Can your vibe-coded app be sued for $100K before its first sale? We checked six claims

Does a sign-up form without an age question break COPPA?

Not on its own. The reel says the first 12-year-old who joins costs "$53,000 under COPPA". The figure is right: the maximum civil penalty is $53,088 per violation, and the FTC kept the 2025 figure in September 2026. The trigger is wrong. The FTC's own guidance says the rule "does not require operators of general audience sites to investigate the ages of visitors".

COPPA applies when a service is aimed at children under 13, or when the operator actually knows a user is under 13. A general-audience app that never asks for age, and never learns a user's age, is not in breach simply because a child signed up. The FTC and state attorneys general enforce it; users cannot sue under COPPA themselves.

• The fix: say in your terms that the app is for people aged 13 and over, do not design it to appeal to children, and if you do ask for age, ask neutrally and delete any account that reports being under 13. Compliance with most of the updated COPPA rule has been required since 22 April 2026.

Can loading Google Fonts really cost €100 per visitor?

In Germany it did once, but that is not the whole story. On 20 January 2022 the Munich regional court ordered a website operator to pay a visitor €100 under GDPR Article 82, because the site loaded fonts from Google's servers and so sent the visitor's IP address to Google without consent (LG München I, 3 O 17493/20). The court noted the fonts could have been hosted on the site's own server.

A wave of automated demand letters followed. Berlin prosecutors raided a lawyer's office over them in December 2022, and on 30 March 2023 the same Munich court rejected a claim built on automated visits (LG München I, 4 O 13063/22), reasoning that someone who never personally visited a site cannot personally be upset by it. A German ruling does not bind UK courts, and the UK Supreme Court's Lloyd v Google judgment, decided under the older Data Protection Act 1998, held that damages need proof of financial loss or distress rather than mere loss of control over data, which makes small claims of this kind hard to bring in the UK.

• The fix: self-host your fonts. It takes minutes, removes the risk entirely and usually makes the page load faster.

Is session replay wiretapping under California law?

It is disputed, not settled. The reel says session replay "in California counts as wiretapping at $5,000 per session". California's Invasion of Privacy Act does allow $5,000 per violation without proof of harm, and many session-replay lawsuits have been filed under it. But three federal appeals courts have thrown out session-replay wiretap suits where users browsed without entering personal details, holding that the plaintiffs suffered no concrete injury and so had no standing to sue: Popa v Microsoft in the Ninth Circuit and Cook v GameStop in the Third, both under Pennsylvania's wiretap law, and Jones v Bloomingdale's in the Eighth, under Missouri law and the federal wiretap statute. The same standing rule applies to a CIPA claim in federal court, though not in California's own state courts. And "per session" is the plaintiffs' reading of a statute that says "per violation".

The risk sits in what users type. In a May 2026 Third Circuit decision, In re BPS Direct, six plaintiffs who only browsed were dismissed, but claims survived for two shoppers whose names, addresses and payment details were captured at checkout. A California reform bill, SB 690, was awaiting the Governor's decision when we checked on 28 September; as passed, it does not cover the wiretapping section these suits rely on.

Defaults vary by tool. Microsoft Clarity masks input fields and PostHog masks inputs by default, while LogRocket records inputs other than password fields unless you configure it otherwise.

• The fix: switch session replay off if you do not use it. If you do, mask every input, exclude login and checkout pages, load it only after consent, and mention it in your privacy policy.

Is a launch email without an unsubscribe link a $53,000 fine?

That is the ceiling, not the likely cost. Under the US CAN-SPAM Act, every commercial email must include a way to opt out and a valid postal address, and a launch email to a waitlist counts as commercial (FTC guide). The maximum penalty is $53,088 per email. But recipients cannot sue under CAN-SPAM. Enforcement comes from the FTC, state attorneys general and internet access providers, and the damages the last two can claim are far smaller: up to $250 per email for a state, capped at $2 million for most violations, and up to $25 per email for a provider (or $100 for emails with false headers), capped at $1 million.

In the UK, PECR governs marketing email. People who joined a waitlist to hear about your launch have usually agreed to that email, but every message still needs a simple way to opt out.

• The fix: send through an email service such as Resend, Postmark or Mailchimp, and fill in the footer: company name, postal address and unsubscribe link. A registered PO box is acceptable as the address.

Does every California renewal become a gift you must refund?

No. California's automatic renewal law does require the renewal terms to appear "in visual proximity" to the subscribe button, with tighter rules for contracts made since 1 July 2025. And section 17603 does call goods sent without proper consent an "unconditional gift". But it says nothing about refunds, and a California appeals court held in Mayron v Google that consumers cannot sue under that law directly. They have to use the state's unfair competition law and show they lost money. Refunds do happen, through settlements and restitution, which is why the gap is still worth closing.

At federal level, the FTC's click-to-cancel rule was struck down by the Eighth Circuit in July 2025, and the FTC has since restored its earlier rule and begun a new rulemaking.

• The fix: put the price, the renewal period and how to cancel right next to the subscribe button, email a confirmation after sign-up, and turn on Stripe's customer portal so people can cancel themselves.

Does a missing DMCA agent make you liable for $150,000 per image?

No. If your users upload content, registering a designated agent with the US Copyright Office is one condition of the "safe harbour" that shields you from copyright claims over what they post (17 USC 512); the others include taking material down promptly when notified and having a policy for repeat infringers. The fee is $6 and the registration lapses after three years unless renewed. Without it you lose that shelter, but you are not automatically liable: the copyright owner still has to prove infringement, and your other defences remain.

Statutory damages are $750 to $30,000 per work, not per post, and reach $150,000 only for wilful infringement. They are also available only for works registered in time, which rules them out for most photos people upload as profile pictures.

• The fix: register the agent, publish a short copyright page saying how to report infringement, and put the renewal date in your calendar.

Is it true that nothing on the list is a percentage of revenue?

Partly. The US penalties above are set per violation, not as a share of revenue, which is why the reel stresses the word "per". But they are maximums: for FTC civil penalties, the law requires courts to weigh culpability and ability to pay. And for data protection in the UK and EU, regulators' fines are capped at a percentage of worldwide turnover (4 percent at the top tier) or a fixed sum, whichever is higher.

Quotable result: A reel claiming a vibe-coded app can be sued for $100,000 before its first sale quotes mostly real maximum penalties, but checked against the law, four of its six claims are overstated, one is partly right and one holds only as a single 2022 German ruling.

What should you fix before launch?

Fix all six. None is expensive, and each removes a risk that is easy to avoid, even if it is smaller than the reel suggests. This is also a useful checklist to hand to an AI coding tool, as long as someone checks the result.

Source: Conceptdigital's review of the statutes, regulator guidance and rulings linked in this article, as of 28 September 2026.

What does this review not cover?

This article checks the six claims in one reel. It does not cover everything a new app needs.

• Not legal advice. Laws differ by country and state, and your facts matter. Speak to a lawyer for your situation.
• US-heavy. Five of the six claims are about US or Californian law. UK and EU apps have their own duties under UK GDPR, the EU GDPR, PECR and the ePrivacy rules, including cookie consent.
• Other gaps. A privacy policy, cookie consent, terms of service, accessibility and security are not on the reel's list, and they matter at least as much.
• A moving target. SB 690 and the FTC's subscription rulemaking were in progress, and the UK's data law reforms were still being phased in, when we checked.

Frequently asked questions

Does my app have to ask users their age under COPPA?

No. The FTC's COPPA guidance says the rule does not require general-audience sites to investigate the ages of visitors. COPPA applies when a service is directed to children under 13 or the operator actually knows a user is under 13, with a maximum civil penalty of $53,088 per violation. Stating a 13-and-over age limit and deleting accounts that report being younger is the usual approach.

Is using Google Fonts illegal under GDPR?

Loading Google Fonts from Google's servers sends visitors' IP addresses to Google. In January 2022 a Munich court awarded a visitor €100 under GDPR Article 82 for this, but later mass claims based on automated visits were rejected, and prosecutors investigated the demand-letter campaign. Self-hosting the fonts removes the issue entirely.

Is session replay legal in California?

Session replay is not banned in California, but it has drawn many lawsuits under the California Invasion of Privacy Act, which allows $5,000 per violation. Federal appeals courts have dismissed session-replay wiretap suits where users browsed without entering personal details, for lack of any concrete injury, while a May 2026 Third Circuit ruling let claims proceed where checkout details were captured. Masking inputs and excluding checkout and login pages is the safer set-up.

What does CAN-SPAM require in a launch email?

Under CAN-SPAM, a commercial email, including a launch email to a waitlist, must include a working way to opt out, honoured within 10 business days, and a valid physical postal address. The maximum penalty is $53,088 per email, but recipients cannot sue; enforcement comes from the FTC, state attorneys general and email providers.

Do I need a DMCA agent for user uploads?

If users can upload content to your app, registering a designated agent with the US Copyright Office for a $6 fee is a condition of the safe harbour against claims over what they post, alongside prompt takedowns and a repeat-infringer policy. Without an agent you lose that protection but are not automatically liable. Statutory damages run from $750 to $30,000 per registered work, up to $150,000 for wilful infringement.

Credit: the six traps come from an Instagram reel that asked viewers to send it to an AI assistant to fix their apps. The legal checks and commentary are ours. This article is general information, not legal advice.

About the author: Tengo Meskhi is CEO of Conceptdigital. He was previously at McKinsey and QuantumBlack, and Deputy CIO at Bank of Georgia.