Skip to content
North End Law
Guides

Website and app legal documents

These guides cover the documents a website or a mobile app must publish (the privacy policy and the terms of use) and the tracking tools that sit behind them: cookies, pixels, analytics, session replay, testing tools and conversion APIs.

In California, tracking tools are also a litigation question under the California Invasion of Privacy Act. The guides on each tool explain what it does in law and what to check.

Guides in this section

  • Received a CIPA demand letter about your website? What to do first

    What a California Invasion of Privacy Act demand letter claims, what SB 690 changes, and the first steps to take before you answer or pay.

    Last reviewed

  • Privacy policies

    What a privacy policy must do: describe the company's actual data practices, give the disclosures the law requires, stay readable, and be kept current.

    Last reviewed

  • Terms of service

    What website and product terms of service should cover: acceptable use, limits of liability, rights to change and terminate, and dispute resolution.

    Last reviewed

  • Cookies, pixels & trackers

    How consent rules apply to cookies, pixels and trackers: a consent platform, correct categories, blocking before consent, and a record of every tracker.

    Last reviewed

  • Session Replay Tools

    Why session replay tools attract wiretapping claims and privacy enforcement, how consent rules differ by jurisdiction, and what masking and vendor setup do.

    Last reviewed

  • Conversion APIs

    Privacy questions raised by conversion APIs that send events server to server: passing consent signals, minimizing event data, and platform requirements.

    Last reviewed

  • Digital Analytics

    Privacy questions in website and app analytics: issues with Google Analytics, privacy-friendly alternatives, consent, and transfers of data abroad.

    Last reviewed

  • A/B Testing

    When A/B testing needs consent under privacy rules: essential and non-essential tests, legitimate interest assessments, personalization and dark patterns.

    Last reviewed

  • Health Apps (Mobile)

    Which rules reach consumer health apps when HIPAA does not: the FTC Health Breach Notification Rule, state health privacy laws, and FDA device rules.

    Last reviewed

  • Ad-funded Mobile Games

    How COPPA, as amended by the FTC in 2025, applies to ad-funded mobile games: age gating, limits on advertising, and data minimization for young users.

    Last reviewed

From the author's publications

Where the firm does this work