法务审查与上线准备
Legal Review & Launch Readiness
从完整草案到可上线协议，需要把业务事实、法律选择和真实系统证据对齐。本清单为律师、业务、隐私、支付及工程负责人提供同一份交接基线。
Turning substantive drafts into operative terms requires alignment between business facts, legal choices and actual system evidence. This checklist gives legal, business, privacy, payments and engineering one review baseline.
这份资料的交付边界
What this pack does and does not establish
17份双语实质条款已形成可审阅文本，但主体、法域、供应商、商业承诺及操作证据尚未确定。必须由能覆盖实际注册地和销售市场的执业律师审定，不能称为律师已编写或已审核。
The 17 bilingual substantive drafts are reviewable text. Entities, jurisdictions, providers, commercial commitments and implementation evidence remain unresolved. Qualified counsel covering the actual incorporation and sales markets must approve them; they must not be described as already written or reviewed by counsel.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 法务交付Legal deliverables | SaaS服务、计费、隐私、Cookie、DPA、AUP、AI、SLA、投诉9份平台文件；销售、隐私、Cookie、配送、退款、支付、AI客服、可访问性8份店铺文件。Nine Platform documents: service, billing, privacy, Cookies, DPA, AUP, AI, SLA and complaints. Eight store documents: sales, privacy, Cookies, shipping, returns, payments, AI support and accessibility. | 待确认Open |
| 不具备的结论Conclusions not established | 没有法律意见书、监管许可、GDPR/PCI/SOC认证、已生效SCC、真实律师签章或对所有国家通用的合规结论。No legal opinion, regulatory license, GDPR/PCI/SOC certification, executed SCCs, actual lawyer sign-off or all-country compliance finding is supplied. | 待确认Open |
| 服务身份Service roles | 平台提供软件；商户是卖方并接收PSP结算；平台订阅独立收款。由律师验证真实资金流及活动是否改变该判断。The Platform supplies software; merchants are sellers and receive PSP settlements; Platform subscriptions are billed separately. Counsel must validate whether actual funds flows and activities change these roles. | 待确认Open |
| 发布状态Publication state | 官网可展示明确标识的草案和建议价。商户生产协议、收款和交易开放须使用批准版本，并确保未填example会阻止正式发布。The website may display clearly labeled drafts and proposed prices. Operative merchant terms, charging and trading require approved versions and a release block for unresolved example fields. | 待确认Open |
需要实际律师决定的事项
Decisions required from qualified counsel
法律审查应围绕真实业务事实进行。不要在未知公司和市场的情况下先填一个方便的管辖地，再把全部协议套用到全球。
Legal review must follow actual business facts. Do not choose a convenient jurisdiction before the company and markets are known and apply that choice worldwide.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 主体和公司法Entities and corporate law | 确定合同公司、集团关系、注册号、注册地址、商号和公司披露义务；确认Aster品牌、域名和商标可用性。Determine contracting entity, group relationships, registration, address, trading name and company disclosures; assess Aster brand, domain and trademark availability. | 待确认Open |
| 销售模型Sales model | 明确B2B平台订阅与B2C店铺交易；是否提供数字内容、服务或商户自己的商品订阅；是否是市场平台、代理、MoR或其他受监管角色。Separate B2B Platform subscriptions from B2C store sales; identify digital content, services and merchant product subscriptions; assess marketplace, agency, MoR and other regulated roles. | 待确认Open |
| 法域矩阵Jurisdiction matrix | 分别确定平台注册地、商户注册地、消费者惯常居所、发货和收货国、服务器及远程访问地；给每个销售市场配置适用分支。Map Platform and merchant establishment, consumer habitual residence, dispatch and destination countries, and hosting and remote-access locations; configure each supported market separately. | 待确认Open |
| 风险分配Risk allocation | 审定12个月费额普通上限、2倍特殊上限、不可限责任、赔偿、防御、保密、保证、不可抗力、终止、退款及保险。Review the proposed 12-month ordinary cap, two-times special cap, nonlimitable liability, indemnity and defense, confidentiality, warranties, force majeure, termination, refunds and insurance. | 待确认Open |
| 争议与消费者Disputes and consumers | 填写法律和法院/ADR，确认不能剥夺消费者强制权利；审查任何仲裁、诉讼时限或集体诉讼限制，本模板未默认加入这些限制。Set law, courts and ADR while preserving mandatory consumer rights; review any arbitration, limitation period or class-action restriction, none of which is automatically imposed here. | 待确认Open |
| 中英文等效Bilingual equivalence | 律师或合资格法律翻译逐节核对两种语言；确定法定语言要求及有效接受方式；不能默认英文一律压过消费者所见版本。Counsel or qualified legal translators must align both languages clause by clause, assess mandatory language and acceptance, and avoid assuming English always overrides the consumer-facing version. | 待确认Open |
| 平台专项义务Platform-specific duties | 根据实际托管/传播/撮合功能评估通知删除、产品安全、商户识别、平台透明度和税务报送等规则；“不是MoR”不能自动排除这些义务。Assess notice-and-action, product safety, merchant identification, platform transparency and tax-reporting requirements based on actual hosting, dissemination and facilitation. “Not MoR” does not automatically eliminate them. | 待确认Open |
| 专项附件Special addenda | 如适用，补充完整并签署的SCC/UK转移附件、供应商DPA、国家消费者附件、DMCA机制、受监管品类条件、自部署软件许可及企业订单。Where applicable, add complete executed SCC/UK transfer instruments, provider DPAs, national consumer addenda, DMCA procedures, regulated-category conditions, self-hosted software licensing and enterprise orders. | 待确认Open |
按目标市场核验的法律分支
Market-specific legal branches
以下是已查阅原始资料支持的适用性问题。日期和立法状态仍需在真正上线时再次核对。
The following applicability issues are supported by reviewed primary sources. Dates and legislative status must be checked again at actual launch.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 欧盟 / EEAEU / EEA | 评估GDPR角色、处理依据、Art28合同、权利响应、DPIA、跨境措施和可能的代表/DPO；消费者条款按各成员国实施规则处理14日撤回、数字内容例外及缺陷救济。Assess GDPR roles, bases, Article 28 contracts, rights, DPIAs, transfers and any representative/DPO. Consumer rules require Member State implementation of withdrawal, digital-content exceptions and defect remedies. | 待确认Open |
| 欧盟在线撤回EU online withdrawal | 2023/2673新增的Article11a要求符合条件的在线合同提供撤回功能；成员国措施自2026-06-19适用。明确入口、持续可用、确认、原始时间和持久媒介回执，不把全部商品都设为可无条件退。Article 11a added by Directive 2023/2673 requires a withdrawal function for covered online contracts; Member State measures apply from 19 June 2026. Provide clear access, continuous availability, confirmation, original submission time and a durable receipt, without treating every product as unconditionally returnable. | 待确认Open |
| 欧盟ODR及可访问性EU ODR and accessibility | 旧ODR平台于2025-07-20停止；不要保留旧投诉入口。电商可能受EAA及国家实施法约束，须评估适用范围、实际测试、豁免条件和公开声明。The former ODR platform stopped on 20 July 2025; do not retain a dead complaint route. E-commerce may be subject to the EAA and national implementation; assess scope, testing, exemption conditions and disclosures. | 待确认Open |
| 英国United Kingdom | ICO在2026-04-29发布更新后的存储与访问技术指引，包含特定统计/外观等条件性例外。核验每项条件、同意、反对机制、UK GDPR跨境安排及英国消费者规则。ICO finalized updated storage-and-access guidance on 29 April 2026, including conditional statistical and appearance exceptions. Check every condition, consent, objection controls, UK GDPR transfers and UK consumer rules. | 待确认Open |
| 美国United States | 区分FTC Act/ROSCA、州自动续费与隐私规则、特定品类及联邦发货规则。2024 click-to-cancel修正已被撤销，2026-02-12恢复旧文本；2026-03启动新征询并不等于新规则已生效。Distinguish FTC Act/ROSCA, state renewal and privacy rules, product rules and federal shipment requirements. The 2024 click-to-cancel amendments were vacated, with prior text restored on 12 February 2026. New March 2026 consultation is not an operative new rule. | 待确认Open |
| 印度（可选）India (optional) | 若选择印度市场，应复核DPDP Act的生效通知、2025最终Rules及后续修正的分阶段实施，并另查电商消费者、支付、GST及本地披露。不能把2025年1月草案或全部未来义务当作当前统一生效规则。If India is selected, verify the DPDP Act commencement notification, phased final 2025 Rules and later amendments, plus e-commerce consumer, payments, GST and local disclosures. Do not treat the January 2025 draft or all future duties as uniformly operative today. | 待确认Open |
| 其他市场与排除Other markets and exclusions | 未配置的市场暂不开放结账和相关推广。新市场需律师完成条款、语言、税务、物流和数据映射；地理限制应透明且合法，不能掩盖已接受订单义务。Keep checkout and relevant promotion disabled for unconfigured markets. New markets require legal, language, tax, shipping and data mapping. Geographic restrictions must be transparent and lawful and cannot hide duties for accepted orders. | 待确认Open |
支付及订阅的上线证据
Payment and subscription release evidence
协议应反映已验证的支付行为。以下事项应由支付负责人、工程和法务一起验收。
Terms must reflect verified payment behavior. Payment operations, engineering and legal should jointly accept the following.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| PSP关系PSP relationships | 平台订阅PSP与各商户PSP的账户、合同、账单描述、收款人和结算去向分别明确；没有未经设计的汇总收款或代付。Separately identify Platform and merchant PSP accounts, contracts, statement descriptors, payees and settlement destinations, without an undesigned pooled-collection or payout flow. | 待确认Open |
| 卡数据范围Card-data scope | 采用PSP托管或安全嵌入流程，证实PAN/CVV不进入自有表单、日志、浏览器回放、AI上下文和工单；由PSP/专业人员确认实际PCI范围。Use hosted or secure embedded PSP flows and prove PAN/CVV do not reach own fields, logs, replay, AI context or tickets. Confirm actual PCI scope with the PSP or qualified specialists. | 待确认Open |
| 真实账单状态Actual billing states | 验证签名webhook、事件去重、重放保护、主动对账、幂等和订阅权益状态；付款失败不得显示成功，跳转页不能单独触发交付。Verify signed webhooks, event deduplication, replay protection, reconciliation, idempotency and entitlement states. Failed payment must not show success and a return page alone cannot trigger fulfillment. | 待确认Open |
| 预览建议价Proposed preview prices | Launch $39/月或$390/年；Grow $99/$990；Scale $249/$2490。年付总额一次收取、12个月服务、相当于10个月月价；年折扣16.67%。不宣称成本或利润已验证。Launch $39/month or $390/year; Grow $99/$990; Scale $249/$2,490. Annual total is charged once for 12 months at ten times monthly price, a 16.67% reduction. No validated cost or margin claim is made. | 待确认Open |
| 订阅同意Subscription consent | 购买前显示周期、总价、税费、下一扣款、自动续订及取消；独立未勾选授权、保留版本和时间、发送可保存确认；营销同意独立。Show period, total, tax, next charge, auto-renewal and cancellation before purchase. Use separate unselected authorization, retain version and time and provide a retainable confirmation. Marketing consent is separate. | 待确认Open |
| 无试用与无自动超额No trial or automatic overages | 本方案无免费试用转付费和自动超额收费；额度耗尽不突然扣费，也不能阻止既有订单售后、取消或必要导出。The proposal has no trial-to-paid conversion or automatic overage billing. Exhausted allowances must not trigger surprise charges or prevent existing after-sales service, cancellation or necessary export. | 待确认Open |
| 取消及提醒Cancellation and reminders | 验证“设置→账单→取消续订”的线上路径及无法登录的备用人工路径；可保存回执；年付30/7日、月付7日是拟议提醒承诺，须验证投递与各地时限。Validate Settings → Billing → Cancel renewal and a human alternative if sign-in fails, with a retainable receipt. Annual 30/7-day and monthly seven-day reminders are proposed commitments requiring delivery and local-timing checks. | 待确认Open |
| 退款审批和边界Refund approval and limits | 逐笔商户人工审批；批准绑定订单、金额、币种和版本；执行时重算PSP可退captured/settled余额，扣除成功及pending退款，验证并发及幂等。Require merchant human approval per refund, bound to order, amount, currency and version. Recalculate PSP-eligible captured/settled balance at execution, subtract successful and pending refunds and verify concurrency and idempotency. | 待确认Open |
| 失败与法定金额Failures and amounts legally owed | 记录PSP失败、不可原路返还、拒付已退金额和替代路径。资金校验不缩减法定债务，人工审批队列不暂停消费者法定时间。Record PSP failures, unavailable original methods, chargeback reimbursements and alternatives. Financial checks do not reduce legal debt and human approval queues do not pause consumer deadlines. | 待确认Open |
DPA、Cookie和数据清单
DPA, Cookie and data inventories
下列清单必须从真实系统和供应商合同形成，而不是让Agent补出看起来合理的信息。
Build these registers from actual systems and provider contracts, not from plausible details invented by an agent.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 处理活动Processing activities | 逐字段记录来源、目的、法律依据、主体、租户、授权、接收方、国家、保留和删除动作；特别区分平台控制数据与商户控制数据。For each field record source, purpose, basis, data subject, tenant, authorization, recipients, countries, retention and deletion, distinguishing Platform-controlled from merchant-controlled data. | 待确认Open |
| 子处理者Subprocessors | 真实法定名称、服务、数据范围、地点、远程访问、合同、训练政策、日志期限及安全措施；变更通知、反对和替代路径均可执行。Actual legal name, service, data scope, locations, remote access, contract, training policy, log period and safeguards, with functioning change notices, objections and alternatives. | 待确认Open |
| 跨境附件Transfer annexes | 出口/进口方、选用机制、模块和附件、监督机关、影响评估及补充措施全部完成并有效签署。仅出现SCC字样没有法律效果。Complete and execute exporter/importer identity, mechanism, module and annexes, authority, risk assessment and supplementary measures. Merely writing SCC has no execution effect. | 待确认Open |
| 安全措施Security controls | 验证租户隔离、RBAC、MFA、加密、密钥托管、备份演练、日志脱敏、漏洞修复、人员保密和访问撤销；记录证据和负责人。Verify tenant isolation, RBAC, MFA, encryption, key custody, restoration exercises, masked logs, vulnerability remediation, personnel confidentiality and access revocation, with evidence and owners. | 待确认Open |
| 保存与删除Retention and deletion | 拟议合同：终止后导出30日；导出期结束后生产数据30日内删除，备份以同一起算点90日内清除。发票、法定证据等例外需独立理由和期限，恢复备份后重用删除记录。Proposed contract: 30-day post-termination export; production deletion within 30 days after export closes and backups within 90 days from that same point. Invoices or required evidence need separate reasons and periods, with deletion records reapplied on restore. | 待确认Open |
| 泄露响应Breach response | DPA首报24h是待验证服务目标，不是所有法域监管报告时限；知悉后无不当延迟通知、分阶段更新、保留证据并按控制者角色协调。The 24-hour DPA first notice is an unvalidated service target, not a universal regulator deadline. Notify without undue delay on awareness, update in stages, preserve evidence and coordinate by controller role. | 待确认Open |
| 权利请求Rights requests | 所有权利入口可达、适度核验、按法域计时、转交商户不丢失原时间；删除、保留例外、撤回同意及人工作出决定有记录。Rights routes must be accessible with proportionate verification, jurisdictional clocks and forwarding without losing original time; record deletion, retention exceptions, withdrawal and human decisions. | 待确认Open |
| Cookie登记Cookie register | 列实际名称、设置方、域、目的、分类、寿命、接收方和依据；首访拒绝、撤回、脚本实际拦截、第三方嵌入及适用退出信号经过实测。List actual names, setters, domains, purposes, categories, lifetimes, recipients and bases; test first-visit refusal, withdrawal, script blocking, embeds and applicable opt-out signals. | 待确认Open |
| 未成年人Children | 确定是否面向或可能收集儿童数据，核对年龄和监护要求，避免收集过多身份证明；默认商业平台定位不能替代具体店铺评估。Determine targeting and likely collection of children’s data, verify age and guardian rules, and avoid excessive identity documents. Default business positioning does not replace each store’s assessment. | 待确认Open |
Agent与法务发布控制
Agent and legal-publication controls
可审计的权限和人工决定应在代码中实现，并通过实际场景验收。
Auditable permissions and human decisions must be implemented in code and validated with actual scenarios.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 工具授权Tool authorization | 租户、店铺、工具、额度和动作均经服务端验证；文档、网页和消息中的指令不能扩大权限；禁将PSP密钥交给模型。Enforce tenant, store, tool, budget and action permissions server-side. Document, web or message instructions cannot expand access. Never provide PSP secrets to models. | 待确认Open |
| 高影响动作High-impact actions | 退款、价格发布、付款配置、权限、批量删除和协议发布需对应具体版本批准；有撤回、审计、失效和重批机制。Bind approval to the exact version for refunds, price publication, payment setup, permissions, bulk deletion and operative terms, with revocation, audit, expiration and reapproval. | 待确认Open |
| 法律结论Legal conclusions | Agent不得自行改动适用法律、法定期限、责任上限或消费者权利。模板必须经过法域选择、律师审阅、中英校对和负责人批准再生效。Agents must not independently alter law, statutory periods, caps or consumer rights. Templates require jurisdiction selection, legal review, bilingual checking and owner approval before adoption. | 待确认Open |
| 消费者请求Consumer requests | AI只辅助查询和起草；拒绝法定权利、权益争议、期限临近和支付异常有人工升级。不能要求顾客与AI反复争辩才能联系真人。AI assists lookup and drafting. Rights refusals, disputes, approaching deadlines and payment anomalies have human escalation. A customer must not repeatedly argue with AI to reach a person. | 待确认Open |
| 真实性Truthfulness | AI客服身份清楚，订单/退款状态有真实数据；没有伪造客户数、增长率、评价、律师审阅、合规认证或生产SLA历史。Identify AI clearly and substantiate order/refund status. Do not invent customer counts, growth, reviews, legal approval, certification or production SLA history. | 待确认Open |
| 发布门禁Publication gate | 发现example、未定法域、缺少卖方身份、未签DPA/必要跨境附件、未填退货地址或不一致语言时阻止生产协议发布；预览草案展示不受此门禁误阻。Block operative terms if example fields, unresolved law, missing seller identity, unsigned DPA/required transfer instruments, missing return address or language conflicts remain. Clearly labeled preview drafts can still be displayed. | 待确认Open |
拟议承诺与工程证据
Proposed commitments and implementation evidence
以下数字来自产品草案，不是已有的运营数据。正式合同应以团队能够交付并完成验证的数值为准。
These numbers are design proposals, not operational history. Contracts must use commitments the team can substantiate and deliver.
| 审查事项Review item | 需要的决定或证据Required decision or evidence | 状态Status |
|---|---|---|
| 99.9% SLA99.9% SLA | 只有采用该SLA的真实托管生产服务适用；需要探测、分母、排除、状态页、服务抵扣及值班证据，自部署不自动包含。Applies only to actual hosted production services that adopt it; requires probes, denominator, exclusions, status page, credits and staffing. Self-hosting is not automatically covered. | 待确认Open |
| 支持响应Support response | P1 1h及24×7接收、P2 4工作小时、P3 2工作日是待确认目标；实际人员、时区、节假日和交接应填写example项。P1 one hour/24×7 intake, P2 four business hours and P3 two business days are unconfirmed targets. Actual staffing, timezone, holidays and handoff must replace example fields. | 待确认Open |
| 维护和抵扣Maintenance and credits | 维护提前72h、月排除120min上限；5%/10%/25%抵扣与服务范围核对。不能用第三方一词排除平台控制的全部故障。Validate 72-hour maintenance notice, 120-minute monthly exclusion cap and 5%/10%/25% credits. The term third-party cannot exclude all failures within Platform control. | 待确认Open |
| 官网双部署Two website deployment options | 当前仅要求SaaS官网HTML可自托管并部署Cloudflare Workers静态资产。不要把这个结论写成整套多租户电商后台已支持自部署或已生产运行。The present requirement is only self-hostable SaaS marketing HTML and Cloudflare Workers static assets. Do not turn that into a claim that the full multitenant commerce backend is self-hostable or operating in production. | 待确认Open |
| 最终签收Final acceptance | 法务签署人 example；商户业务负责人 example；支付负责人 example；隐私负责人 example；工程负责人 example；批准时间和合同版本 example。Legal reviewer example; merchant business owner example; payment owner example; privacy owner example; engineering owner example; approval date and contract version example. | 待确认Open |
集中参数与替换清单
Centralized constants and replacement register
legal-placeholders.json列出每个含example的段落路径、语言和次数。所有字段都必须按真实用途替换，不能把同一段中的公司、国家、邮箱和期限全局替换成一个值。平台和各店铺分别维护版本。
legal-placeholders.json lists each paragraph path, language and count containing example. Replace every value by its real purpose rather than globally replacing an entity, country, email and period with one value. Maintain separate versions for the Platform and each store.
| 命名空间Namespace | 字段Fields | 当前值Current value |
|---|---|---|
platform | legalName, registrationNumber, registeredAddress, incorporationJurisdiction, website, legalEmail, privacyEmail, supportEmail, billingEmail, securityEmail, abuseEmail | example |
store | displayName, legalName, registrationNumber, registeredAddress, tradingAddress, returnsAddress, telephone, website, supportEmail, privacyEmail, accessibilityEmail | example |
jurisdiction | governingLaw, competentCourt, targetMarkets, consumerAddenda, supervisoryAuthority, adrBody | example |
privacy | controllerContact, processorContact, dpoIfRequired, localRepresentativeIfRequired, processingCountries, remoteAccessCountries, primaryRetention, backupRetention, transferMechanism, cookieRegister | example |
providers | merchantPsp, platformPsp, pspPolicyUrl, statementDescriptor, modelProviders, hostingProviders, emailProviders, carriers | example |
tax | invoiceEntity, taxRegistration, taxInclusion, importerOfRecord, customsCharges | example |
operations | effectiveDate, supportHours, supportTimezone, dispatchWindow, deliveryWindow, voluntaryReturnsWindow, pspPostingEstimate, rpo, rto, accessibilityAuditDate, legalReviewer, legalApprovalDate | example |
已查阅的权威原始资料
Reviewed authoritative primary sources
核对日期：2026-10-10。正文是原创拟议条款，不是法律原文复制；下列资料支持适用性判断。新的国家实施法、后续修正和实际合同必须由律师继续核验。
Checked 10 October 2026. These are original proposed terms, not copied statutory text. Sources support applicability analysis; counsel must verify national implementation, later amendments and actual contracts.
- EU GDPR — Regulation (EU) 2016/679
Primary text: roles, lawful processing, rights, processor contracts, security, breach and transfer provisions. Applicability and local implementation must be reviewed.
- EDPB Guidelines 07/2020 on controller and processor concepts
Official interpretation of factual controller/processor roles; labels alone do not determine legal status.
- European Commission — Standard Contractual Clauses
Official source for transfer clauses. A selected module and completed annexes must be executed; a draft DPA reference does not execute SCCs.
- EU Consumer Rights Directive 2011/83/EU
Baseline text for distance-sale information, withdrawal, reimbursement, exceptions and delivery. Read with amendments and national implementing rules, not as a universal consumer code.
- Directive (EU) 2023/2673 — online withdrawal function
Article 1 adds Article 11a to Directive 2011/83/EU; Article 2 provides application from 19 June 2026. Check relevant national transposition and eligible transactions.
- EU Regulation 2024/3228 — discontinuation of ODR platform
The former EU ODR platform was discontinued and its regulation repealed with effect from 20 July 2025. Do not retain obsolete live-complaint links.
- FTC Mail, Internet, or Telephone Order Merchandise Rule
Official rule summary distinguishing promised shipment and the usual 30-day default, delay consent and refund duties.
- 16 CFR Part 435 — current electronic CFR text
Check detailed coverage, shipping-delay notices, exceptions and prompt-refund methods. Dispatch is not delivery; timelines are not universal across payment methods.
- FTC — Restore Online Shoppers’ Confidence Act
Federal online consumer negative-option framework. Consumer applicability differs from a B2B merchant SaaS contract; state requirements need separate review.
- Federal Register 2026-02866 — Negative Option Rule revision
Effective 12 February 2026, restores the pre-2024 Negative Option Rule following court vacatur; do not describe the 2024 click-to-cancel amendments as operative.
- FTC — March 2026 negative-option rulemaking notice
The FTC announced a new advance notice on 11 March 2026. A proposal is not a final enforceable rule; recheck before launch.
- ICO — Guidance on storage and access technologies
Final guidance updated 29 April 2026 following PECR changes. Covers cookies and similar technologies, conditional exceptions and practical consent.
- ICO — Storage and access technology exceptions
Assess every condition for communications, necessity, statistical, appearance or emergency exceptions; do not infer a general advertising exception.
- ICO — Managing consent in practice
Official operational guidance for clear choices, refusing, withdrawal and changed purposes.
- MeitY — Digital Personal Data Protection Rules, 2025 (final Gazette)
Final Gazette G.S.R. 846(E), not the January 2025 draft. Rule 1 stages commencement. An India launch needs the Act commencement notification and any subsequent amendments checked alongside this text; do not assume all provisions are already applicable.
- European Commission — European Accessibility Act
Official scope includes e-commerce. Assess national implementation, service scope, exemptions and evidence instead of blanket conformance claims.
- W3C — Web Content Accessibility Guidelines 2.2
Primary technical standard. WCAG 2.2 AA is a proposed design target, not a completed audit or automatic finding of legal compliance.