Technology Insights

Analysis and practical guides on technology.

90 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice — for a specific matter, contact the firm.

TechnologyPrivacy

Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech

A wave of litigation has repurposed statutes written for telephone wiretapping and video rental records to attack the ordinary instrumentation of commercial websites. This article explains how that happened: what a pixel actually does, why plaintiffs frame data collection as interception of communications, and how the party exception and its two-party-consent variations decide most cases. It covers the Video Privacy Protection Act's revival and the disclosure element that determines outcomes, the special treatment of health and financial contexts, and the statutory damages arithmetic that makes these cases valuable regardless of harm. It closes with what actually reduces exposure, which is tag governance rather than policy language.

Casey Scott McKayFebruary 25, 202628 min read

TechnologyPlatform Law

Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses

This toolkit collects the operating documents a content platform needs, from the terms of service provisions that determine whether the platform creates its own liability through the copyright infrastructure the Section 230 intellectual property carve-out makes mandatory. It includes notice and counter-notice procedures, a repeat infringer policy with the tracking that makes it real, moderation decision logging, a subpoena response protocol, a transparency report structure, a design review form addressing the product-defect claims, and a Section 230 motion outline. Each template is annotated with its purpose, its owner, and the failure it prevents. Each template carries drafting notes on how the provision performs in a motion to dismiss. Adapt everything to the service, the user base, and the content types involved.

Casey Scott McKayFebruary 24, 202612 min read

TechnologyPlatform Law

Platform Content Moderation Checklist: A Practical Checklist

Platform liability almost always traces to the platform's own conduct rather than to user content, and this checklist is organized around that fact. It covers the terms that must match the process actually run, the copyright infrastructure the Section 230 intellectual property carve-out makes mandatory, notice-and-action workflows for every other complaint category, subpoena handling, transparency instrumentation, and the product design review that addresses the defect claims now driving platform litigation. Separate sections cover the hard complaint categories, minors, marketplaces, the annual review, and the diligence package an acquirer will request. It separates the policy layer, the operational layer, and the evidence layer. Every item is written so that a "no" tells you what to do next.

Casey Scott McKayFebruary 23, 20267 min read

TechnologyPlatform Law

Running a Platform That Hosts User Content: A Practical Guide

Running a platform that hosts user content is an operational discipline with a legal layer, and most platform liability comes from the platform's own conduct rather than from anything a user posted. This guide covers what to build: terms that match the process actually run, a moderation policy that scales, the copyright infrastructure the intellectual property carve-out requires, notice-and-action mechanisms for other categories, a subpoena response process, transparency data, and the design review that addresses the product-defect claims now driving platform litigation. It includes a build sequence for a new platform, a remediation sequence for an existing one, and the errors that reliably create exposure. A worked scenario follows a takedown demand from intake through resolution and litigation posture. It also covers what the terms of service must say for the defenses to work.

Casey Scott McKayFebruary 22, 202627 min read

TechnologyPlatform Law

Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops

Section 230 is the most consequential and most misdescribed statute in American technology law. This article explains what it actually provides: two distinct immunities, one for hosting third-party content and one for good-faith moderation, along with four express exceptions that are doing increasing work. It covers the elements courts apply, the material contribution test that determines when a platform becomes a content provider itself, and the product design theories plaintiffs use to plead around the statute. It addresses the Supreme Court's recent decisions, what they decided and what they conspicuously did not, and the First Amendment framework that constrains state regulation of moderation. It closes with practical guidance for platforms that want the protection to hold.

Casey Scott McKayFebruary 21, 202628 min read

TechnologyArtificial Intelligence

AI Licensing Toolkit: Data Provenance Records, License Terms, and Indemnity Clauses

This toolkit collects the working documents of an artificial intelligence licensing practice: the provenance manifest that makes every other protection possible, the clause library covering training rights, output ownership, indemnity conditions and model survival, the model and corpus inventory that keeps compliance current, and the intake and diligence materials that route deals correctly. Each template is annotated with its purpose, its owner, and the specific failure it prevents. The clauses are drafted from both sides so a negotiator can see the position being taken and the position likely to be taken back. Each template carries drafting notes on the allocation of training-data risk and output ownership. Adapt everything to the model, the data, and the deployment.

Casey Scott McKayFebruary 16, 202613 min read

TechnologyArtificial Intelligence

AI Licensing Diligence Checklist: A Practical Checklist

Artificial intelligence diligence fails when it asks for representations instead of documents, and when it treats a three-layer asset as a single license. This checklist separates the data, model, and output layers and runs each through the questions that produce usable answers. It covers provenance verification, chain of title, personal information and regulated data, model license restrictions that engineering teams routinely miss, indemnity conditions tested against the actual deployment, and the termination provisions that determine whether a trained model survives. Separate sections cover transaction diligence, vendor intake, and the ongoing inventory that keeps the answers current.

Casey Scott McKayFebruary 15, 20267 min read

TechnologyArtificial Intelligence

Negotiating an AI Data or Model License: A Practical Guide

Negotiating for artificial intelligence assets fails in predictable ways: the parties license a single undifferentiated thing, the licensor warrants rights it cannot document, and nobody addresses what happens to a trained model when the data license ends. This guide walks through the negotiation in the order that surfaces those problems early. It covers scoping the three layers, running diligence that produces documents rather than assurances, drafting the grant so training, fine-tuning, and evaluation are named separately, negotiating indemnity conditions rather than indemnity grants, and resolving termination before signature. It includes positions for each side, a term sheet, and the escalation points worth walking away over.

Casey Scott McKayFebruary 14, 202628 min read

TechnologyArtificial Intelligence

Licensing Data and Models for Artificial Intelligence: Training Rights, Outputs, and Indemnities

Licensing for artificial intelligence looks like software licensing and is not, because the asset has three layers that behave differently: the data, the model, and the outputs. This article separates them and explains what each layer's owner can and cannot grant. It covers the rights actually needed to train lawfully, the difference between an open weight release and open source, why output ownership provisions are more contract than copyright, and the indemnity structures that allocate the risks nobody can eliminate. It also addresses provenance documentation, the contractual layer that operates independently of copyright, and the practical questions of retention, deletion, and what happens to a model when the license to its training data ends.

Casey Scott McKayFebruary 13, 202628 min read

TechnologyPrivacy and Data Security

Vendor Cybersecurity Diligence Checklist: A Practical Checklist

Most significant data breaches now arrive through a vendor, and most vendor security reviews are a questionnaire nobody reads attached to a contract nobody negotiated. The controls that actually matter are a small set: knowing what data the vendor receives, tiering the review to the risk, obtaining independent assurance rather than self-attestation, and negotiating a handful of contract terms that determine who bears the loss. This checklist covers the sequence: inventory and tiering, the diligence appropriate to each tier, the technical and organizational questions worth asking, the subprocessor and data location analysis, the contract provisions that allocate breach cost and preserve audit and exit rights, and the ongoing monitoring and offboarding that most programs skip entirely. It closes with the ongoing monitoring and offboarding steps that most programs skip, including the deletion certification that determines whether the data actually goes away.

Casey Scott McKayJanuary 23, 202610 min read

TechnologyAdvertising and Marketing

The CAN-SPAM Act: A Comprehensive Guide for Businesses and Marketers

The CAN-SPAM Act of 2003 (15 U.S.C. 7701-7713) and the FTC's implementing rule (16 C.F.R. Part 316) set the federal ground rules for commercial email, regulating all commercial messages rather than only bulk spam. This guide explains the statute's scope through the "primary purpose" test that distinguishes commercial messages from exempt transactional or relationship messages, walks through the seven core compliance requirements, and details who counts as an "initiator" versus a "sender" and how liability is shared across advertisers, vendors, and affiliates. It covers enforcement by the FTC, sector regulators, state attorneys general, and internet service providers, including the inflation-adjusted civil penalty of roughly $51,744 or more per offending email and the criminal penalties under 18 U.S.C. 1037 for fraud-based conduct. The article addresses the absence of any private right of action, the statute's broad preemption of state email laws under 15 U.S.C. 7707, and how CAN-SPAM interacts with the TCPA for text messages and with stricter international regimes such as the GDPR and Canada's CASL. It closes with a practical compliance checklist and an FAQ for businesses and marketers.

Casey Scott McKayJanuary 23, 202647 min read

TechnologyPrivacy

Privacy Compliance Program Checklist: A Practical Checklist

A privacy compliance program is the operating system that keeps a company on the right side of an exploding patchwork of data-protection laws. This checklist builds one from the ground up, in order: governance and a named accountable owner, data mapping, the legal-patchwork analysis (FTC Section 5, CCPA/CPRA, the growing state laws, GDPR, HIPAA, GLBA, COPPA), anchoring to the NIST Privacy Framework and the Fair Information Practice Principles, a prioritized roadmap, and the operational machinery — privacy notices, DSAR handling, vendor and DPA management, DPIAs and privacy by design, security and breach response, training, and retention. It closes with accountability: documentation, monitoring, and audit. Each phase pairs checkboxes with the WHY and the traps, plus common mistakes, primary authority, and related mclaw.io resources. Build to the strictest applicable standard and apply it broadly. This is a map, not legal advice.

Casey Scott McKayDecember 17, 202510 min read