Precedent library
The decisions behind the risk.
Court rulings and regulator actions that turned ordinary product code — a pixel, a pre-ticked box, a replay script, a training set — into a legal problem. Each one says what it means for the code you ship.
- USCourt11 February 2025
Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc.
No. 1:20-cv-613 (D. Del. Feb. 11, 2025) (Bibas, J.)
Training a competing AI product on a rival's copyrighted content is high-risk; document the provenance and licences of training data.
AI systemsIP & licensing - EUCourt4 October 2024
Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens
Case C-621/22, ECLI:EU:C:2024:857
Legitimate interests is available for commercial purposes but it is a three-step test you have to document; write the balancing assessment before shipping the feature, not after the complaint.
Personal dataMarketing comms - EUCourt4 October 2024
Maximilian Schrems v Meta Platforms Ireland Ltd
Case C-446/21, ECLI:EU:C:2024:834
Advertising and profiling stores need a retention clock and a scope boundary, the same as any other personal data store. 'Keep everything forever because it might be useful' is the practice this decision rules out.
Personal dataTracking & wiretap - USRegulator25 September 2024
In re DoNotPay, Inc. ("AI lawyer" claims)
FTC consent order, announced 25 September 2024, finalised 2025
Legal, medical or financial AI has to be described as what it is. Say it is assistance, keep evidence of how well it performs, and do not imply a licensed professional's judgement.
AI systemsDark patterns⚖ USD 193,000 and mandatory notices to subscribers - EURegulator3 September 2024
Dutch DPA decision on Clearview AI
Autoriteit Persoonsgegevens, decision announced 3 September 2024
Scraping images to train or run face recognition is special-category biometric processing; public availability of the photos is no legal basis.
BiometricsScrapingAI systems⚖ EUR 30.5 million administrative fine - EURegulator26 August 2024
Dutch DPA decision on Uber (driver data transfers to the US)
Autoriteit Persoonsgegevens, decision of 22 July 2024 (announced 26 August 2024)
Moving EU user data to a US region or US-owned processor requires a transfer mechanism before the first byte moves.
International transfers⚖ EUR 290 million administrative fine - USCourt20 August 2024
Calhoun v Google LLC
113 F.4th 1141 (9th Cir. 2024)
Your in-product copy is the disclosure that counts. If the settings screen implies data stays local, the privacy policy will not rescue you.
Personal dataTracking & wiretapDark patterns - USCourt16 August 2024
NetChoice, LLC v Bonta (California Age-Appropriate Design Code)
113 F.4th 1101 (9th Cir. 2024)
US children's design rules are unsettled. Build the privacy-protective defaults, which no court has questioned, and treat content-assessment mandates as jurisdiction-specific.
ChildrenPersonal dataUser content - USCourt12 July 2024
Mobley v. Workday, Inc.
No. 3:23-cv-00770 (N.D. Cal. July 12, 2024)
B2B vendors of scoring or screening models can be directly liable for discriminatory outcomes; test for disparate impact and keep human review.
AI systems - EUCourt7 March 2024
IAB Europe v Gegevensbeschermingsautoriteit
Case C-604/22, ECLI:EU:C:2024:214
Consent records and ad-tech preference strings are themselves personal data; the vendors and frameworks you plug in share responsibility with you.
Consent & cookiesTracking & wiretap - USRegulator22 February 2024
In re Avast Limited (sale of browsing data)
FTC Docket No. C-4805 (2024)
Telemetry you sell is not anonymous because you stripped the name. If a record can be tied back to a person by anyone downstream, treat it as personal data.
Personal dataTracking & wiretap⚖ USD 16.5 million and a ban on selling browsing data for advertising - USRegulator9 January 2024
In re X-Mode Social, Inc. and Outlogic, LLC (precise location data)
FTC Docket No. C-4802 (2024)
If you embed a monetisation SDK, you are the one asking for the permission. Find out what the SDK does with the location you hand it, and say so in the permission prompt.
Personal dataTracking & wiretap⚖ Deletion order and a ban on selling sensitive location data - UKCourt20 December 2023
Thaler v Comptroller-General of Patents, Designs and Trade Marks
[2023] UKSC 49
Record meaningful human contribution for AI-assisted inventions and works if you intend to protect them.
AI systemsIP & licensing - USSettlement19 December 2023
FTC v. Rite Aid (facial recognition)
FTC v. Rite Aid Corp., No. 2:23-cv-5023 (E.D. Pa.), order December 2023
Shipping a biometric or AI identification feature requires pre-deployment accuracy and bias testing, monitoring and a way for people to contest matches.
BiometricsAI systems⚖ Five-year ban on facial-recognition surveillance - EUCourt14 December 2023
VB v Natsionalna agentsia za prihodite (Bulgarian National Revenue Agency)
Case C-340/21, ECLI:EU:C:2023:986
Keep evidence that your security decisions were reasonable when you made them — threat models, review records, the reason a control was chosen — because after a breach you have to prove it, not the claimant.
SecurityPersonal data - EUCourt7 December 2023
OQ v Land Hessen (SCHUFA Holding)
Case C-634/21, ECLI:EU:C:2023:957
If customers rely on your model's score to accept or reject people, Article 22 safeguards (human review, explanation, contestation) apply to your product.
AI systemsPersonal data - EUCourt5 December 2023
Deutsche Wohnen SE v Staatsanwaltschaft Berlin
Case C-807/21, ECLI:EU:C:2023:950
You cannot push retention or deletion failures onto a single engineer's mistake; the organisation is answerable for what its systems do.
Personal data - EUCourt5 December 2023
Nacionalinis visuomenės sveikatos centras v Valstybinė duomenų apsaugos inspekcija
Case C-683/21, ECLI:EU:C:2023:949
Commissioning an app makes you a controller for what it does in testing as well as in production; agree responsibilities with the developer in writing before the first build ships to real users.
Personal dataHealth data - EURegulator1 September 2023
Irish DPC decision on TikTok Technology Limited (children's data)
DPC Inquiry IN-21-9-1, decision 1 September 2023
If minors can sign up, defaults must be private and settings-flow design must not nudge them toward sharing.
ChildrenDark patternsPersonal data⚖ EUR 345 million administrative fine - USRegulator14 July 2023
In re BetterHelp, Inc.
FTC Docket No. C-4796 (2023)
A marketing pixel on an intake or symptom flow ships health data off-platform. Treat those pages as a no-third-party-script zone.
Health dataPersonal dataTracking & wiretap⚖ USD 7.8 million in consumer refunds - EUCourt4 July 2023
Meta Platforms Inc. and Others v Bundeskartellamt
Case C-252/21, ECLI:EU:C:2023:537
Do not rely on 'contract necessity' in your terms to justify ad personalisation or cross-service tracking; get consent.
Tracking & wiretapPersonal data - EUCourt22 June 2023
J.M. v Finnish Data Protection Ombudsman and Pankki S
Case C-579/21, ECLI:EU:C:2023:501
Access logs are disclosable material. Record who-viewed-what with a purpose and a timestamp, keep the logs separable from staff identity, and be able to hand a customer their own access history.
Personal dataSecurity - USRegulator31 May 2023
FTC v Ring LLC (employee and contractor access to customer video)
FTC complaint and stipulated order, C.D. Cal. (2023)
Internal access is a product surface. Scope it per role, log every view, alert on bulk access, and offer multi-factor authentication before you are told to.
SecurityPersonal data⚖ USD 5.8 million - EURegulator12 May 2023
Irish DPC decision on Meta Platforms Ireland (EU-US transfers)
DPC Inquiry IN-20-8-1, final decision 12 May 2023
Signing SCCs is not enough; you need a transfer impact assessment and supplementary measures, or an adequacy mechanism such as the EU-US Data Privacy Framework.
International transfers⚖ EUR 1.2 billion administrative fine - EUCourt4 May 2023
F.F. v Österreichische Datenschutzbehörde (CRIF)
Case C-487/21, ECLI:EU:C:2023:369
An export endpoint that emits a tidy summary is not enough: a DSAR export has to be complete and readable enough for the person to verify it, which usually means the underlying records, not a rendered view.
Personal data - EUCourt4 May 2023
UI v Österreichische Post AG
Case C-300/21, ECLI:EU:C:2023:370
Data-protection lapses can ground individual damages claims even for modest harm, which makes mass claims after incidents viable.
Personal dataSecurity - USCourt24 April 2023
Epic Games, Inc. v. Apple Inc.
67 F.4th 946 (9th Cir. 2023)
App-store payment rules are shifting; keep in-app purchase and external-link flows configurable per storefront and jurisdiction.
Payments - UKRegulator4 April 2023
ICO monetary penalty notice: TikTok Information Technologies UK Ltd
ICO Monetary Penalty Notice, 4 April 2023
An age field in your terms is not age assurance; if under-13s realistically use the product you need detection and parental-consent flows.
ChildrenPersonal data⚖ GBP 12.7 million monetary penalty - USCourt17 February 2023
Cothron v. White Castle System, Inc.
2023 IL 128004
B2B vendors shipping biometric login or time-clock features carry per-person statutory exposure for their customers' users; build consent capture into the product.
Biometrics - USSettlement19 December 2022
FTC settlements with Epic Games (COPPA and dark patterns)
United States v. Epic Games, Inc. (E.D.N.C. 2022); In re Epic Games, FTC administrative order (2023)
Default communication settings for minors must be off, and purchase buttons must require clear, deliberate confirmation.
ChildrenDark patternsSubscriptions⚖ USD 275 million COPPA civil penalty and USD 245 million consumer refunds - USRegulator24 October 2022
In re Drizly, LLC and James Cory Rellas
FTC Docket No. C-4780 (2022-2023)
Committed credentials are the textbook FTC security case, and accountability for them is now personal, not only corporate.
Security⚖ Injunctive order binding the company and its CEO personally - USCourt18 October 2022
Popa v Harriet Carter Gifts, Inc.
52 F.4th 121 (3d Cir. 2022)
A session-replay or analytics script that streams input to a vendor is wiretapping unless the user agreed to it before the script loads. Gate these behind consent and name the vendor.
Tracking & wiretapConsent & cookiesPersonal data - USSettlement24 August 2022
People v. Sephora USA, Inc. (CCPA)
California Attorney General settlement, 24 August 2022
Honour the Sec-GPC header / navigator.globalPrivacyControl and disclose third-party tracking as 'sale or sharing' in California.
Tracking & wiretapPersonal data⚖ USD 1.2 million - USCourt31 May 2022
Javier v. Assurance IQ, LLC
No. 21-16351, 2022 WL 1744107 (9th Cir. May 31, 2022) (unpublished)
Session replay and chat transcripts need consent before recording starts, not in a footer or at form submission.
Tracking & wiretapConsent & cookies - EUCourt28 April 2022
Meta Platforms Ireland Ltd v Bundesverband der Verbraucherzentralen
Case C-319/20, ECLI:EU:C:2022:322
Data protection exposure is not limited to regulator fines and individual claims; a consumer body can litigate a design decision on behalf of an entire user base.
Personal data - EUCourt26 April 2022
Republic of Poland v European Parliament and Council (Article 17 DSM)
Case C-401/19, ECLI:EU:C:2022:297
An automated takedown pipeline needs an appeals path and must not block material it cannot confidently classify — over-blocking is itself the legal risk.
User contentIP & licensing - USCourt18 April 2022
hiQ Labs, Inc. v. LinkedIn Corp.
31 F.4th 1180 (9th Cir. 2022)
Scraping public pages is unlikely to be criminal under the CFAA, but contract (ToS), anti-circumvention and privacy law still apply, especially if you log in or evade blocks.
Scraping - UKCourt10 November 2021
Lloyd v Google LLC
[2021] UKSC 50
UK opt-out class actions for data misuse are hard, but individual claims and regulator action remain; do not treat this as immunity for tracking without consent.
Tracking & wiretapPersonal data - USCourt25 June 2021
TransUnion LLC v Ramirez
594 U.S. 413 (2021)
Whether bad data left your systems is the line between a nuisance and a federal class action. Log egress, not just storage.
Personal dataSecurity - USCourt3 June 2021
Van Buren v. United States
593 U.S. 374 (2021)
CFAA exposure turns on technical access barriers; enforce authorisation in code, not just in your terms of service.
ScrapingSecurity - USCourt5 April 2021
Google LLC v. Oracle America, Inc.
593 U.S. 1 (2021)
Re-implementing an API interface for compatibility can be fair use in the US, but copying implementation code is a different question.
IP & licensing - UKCourt26 March 2021
Warner Music UK Ltd and Sony Music Entertainment UK Ltd v TuneIn Inc
[2021] EWCA Civ 441
Embedding or reframing someone else's stream in your player is not the same as linking to their page; the territorial scope of their licence becomes your problem.
IP & licensingUser content - EUCourt11 November 2020
Orange România SA v ANSPDCP
Case C-61/19, ECLI:EU:C:2020:901
If declining costs the user more clicks than accepting, or the default is set for them, the consent record you are storing will not hold up.
Consent & cookiesDark patternsPersonal data - UKRegulator16 October 2020
ICO monetary penalty notice: British Airways
ICO Monetary Penalty Notice, 16 October 2020
Third-party scripts on checkout pages and hard-coded credentials are breach vectors regulators expect you to have controlled.
SecurityPayments⚖ GBP 20 million monetary penalty - EUCourt16 July 2020
Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II)
Case C-311/18, ECLI:EU:C:2020:559
Every non-EU processor (cloud, analytics, LLM API) needs a valid transfer mechanism and a documented transfer impact assessment.
International transfersPersonal data - UKCourt1 April 2020
WM Morrison Supermarkets plc v Various Claimants
[2020] UKSC 12
Least-privilege access and audit logs on bulk exports of personal data are your main defence against insider leaks and the liability that follows.
SecurityPersonal data - TRCourt26 December 2019
Wikimedia Foundation Inc. ve Diğerleri Başvurusu
Anayasa Mahkemesi (Genel Kurul), B. No: 2017/22355, 26/12/2019
UGC platforms serving Türkiye should be able to geo-restrict individual URLs quickly in response to 5651 orders, rather than risk whole-site blocking.
User content - ECHRCourt17 October 2019
López Ribalda and Others v. Spain
Applications nos. 1874/13 and 8567/13, Grand Chamber judgment of 17 October 2019
Surveillance features must support purpose limitation, time-boxing and scope controls to be defensible.
Personal data - EUCourt3 October 2019
Eva Glawischnig-Piesczek v Facebook Ireland Ltd
Case C-18/18, ECLI:EU:C:2019:821
Platforms hosting user content should be able to find and remove identical or equivalent copies of content once it is ruled unlawful.
User content - EUCourt1 October 2019
Planet49 GmbH v Bundesverband der Verbraucherzentralen
Case C-673/17, ECLI:EU:C:2019:801
Consent checkboxes and cookie toggles must default to off, and the banner must disclose cookie duration and third-party access.
Consent & cookiesDark patterns - USCourt8 August 2019
Patel v. Facebook, Inc.
932 F.3d 1264 (9th Cir. 2019)
Face-recognition features default-on for users is a class-action magnet; make them opt-in with written consent.
Biometrics⚖ USD 650 million class settlement (2021) - EUCourt29 July 2019
Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW
Case C-40/17, ECLI:EU:C:2019:629
Embedding a third-party SDK, pixel or social plugin makes you jointly responsible for the data it collects on page load; gate it behind consent.
Tracking & wiretapConsent & cookiesPersonal data - USCourt25 January 2019
Rosenbach v. Six Flags Entertainment Corp.
2019 IL 123186
Collecting any biometric identifier of Illinois residents without written notice and release creates statutory-damages exposure even with no breach.
Biometrics - USCourt15 January 2019
Robles v. Domino's Pizza, LLC
913 F.3d 898 (9th Cir. 2019)
Consumer web and mobile apps should meet WCAG 2.1 AA; accessibility suits against apps are routine.
Accessibility - EUCourt5 June 2018
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein
Case C-210/16, ECLI:EU:C:2018:388
Using a platform's analytics about your users makes you responsible for that processing even if you only see aggregates.
Personal dataTracking & wiretap - ECHRCourt24 April 2018
Benedik v. Slovenia
Application no. 62357/14, judgment of 24 April 2018
An IP address in your logs is identifying data the moment it can be resolved to a person. Treat lawful-access requests for it as requiring a proper legal instrument, and log what you disclosed.
Personal dataSecurity - ECHRCourt5 September 2017
Bărbulescu v. Romania
Application no. 61496/08, Grand Chamber judgment of 5 September 2017
Workplace and B2B monitoring features (message logging, screen capture) need advance notice, proportionality settings and purpose limits built in.
Personal data - EUCourt19 October 2016
Patrick Breyer v Bundesrepublik Deutschland
Case C-582/14, ECLI:EU:C:2016:779
Treat IP addresses in logs and analytics as personal data: define retention, legal basis and access controls.
Personal data - EUCourt13 May 2014
Google Spain SL and Google Inc. v AEPD and Mario Costeja González
Case C-131/12, ECLI:EU:C:2014:317
Products that index or surface information about people need an erasure / delisting workflow.
Personal dataUser content - EUCourt2 May 2012
SAS Institute Inc. v World Programming Ltd
Case C-406/10, ECLI:EU:C:2012:259
Re-implementing a competitor's functionality is lawful in the EU, but copying code, manuals or licence-restricted material is not.
IP & licensing
Summaries and analysis by Lawpatch, each checked by an editor against the official source it links to. This is a selection, not every decision on a topic, and it is risk analysis, not legal advice. Inside the product the corpus is larger and grows weekly from public registers.