Technology Insights

Analysis and practical guides on technology.

90 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice — for a specific matter, contact the firm.

TechnologyArtificial Intelligence

AI Governance Toolkit: Inventory, Risk Classification, and Controls

AI governance fails in a predictable way: a policy is written, a committee is formed, and nobody ever learns what the company is actually running. This toolkit is built the other way around, starting with discovery and inventory and treating documentation as the output of a process rather than its substitute. It covers building an inventory that includes the tools procurement never saw, classifying systems by risk in a way that maps to the obligations that follow, running impact assessments that produce decisions rather than paper, designing human oversight that can actually override a model, testing for bias and accuracy on a schedule, giving notice where notice is required, and handling AI incidents that are not security incidents. It closes with the governance layer: policy, training, vendor management, board reporting, and the annual review that keeps the whole thing from decaying.

Casey Scott McKayMarch 29, 202515 min read

TechnologyContract

Software License Agreement Review Checklists: A Complete Toolkit

This toolkit pairs working review checklists with the explanatory prose a reviewer needs to use them well. It walks provision by provision through a software license agreement—license grant, license metrics and audit rights, SLAs, data rights, IP, warranties, indemnification, limitation of liability, term and termination, and the boilerplate that bites—explaining what each clause does, why it matters, and what good, acceptable, and dangerous versions look like in 2026. It grounds the practical guidance in the governing law: the license-versus-sale distinction (Vernor v. Autodesk), clickwrap and browsewrap enforceability (ProCD, Specht, Nguyen), scope-of-use as copyright infringement (Adobe v. One Stop Micro), anti-assignment traps (SQL Solutions v. Oracle), the UCC's warranty and conspicuousness rules, the Bankruptcy Code's Section 365(n) and ipso facto limits, and the modern data-protection overlay (GDPR, CCPA/CPRA, HIPAA, the 2024 HIPAA Security Rule proposal). Separate tracks serve vendors and customers, SaaS and on-premise deployments. Use it to review a contract systematically, spot the red flags, and prioritize what to negotiate.

Casey Scott McKayMarch 21, 202575 min read

TechnologyPrivacy

Children's Privacy Under COPPA and the Age-Appropriate Design Codes

Children's privacy is governed by a 1998 statute that applies only to children under thirteen, only to operators with actual knowledge or a child-directed service, and only to a defined list of personal information — and by a newer generation of state design codes that attempt to regulate the experience itself rather than the data. The two regimes ask different questions and a company can satisfy one while violating the other. This article covers the COPPA Rule as amended, including who is an operator, what makes a service child-directed, the verifiable parental consent methods that actually exist, the internal operations exception that most services rely on, and the retention and deletion obligations recently strengthened. It then addresses the design codes, the constitutional litigation that has reshaped them, teen privacy under state comprehensive laws, and what an age assurance program looks like in practice.

Casey Scott McKayFebruary 23, 202526 min read

TechnologyArtificial Intelligence

AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After

Artificial intelligence regulation arrived faster than most compliance functions expected and in a shape most were not built for: a comprehensive European statute with extraterritorial reach and staged deadlines, a growing set of state laws targeting algorithmic discrimination and disclosure, a federal posture that swung sharply between administrations, and enforcement by agencies applying decades-old consumer protection, employment, and lending statutes to new technology. This article maps that terrain and then explains how to build a governance program that satisfies most of it at once. It covers the EU AI Act's risk tiers, prohibited practices, high-risk obligations, general purpose model rules, and penalty structure, along with who counts as a provider and who counts as a deployer, which is the classification that determines everything else. It then covers the American picture: Colorado's algorithmic discrimination statute, Texas's intent-based approach, Illinois and New York City employment rules, California's transparency and training data laws, and the federal agencies enforcing existing law against AI systems. A long practical section covers the program itself: inventory, risk classification, impact assessments, human oversight design, testing and documentation, procurement and vendor contracts, incident response, and training. It closes with checklists, a worked example, an FAQ, and related reading.

Casey Scott McKayFebruary 23, 202525 min read

TechnologyPrivacy

Data Subject Rights Request Handling Checklist: A Practical Checklist

A rights request is a deadline running against a company that usually does not know where its data lives. This checklist covers the operational path from intake to closure: recognizing a request whatever channel it arrives through, verifying identity without collecting more data than necessary, determining which statutes apply and what each requires, searching systems of record and vendors, applying exemptions correctly, responding within the deadline, handling appeals, and logging everything. Separate phases cover opt-out signals, which are processed differently and on a shorter clock, and the requests companies forget to plan for, including employee and applicant requests in California and requests received through a support ticket rather than the privacy portal. The goal throughout is a process that can be demonstrated to a regulator from the log alone, without reconstructing anyone's memory of what happened.

Casey Scott McKayFebruary 18, 20258 min read

TechnologyPrivacy

Smile: Cell Phone Camera Privacy and the Law

Nearly everyone now carries a high-resolution camera and microphone everywhere they go, and the law has scrambled to keep pace. This article maps the legal landscape of photographing and recording people--starting with the public-versus-private divide and the "reasonable expectation of privacy," then untangling the patchwork of one-party and all-party wiretap-consent statutes that govern audio under the Electronic Communications Privacy Act and its state analogs. It explains the federal video voyeurism crime at 18 U.S.C. 1801, state "upskirting" and revenge-porn laws, the First Amendment right to record police, and the special rules for landlords, employers, biometrics, and drones. It also addresses how lawfully captured footage becomes admissible evidence. Throughout, it offers concrete do's and don'ts for both the person holding the phone and the person on the other side of the lens. Because recording-consent rules vary dramatically from state to state, the article repeatedly flags where you must check local law before you hit record.

Casey Scott McKayFebruary 17, 202548 min read

TechnologyIntellectual Property

Mobile App Launch Legal Checklist: A Practical Checklist

You finished building the app — now the legal work begins, and most of it should happen before the launch party. This checklist walks the founder, in-house lawyer, and curious layperson through everything between "feature complete" and "live in the store," roughly in the order the risks bite: a liability-shield entity, signed IP assignments from every contractor, surviving Apple's and Google's developer agreements in a post-Epic v. Apple world, enforceable EULA/terms via conspicuous clickwrap, a privacy policy that matches the store labels, the auto-renewal/ROSCA subscription minefield, ADA/WCAG accessibility, COPPA for kids' data, advertising truthfulness, open-source license compliance, and export/encryption rules. Each phase pairs checkboxes with the WHY and the traps, plus common mistakes, primary authority, and related mclaw.io resources. The law here is fast-moving in 2026; treat this as a sophisticated map, not a substitute for counsel.

Casey Scott McKayFebruary 1, 202512 min read

TechnologyInternet

Website Accessibility Remediation Checklist: A Practical Checklist

Website accessibility litigation is high-volume, low-value, and highly repeatable, which means the cheapest defense is a documented remediation program rather than a settlement. This checklist works through legal exposure first, because the answer differs by circuit and by whether the business has a physical location, then moves to the technical work: an audit combining automated scanning with manual keyboard and screen reader testing, prioritized remediation of the defects that actually block users, and the governance that keeps a remediated site from regressing. Separate phases address mobile apps, PDFs and third-party content, overlay widgets and why they are not a defense, procurement language for new vendors, and what to do in the first week after a demand letter arrives. The through-line is documentation: an audit, a prioritized plan, and dated records are worth more in defending a claim than any single technical fix.

Casey Scott McKayDecember 10, 20249 min read

TechnologyInternet

Website and Mobile App Accessibility Under the ADA: WCAG, Litigation Risk, and Remediation

Thousands of federal lawsuits are filed every year alleging that a website or mobile app is inaccessible to people with disabilities, and the vast majority settle quickly because the legal question is unsettled while the technical question usually is not. This article explains the state of the law and, more usefully, what to actually do about it. It covers whether and when a website is covered by Title III of the Americans with Disabilities Act, the circuit split over whether a physical place of public accommodation is required and the nexus test that governs in the Ninth Circuit after Robles v. Dominos Pizza, the Department of Justice's 2024 rule adopting a technical standard for state and local government websites and what it signals for private entities, and the state law overlay that supplies statutory damages where the federal statute does not. It then turns to engineering: what the Web Content Accessibility Guidelines actually require, the small number of defects that generate most complaints, why automated scanners catch only a fraction of them, and why accessibility overlay widgets have become a liability rather than a solution. It closes with a remediation program, a demand-letter response playbook, a worked example, an FAQ, and related reading.

Casey Scott McKayDecember 1, 202426 min read

TechnologyPrivacy and Data Security

Data Breach and Incident Response Toolkit: From Detection to Notification

An incident response plan is tested exactly once, under conditions where nobody has time to read it. This toolkit is built for that moment and for the preparation that makes it survivable. It starts with what must exist before an incident, because the decisions that determine cost are made in advance: the plan, the retainers, the insurance, and the logging that makes an investigation possible. It then works through the first hours, containment and evidence preservation, the privileged forensic investigation and the case law that governs whether the report stays privileged, the legal analysis that determines whether notification is required in each jurisdiction, and the notification mechanics themselves. Later stages cover ransomware and its sanctions problem, business email compromise, vendor breaches where the data is yours and the incident is not, regulatory response, litigation that follows, and the post-incident work that reduces the next one.

Casey Scott McKayNovember 11, 202414 min read

TechnologyOpen Source

Open Source Software Compliance Checklist: A Practical Checklist

Open source compliance fails not because the law is mysterious but because nobody runs the checklist. Hundreds of components, dozens of license families, and a dependency tree that changes hourly turn a tractable obligation into an overwhelming one. This checklist breaks it into discrete, checkable steps: scoping by distribution surface, component discovery (lockfiles, vendored code, binaries and containers), license classification along the permissive/weak/strong-copyleft spectrum, copyleft and AGPL exposure analysis, attribution, remediation (fix, remove, isolate, or comply), a continuous program with a tiered license policy and CI-integrated scanning, SBOM generation, M&A diligence, and incident response. Each step carries enough legal context — anchored in Jacobsen v. Katzer, the SFC v. Vizio third-party-beneficiary theory, the Orange/Entr'ouvert award, and concrete MIT/BSD/Apache/LGPL/GPL/AGPL obligations — to show why it matters. It closes with common mistakes, primary authority, and related mclaw.io resources.

Casey Scott McKayOctober 11, 202412 min read

TechnologyPrivacy

State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork

The United States has no comprehensive federal privacy law, and roughly twenty states have filled the gap with statutes that are similar enough to invite a single compliance program and different enough to punish anyone who builds one carelessly. This article maps that landscape. It explains the structure every one of these laws shares, applicability thresholds, controller and processor roles, consumer rights, opt-out mechanics, sensitive data treatment, and data protection assessments, then identifies the places where the statutes genuinely diverge and where those divergences create real operational work. California receives extended treatment because it remains the outlier: it has a dedicated regulator, it covers employee and business-to-business data, it treats cross-context behavioral advertising as sharing, and it is the only comprehensive state law with a private right of action, for data breaches. The article then covers the sector-specific statutes that often matter more in practice than the comprehensive ones, including Illinois biometric law, Washington health data law, the federal video privacy statute, and the wiretapping theories driving website tracking litigation. It closes with a program build-out, a worked example, an FAQ, and related reading.

Casey Scott McKayOctober 5, 202425 min read