Most internet businesses are running third-party scripts nobody has inventoried, a privacy policy that doesn’t describe what the product actually does, and a billing flow that has never been checked against California’s rules. None of that is unusual. All of it is cheaper to fix now than after someone points it out.
from $1,950 flat
A few documents and an honest look at what your site actually loads. Bounded work, one flat fee, and a written scope before anything starts.
The same handful, in nearly every case: third-party scripts running before anyone consents, a privacy policy that describes a different product than the one you shipped, a subscription flow written before California’s current rules, storage nobody has reviewed, and social proof that can’t be substantiated. Each is a small fix on its own. Together they are why a demand letter, a diligence request, or a chargeback dispute turns expensive.
These are not exotic failures. They are what happens when a product ships faster than its paperwork — which is nearly always. The gaps below are common; what varies is who notices, and when. Sometimes it is a plaintiff’s firm running automated scans. Sometimes it is an acquirer’s diligence checklist, or a payment processor, or an enterprise customer’s security review.
Web and mobile apps, Shopify and e-commerce stores, dropshipping operations, Amazon FBA sellers, subscription products, AI tools and chatbots, agencies and creators — any California-facing site running third-party scripts, billing on a recurring basis, or shipping an AI feature. Increasingly that includes products built quickly with AI coding tools, where the stack outran the paperwork.
Six gaps account for most of what turns up on a California-facing site, with what each one exposes you to when somebody does look.
| The gap | How often it’s there | What it exposes you to |
|---|---|---|
| Tracking scripts firing before consent |
Most sites | Statutory damages of $5,000 per violation under California’s wiretapping statute, and “per violation” is doing heavy lifting. Demands are sent at volume by firms running automated scans, and priced to sit just under what fighting would cost. |
| A privacy policy that doesn’t match the product |
Very common | Attorney General and CPPA enforcement, plus the quieter cost: it is the first document an acquirer, an enterprise customer, or a payment processor reads — and an inaccurate one invites the whole file to be pulled. |
| Subscription and cancellation flow written before the rules |
Most recurring billers | Consumer class actions and refund exposure. California’s rules bind in full and were strengthened in 2025 — the federal “click-to-cancel” vacatur changed nothing here, which a lot of published guidance still gets wrong. |
| A companion chatbot with no crisis protocol |
Most new AI products | The shortest path on this page from non-compliant to being sued personally: direct claims at $1,000 per violation plus attorney’s fees, which is what makes small cases worth a plaintiff lawyer’s time. |
| Storage and retention nobody has reviewed |
Common | $100–750 per consumer, per incident if data is exposed — multiplied by every user record you kept and didn’t need. Plus breach-notification duties, and the customer conversations that follow. |
| Testimonials you can’t substantiate |
Common | Federal penalties north of $50,000 per violation, and every incentivized review can count separately. Among the cheapest items here to fix and the most expensive to be caught on. |
None of this requires a bad actor. Every gap above is the ordinary result of shipping a product faster than its paperwork, and every one is materially cheaper to close now than to argue about later. Closing them is a few documents and an afternoon of looking at what your site actually loads — after which you stop wondering.
The longer version of this ranking is here.Not all of it will. The scope depends mostly on what your product does, and a short conversation usually removes more items than it adds.
Anything with analytics, ad pixels, a chat widget or session replay — which is nearly everything.
Recurring billing, free trials, or anything that converts from free to paid.
Conversational features, AI acting on user data, or a companion-style assistant.
From $1,950 · typically 5–10 business days
If you’ve already received a demand letter or been served, this isn’t the right engagement. That work moves on someone else’s deadline and needs a lawyer who handles active disputes — sooner rather than after a consultation with me. I’d rather say so on this page than after you’ve filled in a form.
This page is for the business that hasn’t received one yet, which is the far cheaper place to be standing.
from $2,500 flat
Entity formation done so the paperwork matches the plan — including the founder equity and IP assignment most DIY filings skip.
View →
from $1,500 flat
The core agreements a young company needs, customized to how you actually sell — with usage notes so you know which one to send.
View →
from $1,500/month
Ongoing counsel on a monthly retainer — review queue, compliance calendar, advisory hours, replies in one business day.
View →
Tell me what you’re running and what’s loading on it. I read every submission personally and reply within one business day — including when the honest answer is that you need less than you think.