Technology Insights
Analysis and practical guides on technology.
150 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice—for a specific matter, contact the firm.
Website Accessibility Lawsuits: What the ADA Requires, What Breaks in the Code, and What to Do When the Letter Arrives
This article explains website accessibility litigation from both the legal and the engineering side, written by an IP and technology attorney who is also a former software engineer. It covers what Title III of the ADA requires, the circuit split over whether a website is a place of public accommodation, the DOJ's 2024 Title II web rule and its 2026 compliance-date extension, state damages statutes such as California's Unruh Act, and the unresolved tester-standing question. It then explains what WCAG actually is and walks through the four code failures that generate most claims (mouse-only controls, broken navigation menus, inaccessible modals, and checkout forms), with working HTML and JavaScript fixes. The second half covers the first week after a demand letter arrives, the economics of these cases, mootness and the voluntary cessation doctrine, the repeat-target problem, why overlay widgets fail, and how to run a remediation program under privilege. A worked example, common mistakes, an FAQ, and takeaways close the article.
AI and Emerging Technology Legal Toolkit: A Roadmap and Resource Guide
This toolkit is a high-level roadmap for lawyers, founders, product teams, and in-house counsel who must navigate the fast-moving legal landscape of artificial intelligence and adjacent emerging technologies. It walks the field from the broad regulatory picture through the hard questions of who owns AI-generated output, whether a machine can be an inventor or author, how training-data copyright disputes are unfolding, and how biometric and privacy law constrains AI development. It then turns practical: how to contract for AI products and services and how to build an AI governance and risk-management program. Each stage links to in-depth mclaw.io articles and checklists plus the primary authorities you actually need—USPTO guidance, the Copyright Office's AI report, and the Thaler decisions. The law here is unsettled; the toolkit flags where the ground is still moving so you can advise with appropriate humility.
Video Privacy Protection Act Compliance Checklist: A Practical Checklist
This checklist turns Video Privacy Protection Act compliance into phased, check-off tasks for a business that delivers video on a website or app. It runs from confirming whether the statute applies, through inventorying video and testing what actually leaves the browser, to choosing a fix for each surface. It then covers the statutory elements of consent, vendor terms, retention, and arbitration terms. The last phases cover what to do when a demand letter or complaint arrives, and what to re-check when the Supreme Court decides Salazar v. Paramount Global. Each task names its authority, and red-flag boxes mark the mistakes that create the most exposure.
Legal Issues for Mobile Applications: Privacy
Mobile apps collect data in ways the average person never sees, and a single SDK can quietly route a user's precise location, contacts, and health interests to dozens of companies. This guide maps the entire U.S. and global legal framework that governs that collection: the FTC's Section 5 authority and its mobile-privacy enforcement playbook, COPPA's strict rules for kids' apps, California's CCPA/CPRA and the wave of copycat state statutes, the GLBA for finance apps, GDPR for any app touching Europe, and the platform rules from Apple and Google that function as private law. It explains geolocation and biometric exposure (including Illinois's BIPA), data-breach notification duties, and the new front of "dark patterns" and deceptive consent. Written for founders, in-house counsel, and curious users alike, it defines every term in plain English and grounds each rule in primary authority. By the end you will know where the legal landmines are buried in a typical app and how to defuse them before launch. Treat it as a map, not a substitute for counsel on your specific product.
Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows
This toolkit gives operators and counsel working papers for complying with, or challenging, age verification and minors' online safety laws. It includes an applicability matrix by law type, a feature worksheet, an injunction status log, a response decision matrix, and a geoblock decision memo. It provides a vendor diligence questionnaire and a clause bank for age assurance contracts, plus an impact assessment template tailored to age checks. It sets out parental consent flows, notices, support scripts, a minors' feature review, and an app store release gate. It closes with an attorney general response plan and a declaration outline for an as-applied challenge. Each item names its purpose, owner, and timing, and each carries drafting notes tied to authority.
Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers
This article treats the decision whether to pay a ransomware demand as the legal problem it has become, rather than a purely technical or financial one. It explains why paying is not generally illegal in the United States but can violate sanctions law on a strict liability basis, and how OFAC, FinCEN, and the federal criminal statutes reach victims, insurers, negotiators, and banks. It then maps the reporting duties that a ransomware attack and a ransom payment each trigger, from CIRCIA and NYDFS to the SEC, HIPAA, the FTC Safeguards Rule, and state breach statutes, and explains why paying never cancels a notification obligation. Separate sections cover cyber extortion insurance and war exclusions, the practical reliability of decryptors and deletion promises, how negotiation is actually run, the ethical and board-level duties that frame the decision, and the litigation that follows. An extended worked example follows a hospital system through a seven-day payment decision, and the article closes with common mistakes, an FAQ, and takeaways.
Software Licensing Agreements
Software is almost never sold; it is licensed, and that single legal choice drives nearly everything that follows. This guide explains the difference between a license and a sale and why it matters under copyright's first-sale doctrine (Vernor v. Autodesk), then walks through the anatomy of a software license agreement: the license grant and its scope, exclusivity, field, territory, and term; the major commercial models from perpetual to subscription to SaaS; and the proprietary-versus-open-source divide. It then tackles the enforceability of clickwrap and browsewrap contracts (ProCD v. Zeidenberg, Specht v. Netscape, Nguyen v. Barnes & Noble), the heavily negotiated risk-allocation clauses (warranties, IP indemnity, limitation of liability), and the operational terms that quietly decide outcomes (maintenance and SLAs, source-code escrow, audit rights, assignment and change of control, and data and privacy). It closes with a negotiation-focused FAQ. The goal is a single resource a developer, a buyer, a judge, or a curious founder can all read and actually use.
Developing a Privacy Compliance Program
A privacy compliance program is the operating system that keeps a company on the right side of an exploding patchwork of data-protection laws. This guide explains how to build one from the ground up: governance and a privacy officer, data mapping, the legal patchwork (CCPA/CPRA, the growing list of state laws, GDPR, HIPAA, GLBA, COPPA, and FTC Section 5), privacy notices, consumer-rights request handling, vendor and data-processing agreements, impact assessments, security and breach response, training, retention, and documentation. It anchors the program to the NIST Privacy Framework and the Fair Information Practice Principles, and it threads in worked examples a layperson, a lawyer, and a judge can all follow. The aim is a program that is defensible on paper and real in practice. Treat it as a map, not legal advice for your specific situation.
A History of Computer Law
Computer law was not handed down on stone tablets; it was improvised, decade by decade, as judges and legislators wrestled new machines into old legal categories. This narrative history traces the story from the first fights over whether software could be copyrighted at all (CONTU and Apple v. Franklin) through the long war over software patents (Diehr, State Street, Bilski, Alice), the rise and reinterpretation of the Computer Fraud and Abuse Act (Van Buren), the DMCA, the twenty-six words that made the modern internet (Section 230), the Crypto Wars, the open-source revolution, the legalization of the electronic signature, the birth of data-privacy law, and the arrival of artificial intelligence. Along the way it explains each milestone in plain language for lawyers and non-lawyers alike. The aim is to show that today's hardest tech-law questions are the latest chapters in a very old argument about how to fit the future into the rules we already have.
Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response
This toolkit gives working papers for managing Video Privacy Protection Act risk and disputes, ready to copy and adapt. It includes a video inventory, a network audit protocol and data-flow grid, an audience and forum matrix, and a route decision memo. It offers consent language in several placements, with a log schema tied to the statute's elements, and a vendor clause bank. For disputes it provides a hold notice, demand-letter responses, a motion to dismiss outline organized by circuit, arbitration clause notes, an exposure worksheet, and a plaintiff's intake questionnaire with discovery topics. Each paper is introduced by its purpose, owner, and timing, and drafting notes tie it to authority.
Building a Vendor and Third-Party Risk Management Program
Most organizations do not know how many vendors they have, which of them hold personal data, or what any of the contracts say about notification and audit. That gap is the reason a growing share of security incidents, regulatory findings, and operational failures originate outside the company entirely. A workable program has four parts that reinforce each other: an inventory that is current, a tiering method that concentrates effort where the risk is, diligence proportionate to the tier, and contract terms that give the company information rights and remedies it can actually use. This guide covers building each part, the provisions worth negotiating and the ones that are not, ongoing monitoring, and the offboarding step that companies most often skip and most often regret.
The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement
This article explains what the federal computer trespass statute covers now that Van Buren has replaced purpose with gates, and why the fight has moved to three questions the Supreme Court left open. It walks through the structure of 18 U.S.C. § 1030, reads the leading cases closely, and shows how credentials, API keys, IP blocks, rate limits, robots.txt, revoked tokens, and cease-and-desist letters fare as gates. It covers the 2025 and 2026 appellate decisions on password sharing, resignation, AI agents, and investigative costs, including the Tenth Circuit's rejection of a technological-harm requirement for loss. It explains the civil claim in § 1030(g), the arithmetic of the $5,000 threshold, the two-year limitations period, and the Justice Department's charging policy for good-faith security research. Readers get worked hypotheticals and a candid account of what remains unsettled.