Start your analysisGet started
[ Compliance for businesses that sell online ]

Know which laws apply to you.And what to fix first.

Smartsteps reads your privacy policy, terms and cookie notice against every obligation of every law in the markets you sell into, checks what your website really does, and keeps watching as the law changes. Made for the people who run the business, not for lawyers.

Start your analysis Free practice check

The free check answers one question in a few minutes: is the way you use AI and messaging tools on client data OK? No account, and nothing you type is stored.

Laws in the library
695
Jurisdictions
60
Obligations, checked one by one
3,842
Judged against the law's own words
3,652
Tools and apps in the library
23
[ Who it's for ]

You run the business. You shouldn't need a law degree to sell online.

Each of these worries starts the same way: someone outside the business asks a question you can't answer yet. Here is the worry, and the law that sits behind it.

  • E-commerce shops

    A demand letter says your checkout doesn't work with a screen reader.

    Law behind itADA Title III (web)EAA
  • SaaS and subscriptions

    A customer disputes a renewal charge and asks where they agreed to it.

    Law behind itROSCACalOPPA / CA ARL
  • Agencies

    A client asks “is our site GDPR-OK?”, and you're the one who built it.

    Law behind itGDPRePrivacy cookiesUK PECR
  • Clinics and therapists

    Your booking page loads an ad pixel, and nobody knows what it sends.

    Law behind itHIPAAGDPR
  • Accountants and law firms

    Client files pass through AI and messaging apps whose terms nobody has read.

    Law behind itUK GDPR / DPA 2018PIPEDA
  • App developers

    Children download your app, and the sign-up form asks for more than it needs.

    Law behind itCOPPADPDP Act / Rules
[ What goes wrong ]

The problems are usually small, specific and fixable.

Most trouble starts with something nobody on the team noticed. Here are four things Smartsteps looks for on every site, and the obligation each one breaks.

[ Cookies ]

Analytics cookies set before anyone clicks “Accept”.

GET / · banner not answered yet_ga, _gid set at page load

Our browser loads your pages without touching the banner and records every cookie and tracker that fires anyway.

Obligation
Reg. 6 — Consent before storing or accessing information on the user's device UK PECR · PECR reg. 6(1)–(2); UK GDPR Art. 4(11); ICO storage and access technologies guidance
Ceiling in the record
Up to GBP 17.5 million or 4% of worldwide annual turnover
[ Subscriptions ]

A trial that renews without its own consent step.

/checkout · renewal terms only inside Termsno separate box for the recurring charge

We walk your sign-up flow and check that the recurring terms are shown, and agreed to, before billing details are taken.

Obligation
Obtain the consumer's express informed consent to the negative option before charging ROSCA · 15 U.S.C. § 8403(2)
Ceiling in the record
Civil penalty of up to USD 53,088 per violation
[ Privacy policy ]

No privacy policy link on the homepage.

/ footer links: Shipping, Returns, Contactno link to a privacy policy found

We read the links on your homepage and every page we visit, and find your policies whether they are linked or not.

Obligation
Conspicuously post a privacy policy linked from the homepage CalOPPA / CA ARL · Cal. Bus. & Prof. Code § 22575(a); § 22577(b)
Ceiling in the record
Civil penalties of up to USD 2,500 per violation under the Unfair Competition Law
[ Health ]

An ad pixel on a clinic's booking page.

/book-appointmentconnect.facebook.net · 3 third-party trackers

We list every third-party tracker by page. For a clinic, that list starts the HIPAA question: a vendor that receives patient information needs a business associate agreement first.

Obligation
Have a written business associate agreement before giving a vendor protected health information HIPAA · 45 CFR § 164.502(e); § 164.504(e)
Ceiling in the record
Civil money penalties in four culpability tiers, up to about USD 2.1 million per violation category per calendar year

Ceilings are the maximum penalties as our law records state them, not predictions. Most findings end in a fix, not a fine. Example lines are illustrative.

[ How it works ]

Three steps. About fifteen minutes of your time.

You answer plain questions and point us at your site. We do the reading, and email you when the report is ready.

  1. Tell us about the business, and where you sell

    About fifteen plain questions: what you sell, roughly how big you are, what data you collect, how you market. Then tick every market: countries, US states, EU member states, Canadian provinces. “Don't know” is always a valid answer, and we tell you which answers would sharpen the result.

  2. Add your website and your policies

    Paste a link, upload a PDF or Word file, or let us find your policy pages for you: privacy policy, terms, cookie notice, refund policy, accessibility statement, imprint.

  3. We read every clause, check the live site, and keep watching

    Each obligation of each law that applies is checked against your actual wording, then a second model argues the opposite reading. A real browser visits your site before and after consent, with and without privacy signals. Every month, and when a law you are under changes, your standing is checked again.

[ Try it ]

Which laws apply to you?

Tick where you sell and what you do. The answer comes from the same 695 law records and applicability rules the full analysis uses, worked out in your browser. Nothing is sent anywhere.

Where do you sell?
About your business
Laws that apply
289
Their obligations
1511
May also apply
347

Applies on these answers

  • UK PECRUnited Kingdom · Cookies15 obligations
  • UK GDPR / DPA 2018United Kingdom · Privacy19 obligations
  • ADA Title III (web)United States · Accessibility15 obligations
  • AK breach lawAlaska · Breach6 obligations
  • AK SSN and disposal rulesAlaska · Privacy5 obligations
  • Alaska spyware lawAlaska · Consumer terms2 obligations
  • AK telephone solicitationAlaska · Marketing8 obligations
  • AK UETAAlaska · E-commerce4 obligations
  • Alaska unordered merchandiseAlaska · Consumer terms1 obligations
  • Alaska UTPAAlaska · Consumer terms6 obligations
  • AL admission ticketsAlabama · Consumer terms2 obligations
  • AL App Store Accountability ActAlabama · Children7 obligations
  • AL breach lawAlabama · Breach10 obligations
  • AL DTPAAlabama · Consumer terms7 obligations
  • AL UETAAlabama · E-commerce4 obligations
  • AR Deceptive Trade Practices ActArkansas · Consumer terms4 obligations
  • AR Fair Gift Card ActArkansas · Consumer terms2 obligations
  • AR Personal Information Protection ActArkansas · Breach7 obligations
  • AR UETAArkansas · E-commerce3 obligations
  • AZ breach lawArizona · Breach8 obligations
  • AZ Consumer Fraud ActArizona · Consumer terms5 obligations
  • AZ gift card, restocking fee and unordered goods rulesArizona · Consumer terms4 obligations
  • AZ spyware lawArizona · Privacy5 obligations
  • AZ ticket bot and resale lawArizona · Consumer terms4 obligations
  • AZ UETAArizona · E-commerce4 obligations
  • BOTS ActUnited States · Consumer terms3 obligations
  • CalOPPA / CA ARLCalifornia · Consumer terms19 obligations
  • CIPACalifornia · Privacy4 obligations
  • CLRACalifornia · Consumer terms8 obligations
  • Connected TVs and devicesCalifornia · Privacy6 obligations
  • CA breach lawCalifornia · Breach10 obligations
  • CA Digital Age Assurance ActCalifornia · Children5 obligations
  • CA e-commerce disclosuresCalifornia · E-commerce6 obligations
  • CA gift card lawCalifornia · Consumer terms5 obligations
  • CA IoT security lawCalifornia · Privacy3 obligations
  • CA minors digital rightsCalifornia · Children6 obligations
  • Reader Privacy ActCalifornia · Privacy4 obligations
  • Song-Beverly Credit Card ActCalifornia · Consumer terms3 obligations
  • UCL / FALCalifornia · Consumer terms7 obligations
  • CA UETACalifornia · E-commerce3 obligations
  • Unruh Act / DPACalifornia · Accessibility3 obligations
  • Colorado CCPA (consumer protection)Colorado · Consumer terms8 obligations
  • Colorado breach and security lawColorado · Breach8 obligations
  • Colorado junk fee lawColorado · Consumer terms4 obligations
  • Colorado gift card lawColorado · Consumer terms3 obligations
  • CO UETAColorado · E-commerce5 obligations
  • CRFAUnited States · Consumer terms4 obligations
  • CT algorithmic pricing disclosureConnecticut · Consumer terms1 obligations
  • CT breach lawConnecticut · Breach8 obligations
  • CT call recordingConnecticut · Privacy3 obligations
  • CUTPAConnecticut · Consumer terms15 obligations
  • CT gift certificatesConnecticut · Consumer terms4 obligations
  • CT SSN lawConnecticut · Privacy5 obligations
  • CT telemarketingConnecticut · Marketing8 obligations
  • CT ticket resale lawConnecticut · Consumer terms2 obligations
  • CT UETAConnecticut · E-commerce4 obligations
  • DC breach lawDistrict of Columbia · Breach9 obligations
  • DC consumer ID information lawDistrict of Columbia · Privacy2 obligations
  • DC CPPADistrict of Columbia · Consumer terms8 obligations
  • DC Human Rights Act (public accommodations)District of Columbia · Accessibility4 obligations
  • DC UETADistrict of Columbia · E-commerce4 obligations
  • DE breach lawDelaware · Breach7 obligations
  • DE CFA / DTPADelaware · Consumer terms5 obligations
  • DOPPADelaware · Privacy7 obligations
  • DE UETADelaware · E-commerce5 obligations
  • DMCA § 512United States · Platforms7 obligations
  • ECPA (Wiretap Act and SCA)United States · Privacy7 obligations
  • EFTA / Regulation EUnited States · Consumer terms7 obligations
  • E-SIGN ActUnited States · E-commerce6 obligations
  • FIPA (Florida breach law)Florida · Breach6 obligations
  • FDUTPAFlorida · Consumer terms3 obligations
  • Florida gift card lawFlorida · Consumer terms1 obligations
  • FL Security of Communications ActFlorida · Privacy6 obligations
  • FL UETAFlorida · E-commerce4 obligations
  • FTC Act § 5United States · Consumer terms7 obligations
  • FTC pricing and advertising guidesUnited States · Consumer terms13 obligations
  • FTC Reviews Rule and Endorsement GuidesUnited States · Consumer terms11 obligations
  • Georgia FBPAGeorgia · Consumer terms5 obligations
  • Georgia SSN protection and records disposalGeorgia · Privacy2 obligations
  • GA UETAGeorgia · E-commerce4 obligations
  • HI breach lawHawaii · Breach5 obligations
  • HI digital accessibility (Act 257)Hawaii · Accessibility2 obligations
  • HI smart security device data (Act 253)Hawaii · Privacy2 obligations
  • HI SSN and disposal rulesHawaii · Privacy3 obligations
  • HI junk-fee rule (Act 254)Hawaii · Consumer terms3 obligations
  • Hawaii UDAPHawaii · Consumer terms3 obligations
  • HI UETAHawaii · E-commerce4 obligations
  • HRS ch. 481BHawaii · Consumer terms9 obligations
  • IA breach lawIowa · Breach5 obligations
  • Iowa Consumer Fraud ActIowa · Consumer terms6 obligations
  • IA UETAIowa · E-commerce5 obligations
  • Idaho breach lawIdaho · Breach6 obligations
  • Idaho CPAIdaho · Consumer terms11 obligations
  • Idaho telemarketing lawIdaho · Marketing7 obligations
  • ID UETAIdaho · E-commerce5 obligations
  • Ill. Consumer Fraud ActIllinois · Consumer terms4 obligations
  • IL Electronic Commerce Security ActIllinois · E-commerce2 obligations
  • Ill. PIPA (breach, security, disposal)Illinois · Breach10 obligations
  • Ill. Restricted Call Registry ActIllinois · Marketing2 obligations
  • Ill. Right of Publicity ActIllinois · AI disclosure3 obligations
  • Ill. telemarketing lawsIllinois · Marketing8 obligations
  • Ill. Ticket Sale and Resale ActIllinois · Consumer terms6 obligations
  • Indiana breach and disposal lawsIndiana · Breach7 obligations
  • Indiana DCSAIndiana · Consumer terms3 obligations
  • IN UETAIndiana · E-commerce4 obligations
  • Junk Fees RuleUnited States · Consumer terms4 obligations
  • KS breach lawKansas · Breach4 obligations
  • KCPAKansas · Consumer terms6 obligations
  • KS gift card lawKansas · Consumer terms3 obligations
  • KS data security, disposal and card privacyKansas · Privacy4 obligations
  • KS UETAKansas · E-commerce4 obligations
  • KY Consumer Protection ActKentucky · Consumer terms4 obligations
  • KY breach and disposal lawKentucky · Breach6 obligations
  • KY gift card lawKentucky · Consumer terms3 obligations
  • KY True Origin of Digital Goods ActKentucky · E-commerce2 obligations
  • KY UETAKentucky · E-commerce4 obligations
  • LA App Store Accountability ActLouisiana · Children5 obligations
  • LA breach lawLouisiana · Breach6 obligations
  • LA gift certificatesLouisiana · Consumer terms3 obligations
  • LUTPALouisiana · Consumer terms3 obligations
  • LA UETALouisiana · E-commerce4 obligations
  • MA breach lawMassachusetts · Breach7 obligations
  • Chapter 93AMassachusetts · Consumer terms3 obligations
  • c. 93 § 105Massachusetts · Privacy3 obligations
  • Chapter 93IMassachusetts · Privacy3 obligations
  • 201 CMR 17.00Massachusetts · Privacy1 obligations
  • MA gift certificatesMassachusetts · Consumer terms4 obligations
  • 940 CMR 38.00Massachusetts · Consumer terms7 obligations
  • c. 214 §§ 1B, 3AMassachusetts · Privacy2 obligations
  • MA ticket resale lawMassachusetts · Consumer terms2 obligations
  • MA UETAMassachusetts · E-commerce4 obligations
  • Made in USA RuleUnited States · Consumer terms4 obligations
  • Magnuson-Moss Warranty ActUnited States · E-commerce6 obligations
  • Mail Order RuleUnited States · E-commerce7 obligations
  • MD consumer contract termsMaryland · Consumer terms5 obligations
  • Md. CPAMaryland · Consumer terms8 obligations
  • Md. gift cardsMaryland · Consumer terms6 obligations
  • Md. PIPA (breach, security, disposal)Maryland · Breach9 obligations
  • Maryland TCPAMaryland · Marketing3 obligations
  • Md. UETAMaryland · E-commerce4 obligations
  • Maine breach lawMaine · Breach7 obligations
  • Maine lodging and ticket price lawMaine · Consumer terms3 obligations
  • Maine SSN lawMaine · Privacy2 obligations
  • Maine UETAMaine · E-commerce4 obligations
  • Maine UTPAMaine · Consumer terms8 obligations
  • Mich. breach notificationMichigan · Breach7 obligations
  • Mich. CPAMichigan · Consumer terms12 obligations
  • Mich. PPPAMichigan · Privacy2 obligations
  • Mich. telephone solicitation lawMichigan · Marketing7 obligations
  • MI UETAMichigan · E-commerce4 obligations
  • MN Consumer Fraud ActMinnesota · Consumer terms4 obligations
  • MN breach lawMinnesota · Breach5 obligations
  • MN UDTPA and junk fee lawMinnesota · Consumer terms6 obligations
  • MN gift certificate lawMinnesota · Consumer terms3 obligations
  • MN Plain Language Contract ActMinnesota · Consumer terms3 obligations
  • MN UETAMinnesota · E-commerce4 obligations
  • Mo. buyers clubs and unsolicited goodsMissouri · Consumer terms4 obligations
  • MO breach lawMissouri · Breach5 obligations
  • Missouri MPAMissouri · Consumer terms4 obligations
  • MO no-call lawMissouri · Marketing5 obligations
  • MO UETAMissouri · E-commerce4 obligations
  • MS breach lawMississippi · Breach3 obligations
  • MS Consumer Protection ActMississippi · Consumer terms4 obligations
  • MS UETAMississippi · E-commerce4 obligations
  • MT breach lawMontana · Breach6 obligations
  • MT Consumer Protection ActMontana · Consumer terms4 obligations
  • MT recording consentMontana · Privacy2 obligations
  • MT UETAMontana · E-commerce4 obligations
  • NC Identity Theft Protection ActNorth Carolina · Breach8 obligations
  • NC UDTPANorth Carolina · Consumer terms6 obligations
  • NC UETANorth Carolina · E-commerce7 obligations
  • ND breach lawNorth Dakota · Breach4 obligations
  • ND consumer fraud lawNorth Dakota · Consumer terms7 obligations
  • ND data processing confidentialityNorth Dakota · Privacy1 obligations
  • ND gift certificate lawNorth Dakota · Consumer terms2 obligations
  • ND UETANorth Dakota · E-commerce4 obligations
  • NE breach lawNebraska · Breach6 obligations
  • NE Consumer Protection ActNebraska · Consumer terms3 obligations
  • Neb. Telemarketing and Prize Promotions ActNebraska · Marketing6 obligations
  • NE UDTPANebraska · Consumer terms8 obligations
  • NE UETANebraska · E-commerce4 obligations
  • NH breach lawNew Hampshire · Breach5 obligations
  • NH CPANew Hampshire · Consumer terms5 obligations
  • NH telemarketing lawNew Hampshire · Marketing5 obligations
  • NH UETANew Hampshire · E-commerce4 obligations
  • NJ breach notificationNew Jersey · Breach6 obligations
  • NJ Consumer Fraud ActNew Jersey · Consumer terms11 obligations
  • NJ gift card lawNew Jersey · Consumer terms7 obligations
  • NJ SSN display and records disposalNew Jersey · Privacy3 obligations
  • NJ TCCWNANew Jersey · Consumer terms3 obligations
  • NJ UETANew Jersey · E-commerce5 obligations
  • NM Data Breach Notification ActNew Mexico · Breach8 obligations
  • NM UETANew Mexico · E-commerce4 obligations
  • NM Unfair Practices ActNew Mexico · Consumer terms9 obligations
  • Nevada DTPANevada · Consumer terms11 obligations
  • Nevada online privacy lawNevada · Privacy4 obligations
  • Nevada NRS 603A security and breachNevada · Breach6 obligations
  • Nevada telephone sellers lawNevada · Marketing6 obligations
  • NV UETANevada · E-commerce5 obligations
  • NY breach notification (GBL § 899-aa)New York · Breach9 obligations
  • NY ESRANew York · E-commerce4 obligations
  • NY GBL §§ 349-350New York · Consumer terms6 obligations
  • NY gift card lawNew York · Consumer terms5 obligations
  • NYSHRL public accommodation (website accessibility)New York · Accessibility3 obligations
  • NY mail and online order shipping rulesNew York · E-commerce5 obligations
  • NY record disposal lawNew York · Privacy2 obligations
  • NY likeness, digital replica and synthetic performer rulesNew York · AI disclosure3 obligations
  • NY SHIELD data securityNew York · Privacy5 obligations
  • NY ticket all-in pricing and botsNew York · Consumer terms4 obligations
  • Ohio breach notificationOhio · Breach4 obligations
  • Ohio CSPAOhio · Consumer terms8 obligations
  • Ohio Data Protection ActOhio · Privacy2 obligations
  • Ohio gift cardsOhio · Consumer terms1 obligations
  • Ohio Telephone Solicitation Sales ActOhio · Marketing7 obligations
  • OH UETAOhio · E-commerce5 obligations
  • OK Security Breach Notification ActOklahoma · Breach6 obligations
  • OK Consumer Protection ActOklahoma · Consumer terms9 obligations
  • OK gift card actOklahoma · Consumer terms5 obligations
  • OK INFORM ActOklahoma · E-commerce7 obligations
  • OK ticket bot banOklahoma · Consumer terms2 obligations
  • OK UETAOklahoma · E-commerce4 obligations
  • Oregon CIPAOregon · Breach9 obligations
  • Oregon gift card lawOregon · Consumer terms3 obligations
  • Oregon shipping disclosure lawOregon · E-commerce2 obligations
  • OR UETAOregon · E-commerce4 obligations
  • Oregon UTPAOregon · Consumer terms10 obligations
  • PA breach notificationPennsylvania · Breach8 obligations
  • PA Plain Language Consumer Contract ActPennsylvania · Consumer terms3 obligations
  • PA ETAPennsylvania · E-commerce6 obligations
  • PA UTPCPLPennsylvania · Consumer terms8 obligations
  • PA Wiretap Act (all-party consent)Pennsylvania · Privacy4 obligations
  • RI DTPARhode Island · Consumer terms7 obligations
  • RI document destruction lawRhode Island · Privacy1 obligations
  • RIDTPPARhode Island · Privacy9 obligations
  • RI breach lawRhode Island · Breach6 obligations
  • RI telephone sales solicitation lawRhode Island · Marketing7 obligations
  • RI UETARhode Island · E-commerce4 obligations
  • SC breach lawSouth Carolina · Breach4 obligations
  • SC gift certificatesSouth Carolina · Consumer terms2 obligations
  • SC SSN protection and disposalSouth Carolina · Privacy4 obligations
  • SC UETASouth Carolina · E-commerce3 obligations
  • SCUTPASouth Carolina · Consumer terms4 obligations
  • SD breach lawSouth Dakota · Breach5 obligations
  • SD Deceptive Trade Practices ActSouth Dakota · Consumer terms7 obligations
  • SD UETASouth Dakota · E-commerce4 obligations
  • TN breach and SSN lawTennessee · Breach5 obligations
  • Tennessee Consumer Protection ActTennessee · Consumer terms2 obligations
  • TN UETATennessee · E-commerce4 obligations
  • Texas App Store Accountability ActTexas · Children8 obligations
  • Texas breach notification (ITEPA)Texas · Breach6 obligations
  • Texas card surcharge banTexas · Consumer terms1 obligations
  • Texas DTPATexas · Consumer terms8 obligations
  • Texas gift card lawTexas · Consumer terms3 obligations
  • Texas SSN protection and records disposalTexas · Privacy4 obligations
  • TX UETATexas · E-commerce4 obligations
  • Utah App Store ActUtah · Children5 obligations
  • Utah CSPAUtah · Consumer terms7 obligations
  • Utah cybersecurity safe harbourUtah · Breach3 obligations
  • Utah breach lawUtah · Breach4 obligations
  • Utah ticket transferability lawUtah · Consumer terms4 obligations
  • Utah ticket website lawUtah · Consumer terms7 obligations
  • UT UETAUtah · E-commerce4 obligations
  • Va. breach notificationVirginia · Breach8 obligations
  • Va. comparison pricingVirginia · Consumer terms4 obligations
  • Va. gift certificatesVirginia · Consumer terms3 obligations
  • Va. junk fee lawVirginia · Consumer terms4 obligations
  • Va. PIPA (SSN and purchaser information)Virginia · Privacy6 obligations
  • Va. right of publicityVirginia · Marketing2 obligations
  • Va. UETAVirginia · E-commerce4 obligations
  • VCPAVirginia · Consumer terms10 obligations
  • Vermont CPAVermont · Consumer terms11 obligations
  • Vermont breach lawVermont · Breach11 obligations
  • VT UETAVermont · E-commerce5 obligations
  • WA breach notificationWashington · Breach7 obligations
  • WA spyware lawWashington · Privacy5 obligations
  • WA CPAWashington · Consumer terms4 obligations
  • WA rebate lawWashington · Consumer terms3 obligations
  • WA gift card lawWashington · Consumer terms3 obligations
  • WA UETAWashington · E-commerce4 obligations
  • Wisconsin breach lawWisconsin · Breach8 obligations
  • Wisconsin DTPAWisconsin · Consumer terms7 obligations
  • WI UETAWisconsin · E-commerce4 obligations
  • WVCCPA consumer protection articleWest Virginia · Consumer terms6 obligations
  • WV breach notification lawWest Virginia · Breach6 obligations
  • WV electronic transactions consumer protectionsWest Virginia · E-commerce2 obligations
  • WV UETAWest Virginia · E-commerce4 obligations
  • WY breach lawWyoming · Breach5 obligations
  • Wyoming CPAWyoming · Consumer terms7 obligations
  • WY UETAWyoming · E-commerce4 obligations

May apply, depending on details below up to 1816 more obligations

  • AL adult-site age verificationAlabama · PlatformsDepends on your sector
  • AL Genetic Data Privacy ActAlabama · PrivacyDepends on the kinds of data you collect
  • AL Personal Data Protection ActAlabama · PrivacyDepends on users in that market, whether you sell or share data, headcount
  • AL sweepstakes solicitationsAlabama · MarketingDepends on email, SMS or phone marketing

This is a preview from our law records. The full analysis asks about fifteen questions (revenue, users per market, the data you collect, how you market) and settles every “may apply”.

Start your analysis
[ What you get ]

Where you stand, the evidence, and the fix.

Four things every Smartsteps workspace gives you, from the first report onward.

[ 01 · Standing report ]

Where you stand, market by market.

One score per jurisdiction, green, amber or red, with the findings that drive it ranked by real exposure. Covers privacy, cookies, marketing, minors, accessibility, consumer terms and AI disclosure. Every finding cites the section of law, the clause it rests on, and the evidence.

[ 02 · Live-site evidence ]

What your website does, not what it says.

Cookies set before anyone clicks, trackers that keep firing after “reject”, forms collecting data without notice, sign-up flows that skip the consent step. Four separate browser visits per region, with the exact cookie, domain and page, and screenshots of your banner before and after each choice.

[ 03 · Fixes ]

Replacement wording, in your policy's own voice.

Not “consider reviewing your policy”. The clause to add or change, written to match how your policy already reads, or the exact banner setting or site change. Mark each fix done, accept a risk with a note, or reopen it. Every suggestion is marked for review before you publish.

[ 04 · Monitoring ]

A standing that stays current.

Laws move. Your site changes every week. On paid plans with monitoring, Smartsteps runs a fresh crawl and re-check every month and sends one email with your standing. When a law you are under changes, it is reviewed and you are checked against it. Everything else waits on your dashboard, so there is no alert fatigue.

[ The law library ]

Built on the law's own words, not a model's memory.

Each law is a record we maintain: who it applies to, every obligation in plain language, the penalties, and links to the official text. We also store the text itself. When an obligation rests on a stored section, the model reads that section next to your wording before it decides.

Laws, each a maintained record
695
Official sources stored, split by section
852
Of 3842 obligations judged against the stored text
95%
Day of the month we re-fetch every source
1st

On the first of every month we fetch every stored source again and compare it section by section. A changed section is flagged with the obligations that rest on it, and a person reviews it before the library changes. Monthly re-checks run an hour later, against the same library.

For the other 5% of obligations, where the official text could not be stored, the model works from our plain-language summary of the obligation, checked against the official text. Where the text is stored, your finding shows it under “The law's own words”.

  • Privacy Act / APPs
  • Spam Act
  • LGPD
  • CASL
  • PIPEDA
  • Quebec Law 25
  • TDDDG § 25 / DDG § 5
  • EAA
  • EU AI Act (Art. 50)
  • DSA (basics)
  • ePrivacy cookies
  • GDPR
  • UK PECR
  • UK GDPR / DPA 2018
  • DPDP Act / Rules
  • ADA Title III (web)
  • AK free trials and opt-out plans
  • AK breach law
  • AK SSN and disposal rules
  • Alaska spyware law
  • AK telephone solicitation
  • AK UETA
  • Alaska unordered merchandise
  • Alaska UTPA
  • AL admission tickets
  • AL adult-site age verification
  • AL App Store Accountability Act
  • AL breach law
  • AL DTPA
  • AL Genetic Data Privacy Act
  • AL Personal Data Protection Act
  • AL sweepstakes solicitations
  • AL telemarketing and do-not-call
  • AL UETA
  • AR adult-site age verification
  • AR automatic renewal law
  • AR commercial email act
  • AR Children and Teens' Online Privacy Protection Act
  • AR Deceptive Trade Practices Act
  • AR employee social media privacy
  • AR Fair Gift Card Act
  • AR Personal Information Protection Act
  • AR prize promotions
  • AR Social Media Safety Act (enjoined)
  • AR SSN protection
  • AR SOPIPA
  • AR telemarketing laws
  • AR UETA
  • AZ adult-site age verification
  • AZ breach law
  • AZ child-directed app ads law
  • AZ commercial email law
  • AZ Consumer Fraud Act
  • AZ genetic testing privacy
  • AZ dating services law
  • AZ SSN, disposal and ID-scan rules
  • AZ gift card, restocking fee and unordered goods rules
  • AZ spyware law
  • AZ student data privacy
  • AZ telephone solicitation law
  • AZ ticket bot and resale law
  • AZ UETA
  • BOTS Act
  • CA AADC
  • AB 489 AI health advice
  • CA AB 2013
  • CA AI Transparency Act
  • CA anti-spam law
  • CA bot disclosure law
  • CalOPPA / CA ARL
  • CCPA/CPRA
  • CIPA
  • CLRA
  • CMIA (digital health)
  • CA SB 243
  • Connected TVs and devices
  • CA contests and sweepstakes
  • CRD ADS employment regulations
  • CA breach law
  • Delete Act
  • CA Digital Age Assurance Act
  • CA e-commerce disclosures
  • CA employee social media privacy
  • CA junk fax
  • CA gift card law
  • CA GIPA
  • CA AB 45 geofencing law
  • CA IoT security law
  • CA minors digital rights
  • CA INFORM / marketplaces law
  • Reader Privacy Act
  • Shine the Light
  • CA SB 976 / AB 56
  • CA social media platform duties
  • Song-Beverly Credit Card Act
  • SOPIPA / ELPIPA
  • CA SSN law
  • CA telemarketing
  • UCL / FAL
  • CA UETA
  • Unruh Act / DPA
  • CAN-SPAM
  • Colorado ADMT law
  • Colorado ARL
  • Colorado commercial email law
  • Colorado CCPA (consumer protection)
  • Colorado chatbot law
  • CPA (Colorado)
  • Colorado breach and security law
  • Colorado junk fee law
  • CO employee social media privacy
  • Colorado gift card law
  • Colorado child influencer law
  • Colorado no-call law
  • Colorado online dating safety
  • Colorado online marketplace law
  • Colorado social media warnings
  • Colorado student data act
  • Colorado ticket law
  • CO UETA
  • COPPA
  • CRFA
  • CT algorithmic pricing disclosure
  • CT auto-renewal law
  • CT breach law
  • CT call recording
  • CTDPA
  • CUTPA
  • CT data broker registration
  • CT monitoring notice
  • CT junk fax and ADV email
  • CT gift certificates
  • CT dating and social media duties
  • CT SSN law
  • CT student data privacy
  • CT telemarketing
  • CT ticket resale law
  • CT UETA
  • DC ARPA
  • DC breach law
  • DC consumer ID information law
  • DC CPPA
  • DC Human Rights Act (public accommodations)
  • DC student digital privacy
  • DC Telephone Fraud Act
  • DC UETA
  • DE auto-renewal law
  • DE breach law
  • DE CFA / DTPA
  • DPDPA
  • DE monitoring notice
  • DOPPA
  • DE SDPPA
  • DE Telemarketing Act
  • DE UETA
  • DMCA § 512
  • DOJ bulk sensitive data rule
  • ECPA (Wiretap Act and SCA)
  • EFTA / Regulation E
  • E-SIGN Act
  • FCRA
  • Florida HB 3 adult-site age verification
  • Florida automatic renewal law
  • FIPA (Florida breach law)
  • Florida Brooke's Law
  • Florida children's online spaces law
  • Florida Electronic Mail Communications Act
  • FL junk fax
  • FDBR
  • FDUTPA
  • FTSA
  • FL game promotions
  • Florida DNA privacy law
  • Florida gift card law
  • FL Security of Communications Act
  • Florida HB 3 social media minors
  • Florida Telemarketing Act
  • FL UETA
  • FTC Act § 5
  • FTC pricing and advertising guides
  • FTC Reviews Rule and Endorsement Guides
  • Georgia adult-site age verification
  • Georgia AI companion chatbot law
  • Georgia breach notification
  • Georgia FBPA
  • Georgia SB 351 social media minors
  • Georgia SSN protection and records disposal
  • Georgia Do Not Call and caller ID law
  • GA UETA
  • GLBA
  • Health Breach Notification Rule
  • HI AI companions act
  • HI AI digital imitations (Act 247)
  • HI automatic renewal law
  • HI breach law
  • HI Act 88 (2026) look-alike solicitations
  • HI digital accessibility (Act 257)
  • HI smart security device data (Act 253)
  • HI Social Media Data Deletion Act
  • HI SSN and disposal rules
  • HI telemarketing
  • HI junk-fee rule (Act 254)
  • Hawaii UDAP
  • HI UETA
  • HRS ch. 481B
  • HIPAA
  • IA adult content age verification
  • IA breach law
  • Iowa Consumer Fraud Act
  • IA conversational AI law
  • IA electronic mail law
  • ICDPA
  • IA online marketplace (INFORM-type) law
  • IA prize promotions law
  • IA ticket bots law
  • IA UETA
  • Idaho adult-site age verification
  • Idaho click-to-cancel law
  • Idaho breach law
  • Idaho CPA
  • Idaho telemarketing law
  • ID UETA
  • Ill. WOPR Act (AI therapy)
  • Ill. AI Video Interview Act
  • Ill. Automatic Contract Renewal Act
  • BIPA
  • Ill. Consumer Fraud Act
  • IL Electronic Commerce Security Act
  • Ill. Electronic Mail Act
  • IL employee online account privacy
  • GIPA
  • Ill. HRA AI employment amendment
  • Ill. PIPA (breach, security, disposal)
  • IL Prizes and Gifts Act
  • Ill. Restricted Call Registry Act
  • Ill. Right of Publicity Act
  • SOPPA
  • Ill. telemarketing laws
  • Ill. Ticket Sale and Resale Act
  • Indiana adult-site age verification law
  • Indiana breach and disposal laws
  • Indiana DCSA
  • Indiana CDPA
  • IN promotional gifts and contests
  • Indiana telemarketing laws
  • IN UETA
  • INFORM Consumers Act
  • Junk Fees Rule
  • KS adult content age verification
  • KS breach law
  • KS commercial email act
  • KCPA
  • KS gift card law
  • KS no-call and telemarketing law
  • KS data security, disposal and card privacy
  • KS prize notification law
  • KS SOPPA
  • KS UETA
  • KY automatic renewal law
  • KY Consumer Protection Act
  • KY breach and disposal law
  • KY Genetic Information Privacy Act
  • KY gift card law
  • KCDPA
  • KY prize notices
  • KY True Origin of Digital Goods Act
  • KY student cloud data law
  • KY telemarketing laws
  • KY UETA
  • LA adult-site age verification
  • LA App Store Accountability Act
  • LA automatic renewal disclosure
  • LA Click-to-Cancel Act
  • LA breach law
  • LA employee online account privacy
  • LA gift certificates
  • LA Kids Online Protection and Anti-Grooming Act
  • LUTPA
  • LA service-created harmful material (Act 618)
  • LA SOCIAL Act
  • LA student data privacy
  • LA do-not-call law
  • LA UETA
  • MA breach law
  • Chapter 93A
  • c. 93 § 105
  • Chapter 93I
  • 201 CMR 17.00
  • MA gift certificates
  • 940 CMR 38.00
  • c. 214 §§ 1B, 3A
  • MA do-not-call
  • MA ticket resale law
  • MA UETA
  • MA Wiretap Act
  • Made in USA Rule
  • Magnuson-Moss Warranty Act
  • Mail Order Rule
  • Md. automatic renewal law
  • Md. Commercial Electronic Mail Act
  • MD consumer contract terms
  • Md. CPA
  • MD employee account privacy
  • Md. interview facial recognition consent
  • MD junk fax
  • Md. Genetic Information Privacy Act
  • Md. gift cards
  • Maryland Kids Code
  • MODPA
  • Md. PIPA (breach, security, disposal)
  • MD prize notifications
  • Md. SSN Privacy Act
  • Md. student data privacy
  • Md. telemarketing laws
  • Maryland TCPA
  • Md. ticket bots and URLs
  • Md. UETA
  • Maine AI chatbot law
  • Maine auto-renewal law
  • Maine commercial e-mail law
  • Maine breach law
  • ME employee social media privacy
  • ME junk fax
  • Maine ISP privacy law
  • Maine lodging and ticket price law
  • Maine SSN law
  • Maine SIPA
  • Maine telemarketing law
  • Maine UETA
  • Maine UTPA
  • Mich. breach notification
  • Mich. Children's Protection Registry
  • Mich. CPA
  • MI employee internet account privacy
  • Mich. PPPA
  • Mich. SSN Privacy Act
  • Mich. telephone solicitation law
  • MI UETA
  • MN addictive social media (minors)
  • MN automatic renewal law
  • MN commercial email law
  • MN Consumer Fraud Act
  • MN breach law
  • MN UDTPA and junk fee law
  • MN junk fax
  • MN Genetic Information Privacy Act
  • MN gift certificate law
  • MN ISP privacy law
  • MCDPA
  • MN nudification ban
  • MN Plain Language Contract Act
  • MN prize notice law
  • MN social media transparency and warning label
  • MN SSN and card data law
  • MN student data (technology providers)
  • MN robocall and solicitation law
  • MN ticket sales law
  • MN UETA
  • MO adult content age verification
  • Mo. buyers clubs and unsolicited goods
  • Mo. commercial email
  • Mo. mugshot removal fees
  • MO breach law
  • Missouri MPA
  • MO no-call law
  • MO SSN law
  • MO UETA
  • MS adult-site age verification
  • MS breach law
  • MS Consumer Protection Act
  • MS Keeping Kids Safe Online Act
  • MS telephone solicitation
  • MS UETA
  • MS Walker Montgomery Act
  • MT adult content age verification
  • MT breach law
  • MT Child Digital Protection Act
  • MT Consumer Protection Act
  • MT employee social media privacy
  • MT junk fax
  • MT GIPA
  • MT digital likeness law
  • MCDPA
  • MT personal solicitation sales
  • MT recording consent
  • MT Pupil Online Privacy Act
  • MT telemarketing laws
  • MT UETA
  • NC automatic renewal law
  • NC Identity Theft Protection Act
  • NC telephone solicitation law
  • NC UDTPA
  • NC UETA
  • N.C. bulk email (computer trespass)
  • ND adult content age verification
  • ND automatic renewal law
  • ND breach law
  • ND commercial email law
  • ND consumer fraud law
  • ND data processing confidentiality
  • ND junk fax
  • ND gift certificate law
  • ND home and telephone solicitation sales
  • ND telephone solicitation law
  • ND UETA
  • NE adult content age verification
  • NE AADC
  • NE breach law
  • NE Consumer Protection Act
  • NDPA
  • NE workplace privacy
  • NE Parental Rights in Social Media Act
  • Neb. Telemarketing and Prize Promotions Act
  • NE autodialer law
  • NE UDTPA
  • NE UETA
  • NH chatbot child safety law
  • NH breach law
  • NH CPA
  • NH employee social media privacy
  • NH Privacy Act
  • NH student online privacy
  • NH telemarketing law
  • NH UETA
  • NJ breach notification
  • NJ Consumer Fraud Act
  • NJ Daniel's Law
  • NJ data broker law
  • NJ employee social networking privacy
  • NJ FAIR Act (algorithmic rent pricing)
  • NJ gift card law
  • NJ health club online cancellation
  • NJ Internet Dating Safety Act
  • NJ Kids Code
  • NJDPA
  • NJ restaurant reservation platforms
  • NJ SSN display and records disposal
  • NJ TCCWNA
  • NJ telemarketing and no-call list
  • NJ UETA
  • NM Data Breach Notification Act
  • NM applicant social media privacy
  • NM Genetic Information Privacy Act
  • NM reproductive health data protections
  • NM Privacy Protection Act (SSNs)
  • NM telemarketing and email rules
  • NM UETA
  • NM Unfair Practices Act
  • Nevada AI therapy ban
  • Nevada commercial email law
  • Nevada consumer health data law
  • Nevada DTPA
  • NV employee social media privacy
  • Nevada online privacy law
  • Nevada NRS 603A security and breach
  • Nevada student data privacy
  • Nevada telephone sellers law
  • Nevada telemarketing
  • NV UETA
  • NY social media warning labels
  • NY AI companion safeguards
  • NY algorithmic pricing disclosure
  • NY automatic renewal law
  • NY breach notification (GBL § 899-aa)
  • NY CDPA
  • NY employee monitoring notice
  • NY employee personal account privacy
  • NY ESRA
  • NY junk fax
  • NY sweepstakes registration
  • NY GBL §§ 349-350
  • NY gift card law
  • NYSHRL public accommodation (website accessibility)
  • NY internet dating safety notice
  • NY mail and online order shipping rules
  • NYC Local Law 144 (AEDT)
  • NY record disposal law
  • NY likeness, digital replica and synthetic performer rules
  • NY Safe by Design Act
  • NY SAFE for Kids Act
  • NY SHIELD data security
  • NY social media ToS and hateful-conduct duties
  • NY SSN protection
  • NY telemarketing and do-not-call
  • NY ticket all-in pricing and bots
  • NY Video Consumer Privacy Act
  • Ohio breach notification
  • Ohio commercial e-mail offence
  • Ohio CSPA
  • Ohio Data Protection Act
  • Ohio gift cards
  • Ohio Telephone Solicitation Sales Act
  • OH UETA
  • OK adult-site age verification
  • OK Security Breach Notification Act
  • OK commercial email laws
  • OK Consumer Protection Act
  • OK data privacy act (SB 546)
  • OK employee SSN and social media privacy
  • OK gift card act
  • OK INFORM Act
  • OK name and likeness in advertising
  • OK prizes and gifts
  • OK rental auto-renewal rule
  • OK telemarketing laws
  • OK ticket bot ban
  • OK UETA
  • Oregon AI companion law
  • Oregon ARL
  • Oregon CIPA
  • Oregon data broker registry
  • OR employee social media privacy
  • OR junk fax
  • Oregon gift card law
  • OCPA
  • Oregon shipping disclosure law
  • Oregon OSIPA
  • OR contests and sweepstakes
  • Oregon telemarketing
  • OR UETA
  • Oregon UTPA
  • PA AI Deceptive Advertising Act
  • PA breach notification
  • PA Plain Language Consumer Contract Act
  • PA SSN privacy law
  • PA Telemarketer Registration Act
  • PA ETA
  • PA Unsolicited Telecommunication Advertisement Act
  • PA UTPCPL
  • PA Wiretap Act (all-party consent)
  • PADFA
  • RI DTPA
  • RI document destruction law
  • RIDTPPA
  • RI employee social media privacy
  • RI game promotions
  • RI breach law
  • RI student data cloud law
  • RI telephone sales solicitation law
  • RI UETA
  • ROSCA
  • SC AADC
  • SC adult-site age verification
  • SC automatic renewal notice
  • SC breach law
  • SC gift certificates
  • SC SSN protection and disposal
  • SC Prizes and Gifts Act
  • SC SHASM Act
  • SC Telephone Privacy Protection Act
  • SC UETA
  • SCUTPA
  • SD adult content age verification
  • SD breach law
  • SD commercial email law
  • SD Deceptive Trade Practices Act
  • SD genetic privacy law
  • SD prize notice law
  • SD telemarketing laws
  • SD UETA
  • TAKE IT DOWN Act
  • TCPA
  • Protect Tennessee Minors Act
  • TN AI mental health advertising rule
  • TN breach and SSN law
  • Tennessee Consumer Protection Act
  • ELVIS Act
  • TN employee online privacy
  • TN Protecting Children from Social Media Act
  • TN telemarketing laws
  • TIPA
  • TN UETA
  • TSR
  • Texas HB 1181 age verification
  • Texas App Store Accountability Act
  • Texas CUBI
  • Texas breach notification (ITEPA)
  • Texas card surcharge ban
  • Texas commercial email law
  • Texas contests and sweepstakes
  • Texas Data Broker Act
  • Texas DTPA
  • Texas DTC genetic privacy
  • Texas gift card law
  • Texas Medical Records Privacy Act
  • Texas Internet Dating Safety Act
  • Texas SCOPE Act
  • Texas HB 20 platform duties
  • Texas SSN protection and records disposal
  • TDPSA
  • Texas telemarketing (incl. SB 140)
  • Texas ticket website domain law
  • TRAIGA
  • TX UETA
  • Utah adult content age verification
  • Utah AI Policy Act
  • Utah App Store Act
  • Utah auto-renewal law
  • Utah child protection registry
  • Utah commercial email act
  • Utah CSPA
  • Utah cybersecurity safe harbour
  • Utah Digital Choice Act
  • Utah AI provenance law
  • UT internet employment privacy
  • Utah GIPA
  • Utah mental health chatbot law
  • Utah social media minors act
  • Utah NISNPIA
  • Utah online dating law
  • UT prize notices
  • Utah breach law
  • Utah student data law
  • Utah telemarketing act
  • Utah ticket transferability law
  • Utah ticket website law
  • UCPA
  • UT UETA
  • Va. automatic renewal law
  • Va. breach notification
  • Va. comparison pricing
  • Va. Computer Crimes Act (spam)
  • VA employee social media privacy
  • Va. food delivery platforms
  • VA junk fax
  • Va. fingerprint return or destruction
  • Va. genetic data privacy
  • Va. gift certificates
  • Va. adult-site age verification
  • Va. junk fee law
  • Va. PIPA (SSN and purchaser information)
  • Va. Prizes and Gifts Act
  • Va. right of publicity
  • Va. streaming ad loudness
  • Va. student data privacy
  • VTPPA
  • Va. ticket resale
  • Va. UETA
  • VCDPA
  • VCPA
  • VPPA
  • Vermont auto-renewal law
  • Vermont CPA
  • Vermont data broker law
  • VT employee social media privacy
  • Vermont Kids Code
  • Vermont breach law
  • Vermont SSN and disposal law
  • Vermont student privacy law
  • Vermont telemarketing law
  • VT UETA
  • WA AI companion law
  • WA AI provenance law
  • WA biometric law
  • WA breach notification
  • WA CEMA
  • WA spyware law
  • WA CPA
  • WA rebate law
  • WA data disposal law
  • WA employee social networking privacy
  • WA junk fax
  • WA gift card law
  • MHMDA
  • WA prize promotions
  • WA all-party consent
  • WA SUPER Act
  • WA telemarketing
  • WA ticket bot law
  • WA UETA
  • Wisconsin breach law
  • Wisconsin B2B auto-renewal law
  • Wisconsin DTPA
  • WI employee internet account privacy
  • WI junk fax
  • WI prize notices
  • Wisconsin no-call law
  • WI UETA
  • WV adult-site age verification law
  • WVCCPA consumer protection article
  • WV breach notification law
  • WV Electronic Mail Protection Act
  • WV electronic transactions consumer protections
  • WV employee personal account privacy
  • WV prizes and gifts
  • WV telemarketing law
  • WV UETA
  • WY adult-site age verification
  • WY breach law
  • WY commercial email
  • Wyoming CPA
  • WY genetic data privacy
  • WY prize notices
  • WY telephone solicitation
  • WY UETA

Where each law applies

United States · federal
ADA Title III (web) · BOTS Act · CAN-SPAM · COPPA · CRFA · DMCA § 512 · DOJ bulk sensitive data rule · ECPA (Wiretap Act and SCA) · EFTA / Regulation E · E-SIGN Act · FCRA · FTC Act § 5 · FTC pricing and advertising guides · FTC Reviews Rule and Endorsement Guides · GLBA · Health Breach Notification Rule · HIPAA · INFORM Consumers Act · Junk Fees Rule · Made in USA Rule · Magnuson-Moss Warranty Act · Mail Order Rule · PADFA · ROSCA · TAKE IT DOWN Act · TCPA · TSR · VPPA
United States · states
AK free trials and opt-out plans · AK breach law · AK SSN and disposal rules · Alaska spyware law · AK telephone solicitation · AK UETA · Alaska unordered merchandise · Alaska UTPA · AL admission tickets · AL adult-site age verification · AL App Store Accountability Act · AL breach law · AL DTPA · AL Genetic Data Privacy Act · AL Personal Data Protection Act · AL sweepstakes solicitations · AL telemarketing and do-not-call · AL UETA · AR adult-site age verification · AR automatic renewal law · AR commercial email act · AR Children and Teens' Online Privacy Protection Act · AR Deceptive Trade Practices Act · AR employee social media privacy · AR Fair Gift Card Act · AR Personal Information Protection Act · AR prize promotions · AR Social Media Safety Act (enjoined) · AR SSN protection · AR SOPIPA · AR telemarketing laws · AR UETA · AZ adult-site age verification · AZ breach law · AZ child-directed app ads law · AZ commercial email law · AZ Consumer Fraud Act · AZ genetic testing privacy · AZ dating services law · AZ SSN, disposal and ID-scan rules · AZ gift card, restocking fee and unordered goods rules · AZ spyware law · AZ student data privacy · AZ telephone solicitation law · AZ ticket bot and resale law · AZ UETA · CA AADC · AB 489 AI health advice · CA AB 2013 · CA AI Transparency Act · CA anti-spam law · CA bot disclosure law · CalOPPA / CA ARL · CCPA/CPRA · CIPA · CLRA · CMIA (digital health) · CA SB 243 · Connected TVs and devices · CA contests and sweepstakes · CRD ADS employment regulations · CA breach law · Delete Act · CA Digital Age Assurance Act · CA e-commerce disclosures · CA employee social media privacy · CA junk fax · CA gift card law · CA GIPA · CA AB 45 geofencing law · CA IoT security law · CA minors digital rights · CA INFORM / marketplaces law · Reader Privacy Act · Shine the Light · CA SB 976 / AB 56 · CA social media platform duties · Song-Beverly Credit Card Act · SOPIPA / ELPIPA · CA SSN law · CA telemarketing · UCL / FAL · CA UETA · Unruh Act / DPA · Colorado ADMT law · Colorado ARL · Colorado commercial email law · Colorado CCPA (consumer protection) · Colorado chatbot law · CPA (Colorado) · Colorado breach and security law · Colorado junk fee law · CO employee social media privacy · Colorado gift card law · Colorado child influencer law · Colorado no-call law · Colorado online dating safety · Colorado online marketplace law · Colorado social media warnings · Colorado student data act · Colorado ticket law · CO UETA · CT algorithmic pricing disclosure · CT auto-renewal law · CT breach law · CT call recording · CTDPA · CUTPA · CT data broker registration · CT monitoring notice · CT junk fax and ADV email · CT gift certificates · CT dating and social media duties · CT SSN law · CT student data privacy · CT telemarketing · CT ticket resale law · CT UETA · DC ARPA · DC breach law · DC consumer ID information law · DC CPPA · DC Human Rights Act (public accommodations) · DC student digital privacy · DC Telephone Fraud Act · DC UETA · DE auto-renewal law · DE breach law · DE CFA / DTPA · DPDPA · DE monitoring notice · DOPPA · DE SDPPA · DE Telemarketing Act · DE UETA · Florida HB 3 adult-site age verification · Florida automatic renewal law · FIPA (Florida breach law) · Florida Brooke's Law · Florida children's online spaces law · Florida Electronic Mail Communications Act · FL junk fax · FDBR · FDUTPA · FTSA · FL game promotions · Florida DNA privacy law · Florida gift card law · FL Security of Communications Act · Florida HB 3 social media minors · Florida Telemarketing Act · FL UETA · Georgia adult-site age verification · Georgia AI companion chatbot law · Georgia breach notification · Georgia FBPA · Georgia SB 351 social media minors · Georgia SSN protection and records disposal · Georgia Do Not Call and caller ID law · GA UETA · HI AI companions act · HI AI digital imitations (Act 247) · HI automatic renewal law · HI breach law · HI Act 88 (2026) look-alike solicitations · HI digital accessibility (Act 257) · HI smart security device data (Act 253) · HI Social Media Data Deletion Act · HI SSN and disposal rules · HI telemarketing · HI junk-fee rule (Act 254) · Hawaii UDAP · HI UETA · HRS ch. 481B · IA adult content age verification · IA breach law · Iowa Consumer Fraud Act · IA conversational AI law · IA electronic mail law · ICDPA · IA online marketplace (INFORM-type) law · IA prize promotions law · IA ticket bots law · IA UETA · Idaho adult-site age verification · Idaho click-to-cancel law · Idaho breach law · Idaho CPA · Idaho telemarketing law · ID UETA · Ill. WOPR Act (AI therapy) · Ill. AI Video Interview Act · Ill. Automatic Contract Renewal Act · BIPA · Ill. Consumer Fraud Act · IL Electronic Commerce Security Act · Ill. Electronic Mail Act · IL employee online account privacy · GIPA · Ill. HRA AI employment amendment · Ill. PIPA (breach, security, disposal) · IL Prizes and Gifts Act · Ill. Restricted Call Registry Act · Ill. Right of Publicity Act · SOPPA · Ill. telemarketing laws · Ill. Ticket Sale and Resale Act · Indiana adult-site age verification law · Indiana breach and disposal laws · Indiana DCSA · Indiana CDPA · IN promotional gifts and contests · Indiana telemarketing laws · IN UETA · KS adult content age verification · KS breach law · KS commercial email act · KCPA · KS gift card law · KS no-call and telemarketing law · KS data security, disposal and card privacy · KS prize notification law · KS SOPPA · KS UETA · KY automatic renewal law · KY Consumer Protection Act · KY breach and disposal law · KY Genetic Information Privacy Act · KY gift card law · KCDPA · KY prize notices · KY True Origin of Digital Goods Act · KY student cloud data law · KY telemarketing laws · KY UETA · LA adult-site age verification · LA App Store Accountability Act · LA automatic renewal disclosure · LA Click-to-Cancel Act · LA breach law · LA employee online account privacy · LA gift certificates · LA Kids Online Protection and Anti-Grooming Act · LUTPA · LA service-created harmful material (Act 618) · LA SOCIAL Act · LA student data privacy · LA do-not-call law · LA UETA · MA breach law · Chapter 93A · c. 93 § 105 · Chapter 93I · 201 CMR 17.00 · MA gift certificates · 940 CMR 38.00 · c. 214 §§ 1B, 3A · MA do-not-call · MA ticket resale law · MA UETA · MA Wiretap Act · Md. automatic renewal law · Md. Commercial Electronic Mail Act · MD consumer contract terms · Md. CPA · MD employee account privacy · Md. interview facial recognition consent · MD junk fax · Md. Genetic Information Privacy Act · Md. gift cards · Maryland Kids Code · MODPA · Md. PIPA (breach, security, disposal) · MD prize notifications · Md. SSN Privacy Act · Md. student data privacy · Md. telemarketing laws · Maryland TCPA · Md. ticket bots and URLs · Md. UETA · Maine AI chatbot law · Maine auto-renewal law · Maine commercial e-mail law · Maine breach law · ME employee social media privacy · ME junk fax · Maine ISP privacy law · Maine lodging and ticket price law · Maine SSN law · Maine SIPA · Maine telemarketing law · Maine UETA · Maine UTPA · Mich. breach notification · Mich. Children's Protection Registry · Mich. CPA · MI employee internet account privacy · Mich. PPPA · Mich. SSN Privacy Act · Mich. telephone solicitation law · MI UETA · MN addictive social media (minors) · MN automatic renewal law · MN commercial email law · MN Consumer Fraud Act · MN breach law · MN UDTPA and junk fee law · MN junk fax · MN Genetic Information Privacy Act · MN gift certificate law · MN ISP privacy law · MCDPA · MN nudification ban · MN Plain Language Contract Act · MN prize notice law · MN social media transparency and warning label · MN SSN and card data law · MN student data (technology providers) · MN robocall and solicitation law · MN ticket sales law · MN UETA · MO adult content age verification · Mo. buyers clubs and unsolicited goods · Mo. commercial email · Mo. mugshot removal fees · MO breach law · Missouri MPA · MO no-call law · MO SSN law · MO UETA · MS adult-site age verification · MS breach law · MS Consumer Protection Act · MS Keeping Kids Safe Online Act · MS telephone solicitation · MS UETA · MS Walker Montgomery Act · MT adult content age verification · MT breach law · MT Child Digital Protection Act · MT Consumer Protection Act · MT employee social media privacy · MT junk fax · MT GIPA · MT digital likeness law · MCDPA · MT personal solicitation sales · MT recording consent · MT Pupil Online Privacy Act · MT telemarketing laws · MT UETA · NC automatic renewal law · NC Identity Theft Protection Act · NC telephone solicitation law · NC UDTPA · NC UETA · N.C. bulk email (computer trespass) · ND adult content age verification · ND automatic renewal law · ND breach law · ND commercial email law · ND consumer fraud law · ND data processing confidentiality · ND junk fax · ND gift certificate law · ND home and telephone solicitation sales · ND telephone solicitation law · ND UETA · NE adult content age verification · NE AADC · NE breach law · NE Consumer Protection Act · NDPA · NE workplace privacy · NE Parental Rights in Social Media Act · Neb. Telemarketing and Prize Promotions Act · NE autodialer law · NE UDTPA · NE UETA · NH chatbot child safety law · NH breach law · NH CPA · NH employee social media privacy · NH Privacy Act · NH student online privacy · NH telemarketing law · NH UETA · NJ breach notification · NJ Consumer Fraud Act · NJ Daniel's Law · NJ data broker law · NJ employee social networking privacy · NJ FAIR Act (algorithmic rent pricing) · NJ gift card law · NJ health club online cancellation · NJ Internet Dating Safety Act · NJ Kids Code · NJDPA · NJ restaurant reservation platforms · NJ SSN display and records disposal · NJ TCCWNA · NJ telemarketing and no-call list · NJ UETA · NM Data Breach Notification Act · NM applicant social media privacy · NM Genetic Information Privacy Act · NM reproductive health data protections · NM Privacy Protection Act (SSNs) · NM telemarketing and email rules · NM UETA · NM Unfair Practices Act · Nevada AI therapy ban · Nevada commercial email law · Nevada consumer health data law · Nevada DTPA · NV employee social media privacy · Nevada online privacy law · Nevada NRS 603A security and breach · Nevada student data privacy · Nevada telephone sellers law · Nevada telemarketing · NV UETA · NY social media warning labels · NY AI companion safeguards · NY algorithmic pricing disclosure · NY automatic renewal law · NY breach notification (GBL § 899-aa) · NY CDPA · NY employee monitoring notice · NY employee personal account privacy · NY ESRA · NY junk fax · NY sweepstakes registration · NY GBL §§ 349-350 · NY gift card law · NYSHRL public accommodation (website accessibility) · NY internet dating safety notice · NY mail and online order shipping rules · NYC Local Law 144 (AEDT) · NY record disposal law · NY likeness, digital replica and synthetic performer rules · NY Safe by Design Act · NY SAFE for Kids Act · NY SHIELD data security · NY social media ToS and hateful-conduct duties · NY SSN protection · NY telemarketing and do-not-call · NY ticket all-in pricing and bots · NY Video Consumer Privacy Act · Ohio breach notification · Ohio commercial e-mail offence · Ohio CSPA · Ohio Data Protection Act · Ohio gift cards · Ohio Telephone Solicitation Sales Act · OH UETA · OK adult-site age verification · OK Security Breach Notification Act · OK commercial email laws · OK Consumer Protection Act · OK data privacy act (SB 546) · OK employee SSN and social media privacy · OK gift card act · OK INFORM Act · OK name and likeness in advertising · OK prizes and gifts · OK rental auto-renewal rule · OK telemarketing laws · OK ticket bot ban · OK UETA · Oregon AI companion law · Oregon ARL · Oregon CIPA · Oregon data broker registry · OR employee social media privacy · OR junk fax · Oregon gift card law · OCPA · Oregon shipping disclosure law · Oregon OSIPA · OR contests and sweepstakes · Oregon telemarketing · OR UETA · Oregon UTPA · PA AI Deceptive Advertising Act · PA breach notification · PA Plain Language Consumer Contract Act · PA SSN privacy law · PA Telemarketer Registration Act · PA ETA · PA Unsolicited Telecommunication Advertisement Act · PA UTPCPL · PA Wiretap Act (all-party consent) · RI DTPA · RI document destruction law · RIDTPPA · RI employee social media privacy · RI game promotions · RI breach law · RI student data cloud law · RI telephone sales solicitation law · RI UETA · SC AADC · SC adult-site age verification · SC automatic renewal notice · SC breach law · SC gift certificates · SC SSN protection and disposal · SC Prizes and Gifts Act · SC SHASM Act · SC Telephone Privacy Protection Act · SC UETA · SCUTPA · SD adult content age verification · SD breach law · SD commercial email law · SD Deceptive Trade Practices Act · SD genetic privacy law · SD prize notice law · SD telemarketing laws · SD UETA · Protect Tennessee Minors Act · TN AI mental health advertising rule · TN breach and SSN law · Tennessee Consumer Protection Act · ELVIS Act · TN employee online privacy · TN Protecting Children from Social Media Act · TN telemarketing laws · TIPA · TN UETA · Texas HB 1181 age verification · Texas App Store Accountability Act · Texas CUBI · Texas breach notification (ITEPA) · Texas card surcharge ban · Texas commercial email law · Texas contests and sweepstakes · Texas Data Broker Act · Texas DTPA · Texas DTC genetic privacy · Texas gift card law · Texas Medical Records Privacy Act · Texas Internet Dating Safety Act · Texas SCOPE Act · Texas HB 20 platform duties · Texas SSN protection and records disposal · TDPSA · Texas telemarketing (incl. SB 140) · Texas ticket website domain law · TRAIGA · TX UETA · Utah adult content age verification · Utah AI Policy Act · Utah App Store Act · Utah auto-renewal law · Utah child protection registry · Utah commercial email act · Utah CSPA · Utah cybersecurity safe harbour · Utah Digital Choice Act · Utah AI provenance law · UT internet employment privacy · Utah GIPA · Utah mental health chatbot law · Utah social media minors act · Utah NISNPIA · Utah online dating law · UT prize notices · Utah breach law · Utah student data law · Utah telemarketing act · Utah ticket transferability law · Utah ticket website law · UCPA · UT UETA · Va. automatic renewal law · Va. breach notification · Va. comparison pricing · Va. Computer Crimes Act (spam) · VA employee social media privacy · Va. food delivery platforms · VA junk fax · Va. fingerprint return or destruction · Va. genetic data privacy · Va. gift certificates · Va. adult-site age verification · Va. junk fee law · Va. PIPA (SSN and purchaser information) · Va. Prizes and Gifts Act · Va. right of publicity · Va. streaming ad loudness · Va. student data privacy · VTPPA · Va. ticket resale · Va. UETA · VCDPA · VCPA · Vermont auto-renewal law · Vermont CPA · Vermont data broker law · VT employee social media privacy · Vermont Kids Code · Vermont breach law · Vermont SSN and disposal law · Vermont student privacy law · Vermont telemarketing law · VT UETA · WA AI companion law · WA AI provenance law · WA biometric law · WA breach notification · WA CEMA · WA spyware law · WA CPA · WA rebate law · WA data disposal law · WA employee social networking privacy · WA junk fax · WA gift card law · MHMDA · WA prize promotions · WA all-party consent · WA SUPER Act · WA telemarketing · WA ticket bot law · WA UETA · Wisconsin breach law · Wisconsin B2B auto-renewal law · Wisconsin DTPA · WI employee internet account privacy · WI junk fax · WI prize notices · Wisconsin no-call law · WI UETA · WV adult-site age verification law · WVCCPA consumer protection article · WV breach notification law · WV Electronic Mail Protection Act · WV electronic transactions consumer protections · WV employee personal account privacy · WV prizes and gifts · WV telemarketing law · WV UETA · WY adult-site age verification · WY breach law · WY commercial email · Wyoming CPA · WY genetic data privacy · WY prize notices · WY telephone solicitation · WY UETA
European Union
EAA · EU AI Act (Art. 50) · DSA (basics) · ePrivacy cookies · GDPR
Germany
TDDDG § 25 / DDG § 5
United Kingdom
UK PECR · UK GDPR / DPA 2018
Canada · incl. Quebec
CASL · PIPEDA · Quebec Law 25
Brazil
LGPD
India
DPDP Act / Rules
Australia
Privacy Act / APPs · Spam Act
[ Three ways in ]

Start where your question is.

[ Full analysis ]

Your standing in every market you sell into.

Your policies read against every obligation that applies, your live site checked, and fixes for what falls short. Add monthly re-checks and law-change monitoring on a subscription.

Start your analysis
[ Policy builder ]

We write, check and host your policies.

No policies yet, or ones copied from somewhere? We draft your privacy policy, terms and cookie notice from your answers, check each draft against the obligations that apply to you, and host them on a page you can link from your site.

Create an account
[ Practice check · free ]

Is the way you use AI and messaging tools on client data OK?

Name the tools and plans you use. We compare them with our library of 23 tools and 48 plans from 21 vendors, each fact taken from the vendor's own page. No account, and nothing you type is stored.

Free practice check
[ Why Smartsteps ]

A plausible answer is not an audit.

A chatbot is good at sounding right. A template is good at looking finished. A lawyer is the right call for real decisions. Smartsteps does the reading in between, and does it again next month.

How Smartsteps compares with a general AI chat, a template generator and a lawyer
The questionA general AI chatA template generatorA lawyerSmartsteps
Which laws apply to youGuesses from a description of your businessPicks a template by country; thresholds are left to youCan decide it properly, for the places they practiseApplies each law's thresholds to your revenue, users, data and markets, the same way every time
What the law saysRecalled from training data, sometimes out of dateFixed wording, updated on the vendor's scheduleAn expert readingRead from a maintained record with citations and a verified date
What your site doesCannot see itDoes not lookA separate technical review, if you ask for oneVisits it with a real browser, before and after consent, from the regions you sell into
ThoroughnessSummarises the obvious pointsCovers what the template coversDeep on the questions you bringChecks every obligation one by one; a second model argues the other side
Next monthStarts from zeroUnchanged until you regenerateA new engagementRe-checks monthly and whenever a law you are under changes
Legal adviceNoNoYes. That is what they are forNo. We show the evidence; take decisions with real exposure to counsel
[ Straight answers ]

What people ask before they start.

Something else? Email info@nomisma.ai and a person will answer.

Is this legal advice?

No. Smartsteps is not a law firm and does not provide legal advice. The report shows how your documents and your site measure up against the obligations in our law records, with the evidence for each finding. For decisions that carry real exposure, take it to a lawyer: it makes a good starting brief.

What happens with my documents?

They are stored encrypted and used to run your analysis. The text is sent to Anthropic's Claude models through Amazon Bedrock to evaluate each obligation. Neither we nor Bedrock use it to train any AI model, and it is deleted when you delete the workspace. The Privacy Policy has the detail.

Do you store what I type into the free check?

No. What you enter and the result are not saved to an account, our database or our logs, and “Save a copy” builds the file in your browser. We keep your IP address for one hour to limit each connection to five checks an hour, and a count of which tools were checked and the overall verdict, with nothing you typed.

How long does an analysis take?

Setting it up takes you about fifteen minutes. The analysis itself takes under an hour for a few markets, a few hours for many, and up to 48 hours for the largest. We email you when the report is ready.

Which regions are held, and why?

Sign-ups from businesses based in the European Economic Area, the United Kingdom, Switzerland, Brazil and Quebec are not open yet. Selling there first needs local pieces in place, such as GDPR and DSA representatives, a German imprint and translation, a Brazilian data protection officer and Portuguese notice, and a French policy for Quebec. A business based elsewhere can still check its exposure in those markets. Email info@nomisma.ai to hear when your region opens.

What does it cost?

There is a one-time scan, and subscriptions billed monthly or yearly that add monthly re-checks and law-change monitoring. Current prices are shown in the app before you pay, and the practice check is free. See Billing, credits and refunds.

Can I cancel?

Yes, at any time: online under Plan & billing, or by emailing info@nomisma.ai from your account's address. No call and no retention offer. Cancelling takes effect at the end of the current billing period, and you keep access until then.

Do you guarantee compliance?

No, and nobody honestly can. Compliance depends on things no scan can see, such as what your staff and vendors do with data, on how a regulator or court reads the law, and on changes still to come. What we promise is that every finding shows what we checked and the evidence behind it, so you can judge it yourself.

[ Honest limits ]

What we don't do.

We would rather you hear this from us now than discover it later.

  • We don't give legal advice. Smartsteps is not a law firm. The report is evidence and suggested fixes, not an opinion from counsel.
  • We never tell you that you are compliant. We tell you what we checked, what we found and what to fix.
  • We don't sell everywhere yet. Sign-ups from the EEA, the UK, Switzerland, Brazil and Quebec are held until the local requirements are in place.
  • Not every check rests on the statute's text. 95% of obligations (3652 of 3842) are judged against the stored text of the law; the rest against our own summary of the obligation.
  • We don't cover every law. 695 laws across 60 jurisdictions today. Markets we have not reached are labelled, never guessed.
  • We don't train AI on your documents. Neither we nor Amazon Bedrock, which runs the models, use them for training.
[ Start here ]

Know where you stand before someone else tells you.

About fifteen minutes to set up. One email when your report is ready.

Start your analysis Free practice check