// writing
Writing
Essays and notes, organized by audience and date.
- Data you kept but did not need is the FTC's new target The FTC's finalized Illuminate order treats data you retain without a reason as a security failure, and that framing reaches well beyond edtech. tech
- What the FTC's Amare suit means for wellness brands that sell through affiliates The FTC sued Amare Global on June 2 over supplement claims its brand partners made on social media. If you sell through affiliates, their posts are your liability. wellness
- Two AI likeness laws take effect this week and creators are in scope New York's synthetic performer disclosure rule and Washington's expanded personality rights law both go live this week, and branded content sits squarely inside them. creators
- Colorado rewrote its AI law, and your vendor contracts are the part that changed Colorado replaced its 2024 AI Act with SB 26-189, dropping impact assessments but voiding indemnity clauses and ending federal exemptions software companies relied on. tech
- What the April OCR ransomware settlements tell wellness brands about risk analysis OCR's $1.165M ransomware enforcement wave on April 23 hinges on one missing document. Wellness operators handling any HIPAA-adjacent data should treat this as a deadline. wellness
- The Take It Down Act compliance deadline lands this week On May 19, 2026, the federal Take It Down Act's platform compliance deadline takes effect, giving creators a new 48 hour takedown right against intimate deepfakes. creators
- Connecticut just passed the broadest state AI law on the books Connecticut's SB 5 layers chatbot disclosure, synthetic media provenance, frontier model rules, and AI hiring transparency into a single statute with staggered 2026 to 2027 effective dates. tech
- What the TruHeight order means for wellness review pipelines The FTC's TruHeight order is more useful for its review-pipeline implications than its substantiation findings, and the operational consequences for wellness brands are concrete. wellness
- What the new $2,500 NIL threshold actually changes The College Sports Commission raised its NIL Go review floor from $600 to $2,500. The operational change is larger than the headline suggests. creators
- "Reasonable security": what the FTC's latest SaaS order means for your startup A consent order against a SaaS CRM whose weak security let attackers walk off with $186 million is not a story about someone else. It is a roadmap for what regulators now expect. tech
- Vendor diligence is the new sales channel Procurement and security review are now where SaaS deals are won or lost. The companies that treat the questionnaire as a sales asset have a real advantage. tech
- Business associate agreements for non-clinical wellness apps Wellness platforms partnering with healthcare providers keep signing BAAs without understanding what they are signing. The recent enforcement uptick is a useful prompt to look again. wellness
- Why your social handle is not a trademark Creators routinely conflate owning a username with owning the underlying brand. The trademark register treats the two very differently. creators
- AI agents and the legal meaning of agent The word 'agent' in 'AI agent' borrows from a legal concept with two centuries of doctrine behind it. The borrowing is creating problems. tech
- Washington's My Health My Data Act applies to you Operators outside Washington keep concluding the law does not reach them. Most of them are wrong, and the obligations are not light. wellness
- Dark patterns rules are about to reach the creator economy The FTC and state regulators have spent years sharpening the dark-patterns doctrine on subscriptions and checkout flows. The next surface is creator monetization. creators
- What the Florida Digital Bill of Rights actually does Florida's privacy law was framed as 'Big Tech only' when it passed. The thresholds are narrower than that, and the outline of who actually has to comply is worth understanding. tech
- Health claims after the FTC's latest wellness consent order A recent consent order against a wellness brand for unsupported claims is a useful map of what the agency now expects the substantiation file to look like. wellness
- Section 230 and the platform problem creators keep running into Section 230 is supposed to protect platforms. The way it functions in 2026 also protects platforms from the creators they host. creators
- SOC 2 will not save you in diligence Founders treat the SOC 2 report as a finish line. Buy-side diligence teams treat it as the floor of a much longer conversation. tech
- Telehealth across state lines after the latest enforcement actions The pandemic-era licensure flexibilities are gone, and state medical boards in 2026 are pursuing telehealth providers with renewed focus. wellness
- FTC endorsement disclosures, version 2026 The Endorsement Guides got teeth two years ago, and the enforcement trend in 2026 is worth understanding before your next campaign. creators
- AI training data and the contracts your enterprise customers will start asking for Enterprise procurement is now asking SaaS vendors what their AI features were trained on. The answers founders give today will be quoted back to them later. tech
- Where wellness meets HIPAA, and where it does not Most wellness operators believe HIPAA does not apply to them. They are usually right and increasingly often wrong. wellness
- Why your NIL deals are starting to look like SaaS contracts Brand deals for athletes and influencers are quietly absorbing the structure of enterprise software agreements, and not always for the athlete's benefit. creators
- Why the NIST Cyber AI Profile will not save your business NIST's draft AI cybersecurity framework is thoughtful, slow, and aimed at a level of AI maturity most businesses do not have. The work you need to do is more boring than that. tech
- The 2026 privacy law map for SaaS founders The patchwork of state privacy laws hit a new milestone on January 1, and most SaaS companies are now in scope of more than they realize. tech
- The Florida wiretap theory aimed at your website Plaintiff firms are using a 1969 wiretap statute against standard website analytics, session replay, and chat. The legal theory is shaky, the settlement pressure is not. tech
- What the Trump AI executive order changes for state compliance The December 2025 executive order tries to clear out state AI laws through federal preemption. For now, it produces more uncertainty, not less. tech
- California is making executives personally certify privacy compliance Starting in 2026, California's privacy regulations push risk assessment and cybersecurity audit certifications onto a named executive under penalty of perjury. The exposure is national, not just California. tech
- Loss of Value insurance for college athletes, and why some claims pay LOV and PTD coverage can be the financial floor a draft-eligible athlete needs. The difference between a payout and a denial usually traces back to how the policy was structured, not to how the injury happened. creators
- When your vendor gets breached, the liability stays with you Outsourcing data handling does not outsource the regulatory exposure. The contract terms that protect you have to be in place before the incident, not after. tech
- California's frontier AI law and what it actually requires SB 53 made California the first state with a binding transparency regime for frontier AI developers. The practical scope is narrower than the headlines, and the real exposure for most businesses is downstream. tech
- What AI content actually costs you when it goes wrong The hidden bill behind AI-generated marketing is not the subscription fee. It is the copyright, defamation, and ownership exposure most companies never priced in. tech
- Algorithmic bias is the employer's problem, not the vendor's When a hiring or lending algorithm produces discriminatory outcomes, the legal exposure runs to the business that deployed it. The software contract almost never changes that. tech
- AI in hiring, and the way the EEOC actually thinks about it Hiring algorithms are now treated like any other employment test. The agencies are not waiting for Congress to catch up. tech
- What the Florida CHOICE Act actually changes about non-competes Florida already had the most employer-friendly non-compete regime in the country. The CHOICE Act, in effect since July 2025, tilts the field further. Here is what is genuinely new. tech
- What the Crumbl case is teaching about audio on social The Warner Music lawsuit against Crumbl Cookies is the most expensive object lesson yet on what 'trending audio' actually costs a brand. tech
- Florida's two-party consent rule, and the lawsuit risk most businesses miss Recording a call without the consent of everyone on it is a $1,000 minimum per interception in Florida. Most businesses do not realize they are inside the statute. tech
- What an AI policy needs to actually cover Most AI policies I read are a paragraph about responsible use and a list of approved tools. That is not an AI policy. Here is what actually belongs in one. tech
- Florida's cybersecurity safe harbor, on its third try The Giallombardo cybersecurity liability bill keeps coming back. The 2026 version (HB 635) is the closest yet, and worth understanding before it lands. tech
- The three buckets of IP, and why most businesses misallocate Copyright, trade secret, and trademark are not interchangeable. Most companies overweight one and underweight the others. Here is how to think about the mix. tech
- NIL and the NFL draft decision after House For a college football player weighing the NFL draft, the financial calculus changed twice: once when NIL arrived, and again when the House settlement turned schools into direct payors. creators
- SIM swap and the end of SMS as a second factor SMS-based two-factor authentication was never very good, and the SIM swap attack is the reason. The carrier rules tightened in 2024, but the underlying weakness has not gone away. tech
- Ransomware after CIRCIA and the enforcement wave Ransomware stopped being only an IT problem several years ago. After the 2024 wave of enforcement actions and the CIRCIA reporting rules, it is a regulatory problem with operational consequences attached. tech
- The guards of innovation: trademarks and patents in plain terms The most common IP mistake founders make is treating trademarks and patents as the same conversation. They protect different things, and the order in which you pursue them matters. tech
- Registering your handle as a trademark The handle is not the trademark, but the brand built around the handle often can be registered. The application turns on three questions most creators get wrong on the first try. creators
- Legal risks of running a business on social media Anyone whose income depends on a social platform is operating a business on infrastructure they do not own, under terms they cannot negotiate, with liability exposure most operators underestimate. creators
- Who actually owns the IP Founders, employees, contractors, and acquirers routinely disagree about who owns a given piece of intellectual property. The disagreement is almost always traceable to a document that was never signed. tech
- Software IP: patent or trade secret For most software businesses, the choice between patent and trade secret protection is not a question of which is stronger. It is a question of which is appropriate for the specific invention and the specific company. tech
- Software contracts are not like talking to Google Founders sign templates that assume their startup is a small version of a tech giant. The legal architecture of a software company is nothing of the kind. tech
- The first 24 hours after a data breach in 2026 The legal clock on a data breach response is shorter than it used to be, and the regulators are no longer asking nicely. tech
- The legal risks social media influencers actually face Most influencer legal exposure is not on the platform's side of the ledger. It is on yours. creators
- Patenting software after Alice, and what the AI inventorship cases mean Software patents are still available, but the framework has narrowed and the AI inventorship question has now been answered. tech
- Foreign-made drones after the DJI restrictions The legal and security architecture around foreign-made drones changed substantially in 2024 and 2025, and operators are still flying as if it did not. tech
- What HIPAA compliance actually requires of a covered entity HIPAA compliance is not a checklist; it is a documented program. The 2024 proposed Security Rule update raises the bar substantially. wellness
- Enforcing IP rights without a patent or registered trademark Unregistered IP can still be defended, but the doctrines are narrower, the geography is smaller, and the timing pressure is real. tech
- The desktop cybersecurity threats that actually matter in 2026 The threats facing the average desktop user are mostly the same ones, dressed in better disguises and powered by AI. tech