Technology Insights

Analysis and practical guides on technology.

90 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice — for a specific matter, contact the firm.

TechnologyLegal Practice Management

Running a Law Firm on Open Source Technology: Embracing Efficiency and Cost-Effectiveness

This is the deep business case for running a law firm on open source software -- the efficiency and cost-effectiveness argument, worked through in numbers and weighed honestly against its limits. It explains what open source is and how the GPL, LGPL, AGPL, MIT, Apache, and BSD license families differ, then maps a complete open source stack covering the operating system, collaboration, documents, email, accounting, research, and security. It develops a rigorous total-cost-of-ownership comparison against proprietary suites, including a worked numeric hypothetical, and treats vendor lock-in and data portability as both a financial and an ethical concern. The article overlays the professional-responsibility framework that governs every technology decision a lawyer makes -- ABA Model Rule 1.1 comment 8 on technology competence, Rule 1.6(c) on safeguarding client confidences, the cloud and SaaS ethics opinions, ABA Formal Opinion 483 on breach response, and the patchwork of state breach-notification and emerging written-information-security-program laws. It closes with a phased migration roadmap and a candid accounting of open source's real limits. For the shorter action checklist, see the companion guide Open Source for the Law Firm; for the licensing law itself, see Open Source Software.

Casey Scott McKayDecember 10, 202549 min read

TechnologyAdvertising and Marketing

CAN-SPAM Email Marketing Compliance Checklist: A Practical Checklist

The CAN-SPAM Act (15 U.S.C. 7701-7713) and the FTC's rule (16 C.F.R. Part 316) do not ban unsolicited commercial email; they impose a disclosure-and-opt-out code of conduct on every commercial message, bulk or single, B2B or B2C. This checklist operationalizes that code: classify each message under the primary-purpose test, keep headers and subject lines honest, label commercial mail as an ad, include a valid physical postal address, provide a one-step opt-out kept live for 30 days, honor opt-outs within 10 business days forever, never sell or transfer opt-out addresses, and maintain and scrub a central suppression list. It allocates sender/initiator liability (no contract can transfer it away), handles affiliate marketing and special content, and layers in the TCPA for texts and GDPR/CASL for international recipients. Each phase pairs checkboxes with the WHY and the traps, plus common mistakes, primary authority, and related mclaw.io resources. Verify the current per-email penalty at the FTC's latest adjustment notice.

Casey Scott McKaySeptember 14, 202510 min read

TechnologyContract

Navigating the Legal Landscape of Agile Software Development

Agile and Scrum development build software in short iterative cycles instead of against a fixed, up-front specification, and that single change breaks most of the assumptions baked into a traditional fixed-scope, fixed-price software contract. This article explains, for lawyers and non-lawyers alike, why fixed-scope contracting clashes with iterative development and how to structure Agile agreements instead, using time-and-materials, capped T&M, and sprint-based statements of work tied to a product backlog and a contractually defined product owner. It covers the doctrinal backdrop (substantial performance, UCC acceptance and perfect tender, failure of essential purpose), acceptance criteria and the "definition of done," change management without formal change orders, intellectual property ownership under the work-made-for-hire doctrine of 17 U.S.C. 101 versus written assignment and implied license, open-source and third-party compliance, warranties and limitation of liability, data security and privacy, the special problems of Agile in regulated and government settings, performance metrics and service levels, emerging frontiers such as AI-assisted development and smart-contract automation, and practical dispute-avoidance strategies. It also situates Scrum among its sibling frameworks — Kanban, Extreme Programming, and Lean — and the scaled approaches used on multi-vendor programs. Worked contract scenarios with invented parties, and sample clause language, illustrate each issue. The goal is a contract as adaptive as the methodology it governs while still protecting both customer and developer.

Casey Scott McKaySeptember 7, 202564 min read

TechnologyEducation

Education Law for Schools and Edtech: FERPA, Title IX, and Section 504

Schools and the companies that sell to them operate under a set of statutes that were written decades apart, overlap unevenly, and are enforced by agencies with very different tools. A district can be simultaneously a FERPA-covered educational agency, a Title IX recipient, a Section 504 and IDEA obligor, a state actor subject to the First and Fourth Amendments, and a customer whose vendor contracts determine whether it has just disclosed student data unlawfully. This article works through each regime in the order it usually arises: what FERPA protects and how the school official exception makes most edtech lawful, how COPPA and state student privacy statutes reach vendors directly, what Title IX now requires procedurally, how Section 504 and the IDEA differ, and where constitutional limits constrain discipline, speech, and searches. It closes with the constitutional limits on discipline, speech, and searches that apply to public schools as state actors and to no one else.

Casey Scott McKaySeptember 1, 202525 min read

TechnologyContract

Software Licensing Agreements: An Overview

A software license is permission to use code you do not own, and that one legal choice--license, not sale--quietly organizes a multi-trillion-dollar industry. This high-level overview explains the big ideas behind software licensing rather than walking clause by clause: why copyright (17 U.S.C. 106 and 117) makes running a program an act that needs permission, why the first-sale doctrine pushed the whole industry from selling to licensing, and how Vernor v. Autodesk decides when a "sale" is really a license. It offers mental models for reading any software contract, surveys the four licensing worlds (perpetual, subscription, SaaS, and open source), explains how courts decide whether a clickwrap or browsewrap deal even formed (ProCD, Specht, Nguyen, Meyer), and maps the lifecycle of a license from grant to exit. Throughout, it points you to mclaw.io's deeper drafting, review, and transaction resources for the clause-level detail. The aim is a clear conceptual map a founder, an in-house lawyer, a judge, or a curious non-lawyer can all follow. This is general information, not legal advice.

Casey Scott McKayAugust 6, 202532 min read

TechnologyArtificial Intelligence

AI and Emerging Technology Legal Toolkit: A Roadmap and Resource Guide

This toolkit is a high-level roadmap for lawyers, founders, product teams, and in-house counsel who must navigate the fast-moving legal landscape of artificial intelligence and adjacent emerging technologies. It walks the field from the broad regulatory picture through the hard questions of who owns AI-generated output, whether a machine can be an inventor or author, how training-data copyright disputes are unfolding, and how biometric and privacy law constrains AI development. It then turns practical: how to contract for AI products and services and how to build an AI governance and risk-management program. Each stage links to in-depth mclaw.io articles and checklists plus the primary authorities you actually need—USPTO guidance, the Copyright Office's AI report, and the Thaler decisions. The law here is unsettled; the toolkit flags where the ground is still moving so you can advise with appropriate humility.

Casey Scott McKayJuly 18, 202515 min read

TechnologyPrivacy

Legal Issues for Mobile Applications: Privacy

Mobile apps collect data in ways the average person never sees, and a single SDK can quietly route a user's precise location, contacts, and health interests to dozens of companies. This guide maps the entire U.S. and global legal framework that governs that collection: the FTC's Section 5 authority and its mobile-privacy enforcement playbook, COPPA's strict rules for kids' apps, California's CCPA/CPRA and the wave of copycat state statutes, the GLBA for finance apps, GDPR for any app touching Europe, and the platform rules from Apple and Google that function as private law. It explains geolocation and biometric exposure (including Illinois's BIPA), data-breach notification duties, and the new front of "dark patterns" and deceptive consent. Written for founders, in-house counsel, and curious users alike, it defines every term in plain English and grounds each rule in primary authority. By the end you will know where the legal landmines are buried in a typical app and how to defuse them before launch. Treat it as a map, not a substitute for counsel on your specific product.

Casey Scott McKayJuly 8, 202539 min read

TechnologyContract

Software Licensing Agreements

Software is almost never sold; it is licensed, and that single legal choice drives nearly everything that follows. This guide explains the difference between a license and a sale and why it matters under copyright's first-sale doctrine (Vernor v. Autodesk), then walks through the anatomy of a software license agreement: the license grant and its scope, exclusivity, field, territory, and term; the major commercial models from perpetual to subscription to SaaS; and the proprietary-versus-open-source divide. It then tackles the enforceability of clickwrap and browsewrap contracts (ProCD v. Zeidenberg, Specht v. Netscape, Nguyen v. Barnes & Noble), the heavily negotiated risk-allocation clauses (warranties, IP indemnity, limitation of liability), and the operational terms that quietly decide outcomes (maintenance and SLAs, source-code escrow, audit rights, assignment and change of control, and data and privacy). It closes with a negotiation-focused FAQ. The goal is a single resource a developer, a buyer, a judge, or a curious founder can all read and actually use.

Casey Scott McKayJune 14, 202542 min read

TechnologyPrivacy

Developing a Privacy Compliance Program

A privacy compliance program is the operating system that keeps a company on the right side of an exploding patchwork of data-protection laws. This guide explains how to build one from the ground up: governance and a privacy officer, data mapping, the legal patchwork (CCPA/CPRA, the growing list of state laws, GDPR, HIPAA, GLBA, COPPA, and FTC Section 5), privacy notices, consumer-rights request handling, vendor and data-processing agreements, impact assessments, security and breach response, training, retention, and documentation. It anchors the program to the NIST Privacy Framework and the Fair Information Practice Principles, and it threads in worked examples a layperson, a lawyer, and a judge can all follow. The aim is a program that is defensible on paper and real in practice. Treat it as a map, not legal advice for your specific situation.

Casey Scott McKayJune 12, 202538 min read

TechnologyInformation Technology

A History of Computer Law

Computer law was not handed down on stone tablets; it was improvised, decade by decade, as judges and legislators wrestled new machines into old legal categories. This narrative history traces the story from the first fights over whether software could be copyrighted at all (CONTU and Apple v. Franklin) through the long war over software patents (Diehr, State Street, Bilski, Alice), the rise and reinterpretation of the Computer Fraud and Abuse Act (Van Buren), the DMCA, the twenty-six words that made the modern internet (Section 230), the Crypto Wars, the open-source revolution, the legalization of the electronic signature, the birth of data-privacy law, and the arrival of artificial intelligence. Along the way it explains each milestone in plain language for lawyers and non-lawyers alike. The aim is to show that today's hardest tech-law questions are the latest chapters in a very old argument about how to fit the future into the rules we already have.

Casey Scott McKayJune 7, 202535 min read

TechnologyVendor Risk

Building a Vendor and Third-Party Risk Management Program

Most organizations do not know how many vendors they have, which of them hold personal data, or what any of the contracts say about notification and audit. That gap is the reason a growing share of security incidents, regulatory findings, and operational failures originate outside the company entirely. A workable program has four parts that reinforce each other: an inventory that is current, a tiering method that concentrates effort where the risk is, diligence proportionate to the tier, and contract terms that give the company information rights and remedies it can actually use. This guide covers building each part, the provisions worth negotiating and the ones that are not, ongoing monitoring, and the offboarding step that companies most often skip and most often regret.

Casey Scott McKayMay 10, 202526 min read

TechnologyArtificial Intelligence

AI Vendor Procurement and Governance Checklist: A Practical Checklist

Buying an AI tool is buying a probabilistic system whose behavior changes when the vendor updates a model. This checklist covers the diligence and the contract terms that make that manageable. It begins with use-case classification, because the controls that matter for a drafting assistant differ from those for a system that screens job applicants or prices credit. It then covers data rights and the training-exclusion terms that are the single most negotiated point, output ownership and IP indemnity, accuracy and evaluation, human oversight for consequential decisions, security and subprocessors, model change management, and the regulatory overlays that now apply to deployers rather than just developers. A final phase addresses ongoing governance: the AI inventory, shadow AI discovery, incident handling, and periodic review.

Casey Scott McKayApril 24, 20258 min read