analytics or pixel calls that include health-related fields or precise location, urgency UI (countdown timers, stock counters, viewer counts) not backed by real database values, system prompts or marketing copy that describe the product as therapy or counseling, pricing logic that varies by user data with no disclosure string, image or video upload features with no notice-and-removal route and no 48-hour SLA, AI chat or generation features with no AI disclosure or content marking, and any mobile or downloadable build with no security contact or vulnerability intake. List each finding with file and line.

Sources

All verified September 9, 2026.