Americas · 12 laws · 44 requirements
United States (federal): the laws your website or app must follow
If your customers are in United States (federal), these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
FTC Act §5
In force.
Who it covers: Most businesses dealing with US consumers.
What it requires of a website or app (8)
- The privacy notice is accurate: it matches the data the product collects and the services it usesChecked§5 (deception)
- Reasonable data securityChecked§5 (unfairness)
- Claims are truthful and substantiated (no unsupported 'guaranteed', '#1', health claims)Checked§5; 16 CFR 255
- Endorsements and testimonials reflect real experience and disclose material connections; no fake reviewsAI review16 CFR 255; 16 CFR 465 (2024)
- AI claims are accurate and AI use isn't hidden where it matters (if if the product uses AI)Checked§5
- Subscriptions: clear terms before billing, express consent, simple cancellation (if if you sell subscriptions)CheckedROSCA 15 U.S.C. §8403
- Reviews: no fake, bought or AI-written reviews, no review suppression, and paid reviews disclosed (if if you show reviews or testimonials)AI review16 CFR 465 (Trade Regulation Rule on Consumer Reviews and Testimonials)
- Investment and earnings claims are truthful and come with the risks (if if you promote investments or earnings)Checked§5
Sources:FTC business guidance
COPPA
Amended rule in force 23 June 2025; full compliance required from 22 April 2026.
Who it covers: Services directed to children under 13, or with actual knowledge they collect from under-13s.
What it requires of a website or app (6)
- Verifiable parental consent before collecting children's personal information (if if children under 13 use the product)Your answers16 CFR 312.5
- Separate parental consent before disclosing children's data to third parties, including for targeted ads (if if children under 13 use the product)Your answers312.5(a)(2) (2025)
- A notice naming the third parties (or categories) that receive children's data (if if children under 13 use the product)Checked312.4
- A written data retention policy, published in the notice; delete when no longer needed (if if children under 13 use the product)Prepared312.10
- A written information security program with annual risk assessments (if if children under 13 use the product)Prepared312.8
- Parents can review and delete their child's dataYour answers312.6
Sources:COPPA Rule (eCFR)
ADA Title III
In force.
Who it covers: Businesses open to the public, including many websites and apps.
What it requires of a website or app (3)
- Images have text alternatives; form fields have labels; the page language is setCheckedWCAG 2.1 AA 1.1.1, 1.3.1, 3.1.1
- Keyboard access, visible focus, colour contrast, captions for videoCheckedWCAG 2.1 AA
- A way for users to report access barriersCheckedDOJ guidance
Sources:DOJ web accessibility guidance
CAN-SPAM
In force.
Who it covers: Anyone sending commercial email.
What it requires of a website or app (3)
- Accurate sender and subject lines; the message is identified as an ad where required (if if you send marketing emails)Your answers15 U.S.C. §7704(a)(1)–(2), (5)
- A working unsubscribe, honoured within 10 business days (if if you send marketing emails)Your answers§7704(a)(3)–(4)
- A valid physical postal address in every message (if if you send marketing emails)Prepared§7704(a)(5)(A)(iii)
Sources:FTC CAN-SPAM guide
HIPAA (if health data)
In force.
Who it covers: Covered entities (providers, plans, clearinghouses) and their business associates.
What it requires of a website or app (5)
- Health information is collected only with appropriate consent and safeguards (if if you handle health data)Your answers45 CFR 164.502; FTC HBNR
- Business associate agreements with every vendor touching PHI (hosting, email, analytics, AI) (if if you're a covered entity or business associate)Prepared45 CFR 164.504(e)
- No tracking pixels on pages with PHI without a BAA (HHS guidance) (if if you handle health data)CheckedHHS tracking-technologies guidance
- Security Rule safeguards and a risk analysis (if if HIPAA applies)Prepared45 CFR 164.308–316
- Breach notification to individuals, HHS (or the FTC for non-HIPAA health apps) (if if you handle health data)Checked45 CFR 164.400–414; 16 CFR 318
Sources:HHS HIPAA for professionals
GLBA (if financial)
In force.
Who it covers: Financial institutions, including non-bank lenders, brokers, fintechs and tax preparers.
What it requires of a website or app (3)
- A privacy notice explaining what financial data is shared and how to opt out (if if you're a financial institution)AI reviewPrivacy Rule, 16 CFR 313
- A written information security program: risk assessment, MFA, encryption, a qualified individual (if if you're a financial institution)CheckedSafeguards Rule, 16 CFR 314.4
- Report security events involving 500+ consumers to the FTC within 30 days (if if you're a financial institution)Checked16 CFR 314.4(j)
Sources:FTC Safeguards Rule
ROSCA (online subscriptions)
In force since 2010.
Who it covers: Sellers charging US consumers through negative-option (automatically renewing) online plans.
What it requires of a website or app (3)
- All material terms are disclosed clearly before billing information is collected (if if you sell subscriptions)Checked15 U.S.C. §8403(1)
- Express informed consent to the charge before billing (if if you sell subscriptions)Checked15 U.S.C. §8403(2)
- A simple way to stop recurring charges (if if you sell subscriptions)Checked15 U.S.C. §8403(3)
Sources:15 U.S.C. §8403 (Cornell LII)
DMCA §512 (copyright safe harbour)
In force.
Who it covers: Services that host material users upload.
What it requires of a website or app (2)
- A designated agent registered with the Copyright Office, with contact details published on the site (if if users can post content)Checked17 U.S.C. §512(c)(2)
- Takedown on valid notice, counter-notices, and a repeat-infringer policy (if if users can post content)AI review17 U.S.C. §512(c), (g), (i)
18 U.S.C. §2257 & PACT Act (adult content and tobacco sales)
In force.
Who it covers: Producers of sexually explicit content, and sellers of cigarettes, vapes and other tobacco products delivered to US buyers.
What it requires of a website or app (3)
- Age and identity records for every performer, and a §2257 statement on the site (if if you produce sexually explicit content)AI review18 U.S.C. §2257 & §2257A; 28 CFR 75
- Online tobacco and vape sales: age verification at order and an adult signature with ID on delivery (if if you sell tobacco or vapes)Checked15 U.S.C. §376a (PACT Act)
- Nicotine product ads carry the FDA warning statement (if if you sell nicotine products)Checked21 CFR 1143.3
Sources:18 U.S.C. §2257 (Cornell LII) 15 U.S.C. §376a (Cornell LII)
Video Privacy Protection Act
In force since 1988.
Who it covers: Businesses that deliver prerecorded video to people, including on their own websites and apps.
What it requires of a website or app (2)
- Don't send which videos someone watched, with something that identifies them, to ad platforms (for example the Meta Pixel on video pages) without separate, informed consent (if if you offer prerecorded video)Checked18 U.S.C. §2710(b)(2)(B)
- Delete video-viewing records once they're no longer needed, and within a year (if if you offer prerecorded video)AI review18 U.S.C. §2710(e)
Sources:18 U.S.C. §2710
TCPA (calls and texts)
In force; people can sue for $500–$1,500 per message.
Who it covers: Anyone who sends marketing texts or makes marketing calls to US phone numbers.
What it requires of a website or app (3)
- Prior express written consent before marketing texts or automated calls, with a clear disclosure next to the phone field (if if you send marketing texts or calls)Checked47 C.F.R. §64.1200(a)(2) & (f)(9)
- Honour STOP and any reasonable way of withdrawing consent, within 10 business days (if if you send marketing texts or calls)AI review47 C.F.R. §64.1200(a)(10)
- Calling hours (8am–9pm local) and the National Do Not Call Registry for telemarketing (if if you send marketing texts or calls)AI review47 C.F.R. §64.1200(c)
Sources:47 C.F.R. §64.1200
TAKE IT DOWN Act (nonconsensual intimate images)
Pub.
Who it covers: Websites and apps that serve the public and mainly host user-generated content, or that regularly host nonconsensual intimate images. Email, internet providers and sites of the provider's own content with only incidental comments are excluded.
What it requires of a website or app (3)
- A process for a person (or someone acting for them) to notify you of an intimate image of them posted without consent, including AI-generated ones, and ask for its removal (if if users can upload or share images or video)AI reviewPub. L. 119-12 §3(a)(1) (47 U.S.C. §223a)
- A clear and conspicuous notice, in plain language, on the platform explaining the process and how to submit a request (if if users can upload or share images or video)AI review§3(a)(2)
- Remove a valid request, and reasonable efforts to remove known identical copies, as soon as possible and within 48 hours (if if users can upload or share images or video)AI review§3(a)(3)
Sources:Public Law 119-12 (govinfo) 47 U.S.C. §223a (Cornell LII)
Licensed professionals in United States (federal)
These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.
- doctors and surgeonsAMA Code of Medical Ethics Opinion 9.6.1 (advertising and publicity)
- professional engineersNCEES Model Rules of Professional Conduct (engineers)
- surveyorsNCEES Model Rules of Professional Conduct (surveyors)
- accountants and auditorsAICPA Code of Professional Conduct (advertising and solicitation)
- financial advisersSEC Marketing Rule (17 CFR 275.206(4)-1) and FINRA Rule 2210
Check your site against United States (federal)'s rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.