⚖️Not legal advice. This is a technical checklist, not a legal opinion. Laws depend on where you and your users are. For anything serious, talk to a lawyer.
The 5 traps
Same order as the reel. Each one comes from a real court case or law, with the source underneath.
1
Fonts loaded from Google's servers
📍 Munich · Jan 2022
A website embedded Google Fonts from Google's servers, so every visitor's IP address went to Google without consent. One visitor sued.
The caseThe Munich regional court (LG München I) ordered the site to pay him €100 and stop, under the GDPR.
The fixSelf-host your fonts (download them and serve them from your own domain). No request to fonts.googleapis.com or fonts.gstatic.com.
Session-replay and some analytics tools record what visitors type and click. Lawsuits argue this is wiretapping under the California Invasion of Privacy Act.
The riskUp to $5,000 per violation, which plaintiffs can count per visitor.
The fixLoad replay only after consent, mask every input field, and say it clearly in your privacy policy. Or turn keystroke recording off.
Your launch or newsletter emails are commercial email under the U.S. CAN-SPAM Act.
The riskUp to $53,088 in civil penalties per email (the FTC's 2025 adjustment).
The fixEvery marketing email needs a working unsubscribe link, your valid physical postal address and an honest subject line. Honor opt-outs within 10 business days.
California's Automatic Renewal Law requires the renewal terms clearly next to the subscribe button, plus the customer's consent.
The riskIf you charge without it, what you sent can be treated as an unconditional gift, so you may have to refund.
The fixShow the price, billing period, that it renews until cancelled and how to cancel right by the button. Get clear consent, send a confirmation email with the terms, and let people cancel online.
Source: Cal. Bus. & Prof. Code § 17602 and § 17603 · § 17603
5
The $6 form: no DMCA agent
📍 U.S. Copyright Office
If users can upload images, files or posts, the DMCA "safe harbor" protects you only if you have registered a designated agent with the U.S. Copyright Office. It costs $6 and you renew it every 3 years.
The riskWithout it, a user's stolen image can expose you to statutory damages of up to $150,000 per work for willful infringement.
The fixRegister your agent, add a copyright/takedown page with the agent's contact details, and have a repeat-infringer policy.
Each fine is small once. It's counted again for every visitor, violation, email or work.
€100per visitor · Munich
$5,000per violation · California
$53,088per email · FTC
$150,000per work · DMCA
The prompt
Every one of these started with a single line of code. Paste this into Claude Code in your app's folder (or into Claude with your code attached).
1
Run the audit
Claude Code · in your project folder
Claude searches your code, shows you what it found with file and line, and waits for your OK before it changes anything.
The audit promptAudit this codebase for 5 common legal traps in web apps. This is a technical review, not legal advice. For each trap: search the code, list what you found (file + line), rate it OK / RISK / NOT APPLICABLE, and propose the exact fix. Don't change anything until I approve.
1. Third-party fonts and scripts: anything loaded from fonts.googleapis.com, fonts.gstatic.com or other external servers that sends visitors' IP addresses before consent. Fix: self-host the fonts and files.
2. Session replay and analytics: any tool that records sessions, clicks, form inputs or keystrokes. Fix: load it only after consent, mask all inputs, and mention it in the privacy policy.
3. Marketing emails: every newsletter or promotional email must have a working unsubscribe link, a valid physical postal address and an honest subject line, and opt-outs must be honored within 10 business days.
4. Subscriptions and checkout: the auto-renewal terms (price, billing period, renews until cancelled, how to cancel) shown clearly next to the subscribe button, clear consent from the customer, a confirmation email with those terms, and a way to cancel online.
5. User uploads: if users can upload images, files or posts, check for a copyright/DMCA takedown page with a designated agent's contact details and a repeat-infringer policy. Remind me to register the agent with the U.S. Copyright Office.
Finish with a table: trap, status, files, fix, effort. Then ask me which fixes to apply.
💡Not using Claude Code? Paste the same prompt into Claude and attach your main files (layout, checkout, email templates, upload code).
2
Apply the fixes
After you've read the table
Pick what to fix and let Claude do it, one trap at a time, so you can review each change.
Fix promptApply the fix for trap [number] only. Show me the diff, explain what changed in plain English, and list anything I still need to do by hand.
3
Do these by hand
Claude can't do these for you
Register your DMCA agent ($6, renew every 3 years) on the Copyright Office's DMCA Designated Agent Directory.
Add your real postal address to your email footer (a P.O. box registered with the USPS also works).
Update your privacy policy to list every tool that collects data, and have a lawyer review it if you have paying users.
Self-host fontsFind every font loaded from Google Fonts or another CDN, download those font files into this project, serve them locally, and remove the external requests. Then confirm no page still calls fonts.googleapis.com or fonts.gstatic.com.
Consent bannerAdd a simple consent banner so analytics and session replay only load after the visitor accepts. Keep strictly necessary cookies working without consent, and remember the visitor's choice.
Checkout termsRewrite my subscribe step so the auto-renewal terms (price, billing period, renews until cancelled, how to cancel) sit right next to the subscribe button, add a consent checkbox that isn't pre-ticked, and send a confirmation email with the terms and a cancel link.
