Technology Insights

Analysis and practical guides on technology.

90 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice — for a specific matter, contact the firm.

TechnologyPrivacy and Data Security

Cybersecurity Program Toolkit

Nearly every legal regime that touches data now requires the same handful of controls, described in slightly different words, and the organizations that fail examinations and lose claims are rarely the ones that lacked a framework. They are the ones whose risk assessment covered part of the environment, whose backups had never been restored, whose vendor agreements had a thirty-day breach clock, and whose incident response plan had never been exercised. This toolkit builds a program that satisfies the overlapping requirements at once: the data and asset inventory that scopes everything, the risk assessment the regulations actually require, the technical and administrative controls in priority order, vendor oversight, incident response and the notification clocks, insurance, and the governance and testing that make it durable. It closes with the notification clocks that run simultaneously under different regimes, the insurance that responds, and the testing cadence that keeps the program honest.

Casey Scott McKayAugust 2, 202413 min read

TechnologyPrivacy

Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design

Three separate regimes govern data about young people, and they ask different questions. COPPA regulates collection from children under thirteen and answers with parental consent. FERPA and the state student privacy statutes regulate education records and answer with school control and use restrictions. The design codes and the minor provisions of state privacy statutes regulate the product experience for all minors and answer with defaults, regardless of what anyone consented to. This toolkit runs all three in sequence, from the audience analysis and data inventory through consent, retention and deletion, school-context obligations, design defaults, age assurance, and the international rules that make a single thirteen-year-old age gate insufficient for a global service.

Casey Scott McKayJuly 16, 202413 min read

TechnologyPrivacy

Privacy and Data Protection Toolkit: Building and Running a Privacy Program

This toolkit is a roadmap for building, running, and defending a privacy and data-protection program in the United States and across borders. It walks the program life cycle: mapping and inventorying personal data, standing up governance, providing notices and obtaining consent, minimizing and retiring data, and complying with the sectoral and state-law patchwork (HIPAA, GLBA, COPPA, CCPA/CPRA), the GDPR and international transfer rules after Schrems II, and biometric statutes. It closes with breach and incident response and vendor management. Each stage links to mclaw.io checklists and articles plus the controlling statutes, regulators, and leading authorities. It is written for privacy counsel, compliance leads, founders, and product teams who need both a strategic overview and the operative rule for each step.

Casey Scott McKayJuly 13, 202413 min read

TechnologyInternet

Website Terms of Service Review Checklist: A Practical Checklist

The enforceability of a terms of service document is decided almost entirely by the screen that presents it, not by the words inside it. This checklist reviews both. It starts with formation, walking the interface features courts actually examine, and with the evidentiary record that lets a company prove what a particular user saw on a particular day. It then reviews the substantive provisions in the order they generate disputes: dispute resolution and the mass arbitration problem, unilateral modification, acceptable use and automated access, the user content license, limitations of liability, and auto-renewal and cancellation. Later phases cover accessibility of the assent flow, minors, and the jurisdiction-specific supplements that a single global document cannot replace.

Casey Scott McKayJune 6, 20248 min read

TechnologyData Security

Responding to a Data Breach: The First Seventy-Two Hours

The first three days of a security incident set the terms for everything that follows. They determine whether the forensic investigation is privileged, whether the evidence needed to scope the incident still exists, whether the insurer will pay, and whether the notification clocks that run from discovery can be met. Most of these decisions must be made before anyone knows what happened, which is why they should be made in advance and written down. This guide runs the response hour by hour through the first seventy-two hours and the two weeks that follow, covering the sequencing of containment against preservation, the engagement structure that protects the forensic report, the ransom and law enforcement decisions, the scoping work that drives every notification obligation, and the communications that will be read by regulators and plaintiffs' counsel.

Casey Scott McKayJune 3, 202425 min read

TechnologyAviation and Regulatory

Regulation of Drones

This is a plain-English but rigorous guide to how drones are regulated in the United States, anchored in the Federal Aviation Administration's framework and tied to its statutory and regulatory sources. It explains the two main paths an operator can fly under—the recreational exception in 49 U.S.C. § 44809 (with its free TRUST knowledge test) and the commercial small-UAS rule in 14 C.F.R. Part 107—plus registration, the Remote ID "digital license plate," airspace classes and authorization through LAANC, the security-sensitive airspace that is off-limits to everyone, and the slow march toward routine beyond-visual-line-of-sight (BVLOS) flight and drone delivery. It then turns to the harder questions the FAA does not fully answer: where federal preemption ends and state trespass, nuisance, and "Peeping-Tom" laws begin; why there is no comprehensive federal drone-privacy statute, only a patchwork (illustrated with Florida's statutes); how the Fourth Amendment's aerial-surveillance cases bear on government drones; the surprising gap in consumer product-safety oversight; and why shooting a drone out of the sky is a federal crime, not a property right. Worked hypotheticals, a FAQ, and a map of penalties make the rules usable for hobbyists, businesses, lawyers, and judges alike.

Casey Scott McKayMay 12, 202450 min read

TechnologyInternet

Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration

Almost every consumer relationship online is governed by a contract nobody read, and whether that contract exists at all turns on interface design rather than on legal drafting. This article explains how courts decide whether a website or app user agreed to terms: the spectrum from clickwrap through sign-in wrap to browsewrap, the reasonable notice and manifestation of assent standards applied in Specht, Nguyen, Meyer, Berman, and Oberstein, and the specific design features that decide cases, including button proximity, hyperlink contrast, font size, scroll position, and the wording of the assent notice. It then covers what those terms can and cannot accomplish: arbitration clauses and class waivers under the Federal Arbitration Act, delegation clauses and who decides arbitrability, the mass arbitration problem that has made these clauses double-edged, forum selection and choice of law, limitations of liability, unilateral modification and the illusory promise problem, and the consumer protection overlay for auto-renewal and cancellation. It closes with an interface and drafting checklist, a worked example, an FAQ, and related reading.

Casey Scott McKayApril 18, 202426 min read

TechnologyData Security

Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation

A data breach is an operational crisis with a legal deadline attached, and the deadline usually arrives before the facts do. Every state has a notification statute, they define covered information and trigger notification differently, and a single incident affecting customers nationwide requires satisfying all of them simultaneously along with any sector-specific federal regime that applies. The decisions that determine both regulatory exposure and litigation outcome are made in the first week: how the forensic investigation is structured and whether it is privileged, whether to pay a ransom, what the notification says, and what the company tells regulators and the market. This article covers the first seventy-two hours, the notification analysis across state and federal regimes, the litigation that follows, and the preparation that makes all of it survivable.

Casey Scott McKayApril 18, 202427 min read

TechnologyInformation Technology

Cloud and SaaS Agreements: Service Levels, Data Rights, Security, and Exit

A software-as-a-service agreement is not a software license with a different delivery method. The customer never possesses the software, its data lives on the vendor's infrastructure, the vendor can change the product unilaterally, and switching costs are usually far higher than either side admits during negotiation. This article explains what actually matters in cloud contracts and where the leverage is. It covers the grant of access rights and the difference between a license and a subscription, service level agreements and why the service credit remedy is usually worth less than it appears, availability definitions and how exclusions swallow the commitment, and the escalation and termination rights that give an SLA teeth. It then turns to data: who owns customer data, what the vendor may do with it including the increasingly contested question of training machine learning models, the data processing addendum and subprocessor controls, and cross-border transfer obligations. Sections on security representations and audit rights, incident notification, business continuity, intellectual property and feedback clauses, liability allocation, suspension, and the exit provisions that determine whether you can ever leave follow. It closes with a negotiation playbook, a worked example, an FAQ, and related reading.

Casey Scott McKayApril 8, 202425 min read

TechnologyCopyright and Consumer Rights

Unlocking Cell Phones: The Law and the DMCA Exemption

Unlocking your cell phone so it works on another carrier's network is legal in the United States today, but the path to that simple sentence runs through one of the strangest detours in modern copyright law. For a brief stretch beginning in January 2013, unlocking a phone without your carrier's blessing was arguably a federal copyright violation under the Digital Millennium Copyright Act's anti-circumvention rules, after the Copyright Office declined to renew a long-standing exemption. A record-breaking White House petition and a rare burst of bipartisan agreement produced the Unlocking Consumer Choice and Wireless Competition Act of 2014, and the exemption has been renewed in every triennial rulemaking since. This article tells the full arc, explains how Section 1201 and the triennial process actually work (including the deep circuit split over whether circumvention must have any connection to copyright at all), and untangles the often-confused trio of unlocking, jailbreaking, and rooting. It closes with worked examples, an FAQ, and a look at how all of this connects to the broader right-to-repair movement.

Casey Scott McKayMarch 12, 202447 min read

TechnologyInternet

Section 230 Reform and Platform Liability for User-Generated IP Infringement

Section 230 of the Communications Decency Act famously shields online platforms from being treated as the publisher of user content, but its own text carves intellectual property out of that shield in 47 U.S.C. 230(e)(2). This article maps the resulting two-track world: copyright claims run through the DMCA's Section 512 notice-and-takedown safe harbor, while trademark and other IP claims are litigated on the merits under doctrines like contributory infringement. We update the doctrine to mid-2026, anchored by the Supreme Court's unanimous March 2026 decision in Cox Communications v. Sony Music Entertainment, which rewrote the standard for contributory copyright liability, alongside Moody v. NetChoice, Gonzalez, Taamneh, Anderson v. TikTok, and the Cox repeat-infringer line that preceded the Supreme Court's intervention. We explain how reform aimed at non-IP harms would still reshape IP enforcement through shared moderation infrastructure, and we draw out the practical stakes for rights holders, platforms of every size, and the creators caught in the middle. The piece compares the U.S. approach to the EU's Digital Services Act and offers concrete guidance for practitioners advising on intermediary liability.

Casey Scott McKayFebruary 29, 202448 min read

TechnologyInternet

Social Media Law Basics

Social media sits on top of a surprisingly deep legal stack: federal immunity statutes, copyright law, advertising regulation, labor law, constitutional doctrine, and a patchwork of privacy rules. This article maps that stack for anyone who posts, markets, hires, moderates, or governs online. We explain Section 230 and its limits, the 2023-2024 Supreme Court decisions in Gonzalez, Taamneh, Moody v. NetChoice and Lindke v. Freed, the FTC's endorsement rules for influencers and its 2024 fake-reviews rule, the Consumer Review Fairness Act, the line the National Labor Relations Act draws around employee venting, the state laws protecting employees' account passwords, who owns a work account when an employee quits, the rules for content ownership and DMCA takedowns, and how defamation, anonymous-speech unmasking, impersonation, and contests actually work. Plain-language explanations and worked examples throughout, with cross-links to deeper articles. It closes with an FAQ and the usual reminder to get real counsel before you act.

Casey Scott McKayJanuary 8, 202452 min read