Technology Insights
Analysis and practical guides on technology.
150 articles, checklists, and guides on technology law, written by the attorneys at MC Law. Every piece is general information, not legal advice—for a specific matter, contact the firm.
Taking Down a Lookalike Domain in Days: A Practical Guide
This guide takes a business from the moment it discovers a lookalike domain through the first 72 hours and on to a decision about the UDRP, the URS, or federal court. It separates the money, the domain, and the possible mailbox compromise, because each has its own clock and its own owner. It gives step-by-step instructions on wire recalls and IC3 reports, on capturing evidence before it disappears, and on writing abuse reports that registrars, hosts, and CDNs can act on under ICANN's 2024 rules. It explains how to communicate internally and with customers, when to notify an insurer, and how to choose among takedown forums, with costs and trade-offs. It also covers the other sides of the dispute, including the trading partner who says you still owe the money and the registrant who was wrongly accused. It ends with common mistakes and a defensive program of monitoring, registrations, and contract terms.
AI Vendor Procurement and Governance Checklist: A Practical Checklist
Buying an AI tool is buying a probabilistic system whose behavior changes when the vendor updates a model. This checklist covers the diligence and the contract terms that make that manageable. It begins with use-case classification, because the controls that matter for a drafting assistant differ from those for a system that screens job applicants or prices credit. It then covers data rights and the training-exclusion terms that are the single most negotiated point, output ownership and IP indemnity, accuracy and evaluation, human oversight for consequential decisions, security and subprocessors, model change management, and the regulatory overlays that now apply to deployers rather than just developers. A final phase addresses ongoing governance: the AI inventory, shadow AI discovery, incident handling, and periodic review.
AI Governance Toolkit: Inventory, Risk Classification, and Controls
AI governance fails in a predictable way: a policy is written, a committee is formed, and nobody ever learns what the company is actually running. This toolkit is built the other way around, starting with discovery and inventory and treating documentation as the output of a process rather than its substitute. It covers building an inventory that includes the tools procurement never saw, classifying systems by risk in a way that maps to the obligations that follow, running impact assessments that produce decisions rather than paper, designing human oversight that can actually override a model, testing for bias and accuracy on a schedule, giving notice where notice is required, and handling AI incidents that are not security incidents. It closes with the governance layer: policy, training, vendor management, board reporting, and the annual review that keeps the whole thing from decaying.
Defending or Bringing a Data Breach Class Action: A Practical Guide
This guide walks both sides of a data breach class action through the sequence of decisions from the notice letter to dismissal or settlement. Defense counsel get a plan for the letter, the investigation structure, forum, standing and merits motions, and discovery. Plaintiffs' counsel get a screening method for clients and defendants, forum selection by circuit, pleading language, and a plan to pry loose the forensic report. It explains timing, who does what, the costs and trade-offs of each choice, and the mistakes that lose cases early. Worked hypotheticals and sample language appear throughout.
Software License Agreement Review Checklists: A Complete Toolkit
This toolkit pairs working review checklists with the explanatory prose a reviewer needs to use them well. It walks provision by provision through a software license agreement—license grant, license metrics and audit rights, SLAs, data rights, IP, warranties, indemnification, limitation of liability, term and termination, and the boilerplate that bites—explaining what each clause does, why it matters, and what good, acceptable, and dangerous versions look like in 2026. It grounds the practical guidance in the governing law: the license-versus-sale distinction (Vernor v. Autodesk), clickwrap and browsewrap enforceability (ProCD, Specht, Nguyen), scope-of-use as copyright infringement (Adobe v. One Stop Micro), anti-assignment traps (SQL Solutions v. Oracle), the UCC's warranty and conspicuousness rules, the Bankruptcy Code's Section 365(n) and ipso facto limits, and the modern data-protection overlay (GDPR, CCPA/CPRA, HIPAA, the 2024 HIPAA Security Rule proposal). Separate tracks serve vendors and customers, SaaS and on-premise deployments. Use it to review a contract systematically, spot the red flags, and prioritize what to negotiate.
Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints
This toolkit collects the working papers for recovering a hijacked domain name and for preventing the next theft, each introduced by its purpose, its owner, and when to use it, and each followed by drafting commentary tied to authority. The recovery templates cover a triage worksheet, a demand letter to the losing registrar, an abuse report to the gaining registrar, an evidence-of-ownership declaration, an evidence log, and an outline for a Transfer Dispute Resolution Policy request. The litigation and dispute templates supply UDRP complaint sections written for stolen-domain cases, an in rem ACPA complaint skeleton for the registry's district, and a temporary restraining order motion outline with a proposed order directed at the registry. The prevention templates are a domain portfolio security policy, a web developer domain control clause, a demand letter to a developer holding a client's name, and a buy-back decision record. A running example follows one software company through every paper.
Data Breach Litigation Readiness Checklist: A Practical Checklist
This checklist turns data breach litigation readiness into tasks that can be assigned and checked off, before an incident and after one. The pre-incident phases cover vendor contracts, class waivers, data minimization, and evidence retention, since those are hard to fix later. The post-incident phases cover privilege structure, the notice letter, complaint triage, forum, motions, discovery, class issues, and settlement, with a separate phase for plaintiffs' counsel. Every task names its authority, and red flags mark the points where cases have actually been lost. It is designed to print and sit on a desk during an incident.
Children's Privacy Under COPPA and the Age-Appropriate Design Codes
Children's privacy is governed by a 1998 statute that applies only to children under thirteen, only to operators with actual knowledge or a child-directed service, and only to a defined list of personal information—and by a newer generation of state design codes that attempt to regulate the experience itself rather than the data. The two regimes ask different questions and a company can satisfy one while violating the other. This article covers the COPPA Rule as amended, including who is an operator, what makes a service child-directed, the verifiable parental consent methods that actually exist, the internal operations exception that most services rely on, and the retention and deletion obligations recently strengthened. It then addresses the design codes, the constitutional litigation that has reshaped them, teen privacy under state comprehensive laws, and what an age assurance program looks like in practice.
AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After
Artificial intelligence regulation arrived faster than most compliance functions expected and in a shape most were not built for: a comprehensive European statute with extraterritorial reach and staged deadlines, a growing set of state laws targeting algorithmic discrimination and disclosure, a federal posture that swung sharply between administrations, and enforcement by agencies applying decades-old consumer protection, employment, and lending statutes to new technology. This article maps that terrain and then explains how to build a governance program that satisfies most of it at once. It covers the EU AI Act's risk tiers, prohibited practices, high-risk obligations, general purpose model rules, and penalty structure, along with who counts as a provider and who counts as a deployer, which is the classification that determines everything else. It then covers the American picture: Colorado's algorithmic discrimination statute, Texas's intent-based approach, Illinois and New York City employment rules, California's transparency and training data laws, and the federal agencies enforcing existing law against AI systems. A long practical section covers the program itself: inventory, risk classification, impact assessments, human oversight design, testing and documentation, procurement and vendor contracts, incident response, and training. It closes with checklists, a worked example, an FAQ, and related reading.
Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide
This guide takes a civil computer access dispute from the first alert through summary judgment, once from the plaintiff's chair and once from the defendant's. It sequences triage, revocation, forensic preservation, loss accounting, claim selection, pleading, emergency relief, and discovery, and it explains who should do each task and when. The defense half covers first-day containment, criminal exposure, the Rule 12 motion sequence, opposing a TRO, and attacking loss at summary judgment and trial. It compares the CFAA with the Stored Communications Act, the Defend Trade Secrets Act, and state computer crime statutes in California, Virginia, Florida, and elsewhere. Sample language, two worked hypotheticals, and a list of common mistakes make it usable on a live matter.
Data Subject Rights Request Handling Checklist: A Practical Checklist
A rights request is a deadline running against a company that usually does not know where its data lives. This checklist covers the operational path from intake to closure: recognizing a request whatever channel it arrives through, verifying identity without collecting more data than necessary, determining which statutes apply and what each requires, searching systems of record and vendors, applying exemptions correctly, responding within the deadline, handling appeals, and logging everything. Separate phases cover opt-out signals, which are processed differently and on a shorter clock, and the requests companies forget to plan for, including employee and applicant requests in California and requests received through a support ticket rather than the privacy portal. The goal throughout is a process that can be demonstrated to a regulator from the log alone, without reconstructing anyone's memory of what happened.
Smile: Cell Phone Camera Privacy and the Law
Nearly everyone now carries a high-resolution camera and microphone everywhere they go, and the law has scrambled to keep pace. This article maps the legal landscape of photographing and recording people—starting with the public-versus-private divide and the "reasonable expectation of privacy," then untangling the patchwork of one-party and all-party wiretap-consent statutes that govern audio under the Electronic Communications Privacy Act and its state analogs. It explains the federal video voyeurism crime at 18 U.S.C. 1801, state "upskirting" and revenge-porn laws, the First Amendment right to record police, and the special rules for landlords, employers, biometrics, and drones. It also addresses how lawfully captured footage becomes admissible evidence. Throughout, it offers concrete do's and don'ts for both the person holding the phone and the person on the other side of the lens. Because recording-consent rules vary dramatically from state to state, the article repeatedly flags where you must check local law before you hit record.