Glossary

The words LexLint uses for software law and legal risk, defined in United States legal usage first, and none of it is legal advice. Where another regime or a neighboring field uses a different word for the same thing, or the same word for a different thing, the entry says so. The dotted underlines across the site open the same definitions. The terms behind agentic systems and the law that reaches them are also on two printable pages, each linked back to its entry here. How LexLint tells law from guidance, frameworks and policy is on the methodology page.

§ · Law

Age assurance

The family of methods for establishing that a user is above or below an age: self-declaration, age estimation from a face or from behavior, and age verification against a document or a trusted third party. Laws name the level they require, and the levels are not interchangeable.

In software usage	age gate. A self-declared date of birth screen; the weakest method and the one most laws now say is not enough.
United Kingdom	highly effective age assurance. The Online Safety Act's standard for services that allow pornography, defined by Ofcom's guidance.

European Union	fundamental rights impact assessment. AI Act Art. 27 requires one from deployers of high-risk systems that are public bodies or provide certain services.
Canada	Algorithmic Impact Assessment. A capitalized proper noun in Canada: the Treasury Board's questionnaire under the Directive on Automated Decision-Making.

In software usage	audit log. A record the system keeps of who did what and when. Keeping one can be a legal duty, as with the automatic logs a high-risk AI system must allow for under the AI Act (Art. 12), but keeping a log is not an audit.

United Kingdom	unauthorised access. The Computer Misuse Act 1990 s. 1 turns on the accused knowing the access was unauthorised, with no public-page carve-out written into the statute.
European Union	illegal access to information systems. Directive 2013/40 requires Member States to criminalize access without right where a security measure is infringed.

European Union	solely automated processing, profiling. General Data Protection Regulation (GDPR) Art. 22 restricts decisions based solely on automated processing; profiling is the evaluation of personal aspects that often feeds them.
United States	automated decision technology, automated decision-making technology (ADMT). California's rulemaking term; Colorado's AI Act says "consequential decision".

In cybersecurity usage	loss event frequency. The Factor Analysis of Information Risk (FAIR) term for the same quantity.
In software usage	prior probability. Statistics and epidemiology usage; the enforcement climate is the prior that fills in where an instrument has no base rate of its own.

European Union	jurisprudence of the Court of Justice. Civil-law systems do not bind later courts by precedent in the common-law sense, but the Court of Justice's rulings on EU law bind every Member State court.

United States	anti-circumvention. The Digital Millennium Copyright Act (DMCA)'s anti-circumvention provision targets measures that control access to copyrighted works, a narrower thing than a rate limit.

European Union	representative action. Directive 2020/1828, applying since 2023, lets qualified entities such as consumer bodies sue for injunctions and redress on behalf of consumers; individuals cannot lead the action themselves.
United Kingdom	collective proceedings, group litigation order. Opt-out collective proceedings exist only before the Competition Appeal Tribunal; a group litigation order in the High Court is opt-in and case-managed.
Germany	Musterfeststellungsklage, Abhilfeklage. The model declaratory action (2018) settles common questions; the redress action (2023) can award compensation, both led by qualified consumer associations.
Netherlands	WAMCA collective action. The Netherlands' 2020 act allows opt-out damages claims by representative foundations, which has made Dutch courts a preferred venue for EU-wide claims.
Australia	representative proceeding. Federal Court class actions under Part IVA, opt-out by default, with litigation funders common.

European Union	supervisory authority. The General Data Protection Regulation (GDPR)'s term for a national data protection authority (Art. 51); the EU AI Act uses "market surveillance authority" and "notifying authority" for its enforcers.
United Kingdom	the Commissioner. The Information Commissioner's Office is the data protection authority; the Competition and Markets Authority and Ofcom enforce the digital-markets and online-safety regimes.
Canada	Privacy Commissioner. The federal Office of the Privacy Commissioner and the provincial commissioners (Quebec's CAI above all) enforce; the federal Commissioner's powers are largely recommendatory.
Australia	the Commissioner (Office of the Australian Information Commissioner (OAIC)). The Office of the Australian Information Commissioner enforces the Privacy Act; the Australian Competition and Consumer Commission (ACCC) enforces consumer law against software as well.
Singapore	Personal Data Protection Commission (PDPC). The Personal Data Protection Commission enforces the Personal Data Protection Act (PDPA) and publishes its decisions.

United States	consent decree. The same thing entered by a court rather than the agency.
European Union	commitments. Competition-law usage; data protection authorities settle less often and publish decisions instead.

European Union	corrective measure. General Data Protection Regulation (GDPR) Art. 58(2) lists the supervisory authority's corrective powers, from a warning to a ban on processing to an administrative fine; each exercise is one action.
United Kingdom	enforcement notice, monetary penalty notice. The Information Commissioner's Office (ICO)'s formal instruments; a reprimand is also published but carries no penalty.
Australia	civil penalty proceeding. The Office of the Australian Information Commissioner (OAIC) or Australian Competition and Consumer Commission (ACCC) applies to the Federal Court for a civil penalty; the court, not the regulator, sets the amount.

European Union	resources of supervisory authorities. General Data Protection Regulation (GDPR) Art. 52(4) requires each Member State to resource its authority; the European Data Protection Board publishes the figures yearly.

United States	doing business, minimum contacts. The US analogues: statutory thresholds for who a state act covers, and the constitutional test for whether a court has jurisdiction over an out-of-state defendant.

In cybersecurity usage	asset and loss factors. Factor Analysis of Information Risk (FAIR)'s names for the analogous inputs.

In law usage	territorial scope. The heading under which EU instruments state it (GDPR Art. 3, AI Act Art. 2).

United Kingdom	fair dealing. Purpose-limited; the EU's closed list of exceptions in Directive 2001/29 works the same way.
Canada	fair dealing. Canada's list includes research, private study, education, parody, and satire, read generously by the Supreme Court.

In software usage	foundation model, frontier model. Industry and US policy usage for the same class; the AI Act uses neither term.

United States	high-risk artificial intelligence system. Colorado's AI Act borrows the phrase for systems making consequential decisions, with a different list and a duty of reasonable care rather than conformity assessment.

In software usage	human in the loop, human on the loop. Design patterns rather than duties. In the loop, a person must act before the agent proceeds; on the loop, a person watches and may act. Neither is by itself the oversight a statute asks for, which turns on whether the person can really intervene.

European Union	entry into force, application. An EU regulation enters into force on one day and its articles start to bind in stages, sometimes years later. LexLint tracks articles, so each article's date is the day that article starts to bind, not the regulation's entry into force.

European Union	regulation, directive. A regulation binds directly in every Member State; a directive binds only once transposed into national law, so the national act is the instrument that reaches an app.
United Kingdom	Act, statutory instrument. Primary legislation and the secondary rules made under it; both are instruments in the law library.

European Union	Member State. An EU Member State is a national jurisdiction in LexLint's model, sitting under the EU's supranational rung, so an EU-wide regulation and a Member State's own act are two jurisdictions.
United Kingdom	nation. England and Wales, Scotland and Northern Ireland are separate legal systems; LexLint keys UK-wide statutes to the national rung and does not yet split the nations.
In software usage	region. Cloud and CDN "regions" are data-center locations, not jurisdictions; where data sits is one input to which jurisdiction applies, never the answer.

European Union	Union, Member State, region. Regional and municipal law exists across the EU but reaches LexLint's law library only where it binds software; the local rung is US-first today.

In law usage	practice area. A firm's practice areas are broader (privacy and data security, technology transactions); a legal area is one topic of the law library.

In cybersecurity usage	risk score. A security register scores likelihood times impact on a system; the LexLint Risk Score (LRS) prices the same product in money and in legal terms, and the two should never be merged into one number.

United States	children, teens. Children's Online Privacy Protection Act (COPPA) says children (under 13); the state acts add teens (13 to 17) with opt-in rules of their own.

United States	civil penalty. The Federal Trade Commission (FTC) cannot fine for a first violation of Section 5 and must sue for civil penalties under a rule or an existing order; state attorneys general have direct penalty authority under their consumer-protection acts.
European Union	administrative fine. General Data Protection Regulation (GDPR) Art. 83 and AI Act Art. 99; imposed by the authority directly in most Member States, by a court in Denmark and Estonia.
United Kingdom	monetary penalty. Issued by notice; appealable to the First-tier Tribunal.

European Union	operator (AI Act). The AI Act uses operator as an umbrella for the provider, product manufacturer, deployer, authorized representative, importer and distributor (Art. 3(8)), so an EU text's operator can be any of them. The party that runs an AI system is its deployer there.

European Union	legal person, public authority, agency or other body. EU texts write the whole class out in each role they bind and define none of the words in it; the General Data Protection Regulation (GDPR) does so for controller and processor (Article 4(7) and (8)) and the AI Act for provider and deployer (Article 3(3) and (4)).

In economics usage	consolidation. Borrowed from group accounting, where a parent's consolidated statements fold in its subsidiaries.

European Union	administrative fine tiers. General Data Protection Regulation (GDPR) Art. 83 and AI Act Art. 99 set tiers as the higher of a fixed sum and a share of worldwide annual turnover; the AI Act gives small or medium-sized enterprises (SMEs) the lower of the two.
United States	civil penalty schedule. US statutes set per-violation amounts, adjusted for inflation by rule, with the count of violations doing the work a turnover percentage does in the EU.

In software usage	policy (policy as code). Machine-readable rules, written in a language such as Rego or Cedar, that a policy engine evaluates to allow or deny an action. A gateway applies this kind of policy; it can carry a duty from a law, but it is not an instrument.

In software usage	prior. Bayesian usage, where a prior is the belief before the data arrives; the climate plays that role for the instrument's own record.

In law usage	standing. Standing is the separate question of whether this plaintiff may bring the claim, which in US federal court turns on a concrete injury even where the statute grants the right.
European Union	right to an effective judicial remedy and to compensation. General Data Protection Regulation (GDPR) Arts. 79 and 82 give every data subject a right to sue the controller or processor and to be compensated for material or non-material damage.

United States	developer and deployer. Colorado's and Utah's terms; the National Institute of Standards and Technology (NIST) AI Risk Management Framework speaks of actors across the lifecycle rather than fixing two roles.
In software usage	model provider, operator. Industry usage; an operator that fine-tunes and re-releases a model becomes a provider under the AI Act.

In software usage	regulatory enforcement. Industry usage; the same thing, minus the contrast with private enforcement that the model needs.

In cybersecurity usage	FAIR. Factor Analysis of Information Risk, the Open Group standard that decomposes cyber risk into loss event frequency and loss magnitude; LexLint uses the structure and its own legal inputs.

In cybersecurity usage	risk register entry. ISO 31000 and the governance, risk, and compliance (GRC) tools use the same shape; LexLint keeps the field names so an export needs no mapping.

European Union	AI regulatory sandbox. The AI Act's form (Art. 3(55)), a controlled framework a competent authority sets up so that providers can develop, train, validate and test an innovative AI system under a sandbox plan, for a limited time and under regulatory supervision. Each Member State must establish at least one (Art. 57).
In software usage	execution sandbox. Isolation that limits what running code can touch, such as the container, microVM or WebAssembly runtime an agent runs in. It is a technical boundary, and no regulator is part of it.

In law usage	risk acceptance. ISO Guide 73's term for the decision itself.

In law usage	software law (licensing and IP). In general legal usage the phrase means the law of software as property, its licenses, copyright, patents and contracts. Licenses, patents and contracts are not in the law library. Copyright is, but only where it governs what an application may copy, store, resell or decompile, and LexLint's sense is the law that binds what an application does.
In law usage	technology law, digital regulation. Practice-area and policy labels that reach further than the law library, into telecom, e-commerce, platform and IP law. LexLint does not use them for its collection.

European Union	compensation for material or non-material damage. General Data Protection Regulation (GDPR) Art. 82 requires an infringement, damage, and a causal link; the Court of Justice has held there is no seriousness threshold but also no damages without damage, which is not statutory damages.
United Kingdom	damages for distress. Recoverable under the UK GDPR and the Data Protection Act 2018, assessed by the court on the facts.

In law usage	browsewrap, clickwrap. US case-law labels for the two presentations; the law library records enforceability of each per jurisdiction.
European Union	terms and conditions, unfair contract terms. Consumer-protection law limits what standard terms can impose on consumers, but a crawler is rarely a consumer.

United States	fair use. The US has no text and data mining (TDM) exception; the question is whether the copying is a fair use, decided case by case on purpose, nature, amount, and market effect.
United Kingdom	text and data analysis for non-commercial research. The UK exception (s. 29A) covers non-commercial research only; a wider exception was proposed and withdrawn.
European Union	TDM exception with opt-out. Directive 2019/790 Art. 4 permits commercial TDM unless the rightsholder has reserved the right, machine-readably for online content.
Japan	Article 30-4. Japan's exception permits use for information analysis regardless of purpose, with no opt-out, which is why it is the widest in the law library.

In cybersecurity usage	mitigate, transfer, avoid, accept. The governance, risk, and compliance (GRC) labels for the same four options.

In law usage	forum, situs. Near-synonyms in US practice; "forum selection" is the contract clause that picks the venue in advance.

In law usage	agent (agency law). A person who acts for a principal with the principal's consent and subject to its control. Software is not an agent in that sense; US law treats an electronic agent as a tool of the person who uses it.
European Union	AI system. The AI Act does not define an agent. An agent is usually an AI system under Art. 3(1), a machine-based system that infers from its input how to generate outputs that can influence physical or virtual environments, and the model inside it may be a general-purpose AI model.

In law usage	issue. A legal memo's "issues" are the questions presented; a lint finding is narrower, one duty against one declared fact about the app.

In software usage	evaluation harness. A test runner that exercises a model or an agent on a set of tasks and scores the results, the sense of the Agentic AI Foundation's category for evaluation and benchmarking harnesses. It tests an agent and limits nothing while the agent runs.

See also: Instrument, Framework, Policy

Handles health records App activity

Your app stores or processes a person's medical history, diagnosis, treatment, or other health information. This covers a patient portal, a fitness app that stores a diagnosis a user enters, and a scheduling tool that records the reason for a medical visit. A step counter with no diagnosis or health condition attached does not count on its own. Declaring it puts privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: handles_health_records

In the activity registry: what triggers it, and the law it brings into scope

Hot news misappropriation Law family

A US state-law claim against a business that takes time-sensitive facts a rival paid to gather and publishes them while they are still news. The claim began with International News Service v. Associated Press (1918), where the Supreme Court stopped one wire service copying another's freshly gathered war news. That was federal common law and fell with Erie Railroad Co. v. Tompkins (1938); the claim survives as state law, above all in New York. The federal Copyright Act preempts most such claims, because facts are not protected. In National Basketball Association v. Motorola (1997) the Second Circuit left a narrow claim standing, for free-riding on costly, time-sensitive information that threatens the gatherer's product, and in Barclays v. Theflyonthewall.com (2011) it held preempted a claim against a service that reported firms' recommendations and credited the firms.

Identity reliance Law family

What a service must do when it accepts a digital identity wallet, a credential or an attestation, and when it must accept one. This family covers the duties a service takes on by relying on a digital identity: in the EU, registering in its member state before it relies on a European Digital Identity Wallet, asking only for the data it registered, identifying itself to the user, validating what the wallet presents and accepting a pseudonym where no law requires identification. It also covers the rules that oblige some services to accept a wallet when a user offers one: in the EU, any business other than a micro or small one that law or contract requires to use strong authentication, as in banking, health or telecoms, and very large online platforms. A duty to check a user's age is listed under age gating law.

Importer (EU AI Act)

You are located or established in the EU and place on its market an AI system bearing the name or trademark of someone established outside it. The AI Act's role, defined in Article 3(6), for the party that brings a system from a provider outside the Union onto the Union market, and a role a LexLint declaration asks about.

Interception and recording consent Law family

Rules on who must agree before a phone call or private conversation can be recorded or intercepted, and what can be done with a recording made without that consent. Wiretap and interception statutes make it a criminal or civil wrong to intercept, record, or listen in on a private communication without the required consent. Some jurisdictions need only one participant's consent, so a party to the call can record it themselves; others need every participant to agree before a recording is lawful. These statutes typically carve out exceptions for law enforcement, national security, and a network operator's own maintenance, and separately restrict disclosing or using an intercepted communication afterward.

Intermediary liability Law family

Whether a service that carries, caches or hosts what its users post can be held liable for it, and what conditions keep it protected. This family covers the liability shields for online intermediaries and the conditions they carry. In the United States, section 230 of the Communications Act stops a service being treated as the publisher of what a third party posted; in the EU, the Digital Services Act protects a host that did not know content was illegal and removes it promptly once it does. Other countries condition protection on acting on a notice or a court order. A service that writes or materially shapes the content itself generally falls outside the shield.

Is a bank App activity

The company behind your app is a bank, credit union or other deposit-taker, or supplies software to one. This covers a bank, a credit union, a building society and a savings association, and a vendor whose software one of them runs. It implies Provides financial services, so the rules that bind every financial firm reach it too, and a bank that lends also declares Is a lender. A lender that takes no deposits does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_bank

In the activity registry: what triggers it, and the law it brings into scope

Is a crypto-asset provider App activity

The company behind your app is a crypto-asset or virtual-asset service provider, or supplies software to one. This covers a crypto-asset exchange or trading platform, a custodial wallet provider, a broker, a transfer service and a token or stablecoin issuer, whatever the law calls the license: a crypto-asset service provider, a virtual asset service provider, a virtual currency business or a digital asset business. It implies Provides financial services. A merchant that accepts crypto for its own goods, through a processor it does not run, does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_crypto_asset_provider

In the activity registry: what triggers it, and the law it brings into scope

Is a frontier developer App activity

The company behind your app trained, or started training, a frontier model, one trained with more than 10^26 operations. California's SB 53 defines a frontier model as a foundation model trained with more than 10^26 integer or floating-point operations, and New York's RAISE Act adds a training-cost threshold. Only a handful of companies have trained one. Calling someone else's model, or a small fine-tune of it, does not count. Declaring it puts AI law in scope, along with any other law that names this activity.

In an app profile: is_frontier_developer

In the activity registry: what triggers it, and the law it brings into scope

Is a lender App activity

The company behind your app regularly lends or arranges credit as a business, such as consumer, business or mortgage loans or buy now, pay later, or supplies software to a lender. This covers a consumer or small-business lender, a mortgage lender or broker, a buy now, pay later provider and a bank when it lends, licensed or not, because credit law binds whoever regularly extends credit. It implies Provides financial services. A retailer that only accepts a card at checkout does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_lender

In the activity registry: what triggers it, and the law it brings into scope

Is a listed company App activity

The company behind your app has shares traded on a public stock exchange. This is a status of the company that makes the app, not a feature of the app. Some cybersecurity rules bind listed companies directly, such as the US Securities and Exchange Commission's rule that a listed company disclose a material cybersecurity incident. A privately held company, including one planning to go public, does not count. Declaring it puts cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_listed_company

In the activity registry: what triggers it, and the law it brings into scope

Is a payment provider App activity

The company behind your app is a payment or e-money institution or a money transmitter, or supplies software to one. This covers a payment institution, an e-money issuer, and a money transmitter or remittance service. A crypto-asset exchange or custodian declares Is a crypto-asset provider instead. It implies Provides financial services. A merchant that takes payment for its own goods, through a processor it does not run, does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_payment_provider

In the activity registry: what triggers it, and the law it brings into scope

Is a securities firm App activity

The company behind your app is a broker-dealer, investment firm or investment adviser, or a fund or portfolio manager, or supplies software to one. This covers a broker-dealer, an investment firm under EU law, a registered investment adviser, a fund or portfolio manager, and a robo-adviser that invests on a user's behalf. It implies Provides financial services. A market-data or charting app that gives no advice and takes no orders does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_securities_firm

In the activity registry: what triggers it, and the law it brings into scope

Is an insurer App activity

The company behind your app is an insurer, reinsurer or insurance producer, or a utilization-review organization acting for a health insurer, or supplies software to one. This covers a carrier that underwrites policies, a reinsurer, an agent or broker licensed to sell insurance, and a utilization-review organization deciding claims for a health insurer. It implies Provides financial services. A comparison site that sells no policy itself does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: is_insurer

In the activity registry: what triggers it, and the law it brings into scope

Liability safe harbors Law family

Statutory defenses or caps on damages that a business earns by meeting a stated standard, such as running a recognized cybersecurity program. This family covers laws that limit what a business can be made to pay rather than adding a duty: an affirmative defense, or a bar on punitive damages, for a business that kept a written security program conforming to a recognized framework when a breach happened. The work they ask for is security work, so these laws are listed under cybersecurity law.

Linking and framing Law family

Whether posting a hyperlink, or embedding another site's content by framing it inside your own page, counts as publishing that content and can create liability. This family covers case law and intermediary-liability statutes on when linking to, or framing, someone else's online content makes the linker legally responsible for it. Courts have generally held that a bare hyperlink is not itself publication of the linked material, but framing content in a way that bypasses the rightsholder's own access controls can cross into infringement or an unlawful communication to the public. Separate statutes shield a network or hosting provider from liability for third-party material it merely carries, provided it lacks actual knowledge of a problem and acts once notified.

Makes credit decisions App activity

Your app makes or scores decisions about a person's credit, a loan or another financial service offered to them. This covers a credit-scoring model, an automated loan approval and a system that sets a credit limit or a rate, whoever runs it, a lender or its vendor. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A model used only to detect fraud does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: credit_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes education decisions App activity

Your app makes or scores decisions about a person's education, such as admission, a grade or a test result. This covers an admissions screener, an automated essay grader that sets a mark, and remote proctoring that flags a test taker. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A practice quiz with no effect on a grade or a place does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: education_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes employment decisions App activity

Your app makes or scores decisions about a person's work, such as hiring, promotion, pay or termination. This covers a resume screener, a video-interview scorer, and software that allocates tasks to workers or monitors and rates their performance. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A scheduling tool that applies a rule a person set and can see does not count in the same way. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: employment_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes health care decisions App activity

Your app makes or scores decisions about a person's access to health care, such as coverage, prior authorization or triage. This covers a prior-authorization engine, a utilization-review model that recommends a denial, and a triage tool that sets who is seen first. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. Diagnosis by a medical device is not this; it is a decision about a condition, not about access to care. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: health_care_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes high-risk automated decisions App activity

Your app lets software decide, on its own, an outcome with a serious effect on a person, such as a loan, a job, or a benefit. This covers an automated loan-approval system, a resume-screening tool that rejects candidates without human review, and a claims model that denies a benefit. Declare each kind of decision it makes as well, from Makes employment decisions to Makes justice decisions, so a rule written for one kind reaches it. A recommendation a human reviewer can freely overrule before it takes effect does not count in the same way. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: high_risk_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes housing decisions App activity

Your app makes or scores decisions about a person's housing, such as a rental application or tenant screening. This covers a tenant-screening score, an automated rental-application decision and a system that decides who is offered a home. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A listing site that shows every listing to everyone does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: housing_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes insurance decisions App activity

Your app makes or scores decisions about a person's insurance, such as eligibility, a price or a claim. This covers an underwriting model, a pricing engine that sets a person's premium and a claims model that denies or reduces a claim, whoever runs it. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A comparison site that only ranks published prices does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: insurance_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes justice decisions App activity

Your app makes or scores decisions about a person in law enforcement, migration, the courts or legal services. This covers a recidivism or risk-assessment tool, software that screens a visa or asylum application, and a system that decides who receives legal aid. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A legal research tool that decides nothing about a person does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: justice_decisions

In the activity registry: what triggers it, and the law it brings into scope

Makes public services decisions App activity

Your app makes or scores decisions about a person's public services or benefits, such as eligibility for public assistance. This covers a benefits-eligibility engine, a model that flags a claimant for review or cuts a benefit, and software that triages emergency calls and dispatches a response. It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too. A public body's internal tool that decides nothing about a person does not count. Declaring it puts AI law, privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: public_services_decisions

In the activity registry: what triggers it, and the law it brings into scope

News media bargaining code Law family

A law forcing a large search engine or social platform to pay news outlets for their content, through negotiation and arbitration if a deal is not reached. A news media bargaining code requires a digital platform above a size threshold to negotiate compensation with news businesses whose content it carries or links to, backed by mandatory mediation and binding arbitration if the parties cannot agree on commercial terms themselves. Australia created the model in 2021, and Canada's Online News Act follows it, exempting a platform that has already reached agreements with news outlets on set terms. The mechanism is a regulator-run bargaining process, not a copyright or licensing right.

Notice and action Law family

What a service must do once someone reports unlawful content on it: the channel it runs, how fast it acts, and how the uploader can respond. This family covers the procedures a host must follow when it is notified of unlawful content: accepting notices through a channel, acting within a deadline, telling the person who posted it, and restoring content wrongly removed. Copyright takedown under the US Digital Millennium Copyright Act (DMCA), with its registered agent and counter-notice, is the best-known form; the EU Digital Services Act, the UK Online Safety Act and the US Take It Down Act set their own versions, some with removal clocks measured in hours.

Operates a social platform App activity

Your app lets users create accounts, post content, and interact with each other's posts in a shared public or semi-public space. This covers a photo-sharing network, a video-sharing site users upload to, and a discussion forum with public profiles. A single-player app with no user-to-user posting does not count, even if users can leave a comment for your staff to read. Declaring it puts age-gating law, cybersecurity law, content moderation law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: operates_social_platform

In the activity registry: what triggers it, and the law it brings into scope

Operates an app store App activity

Your app is itself a storefront that lists, distributes, or lets people download other companies' apps. This covers a general-purpose app marketplace and a curated storefront limited to one device category. A company's own single app does not count, even one built with plugins, unless it distributes other developers' separate apps. Declaring it puts age-gating law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: operates_app_store

In the activity registry: what triggers it, and the law it brings into scope

Personal data scope Law family

How a privacy law defines the personal data it covers, including whether information a person or a government has already made public falls outside that scope. Privacy and data protection statutes define what counts as personal data, and a common carve-out exempts information that is already publicly available, whether because a government record discloses it or because the individual made it public themselves. The wording differs: some laws exempt only lawfully published government records, others also exempt what the individual chose to make public, and a data type such as a biometric identifier can be defined narrowly enough to leave out an ordinary photo. That carve-out decides whether scraping public information triggers a privacy statute, and its boundaries differ by jurisdiction.

Places automated calls App activity

Your app places voice calls by itself, with an autodialer or a prerecorded or AI-generated voice. This covers a robocall campaign, a voice agent that dials people, and a telemarketing dialer. A person dialing each call by hand does not count. It implies Sends automated outreach, so the rules written for every channel reach it too. Declaring it puts AI law, communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: places_automated_calls

In the activity registry: what triggers it, and the law it brings into scope

Press publishers' right Law family

An EU-created neighboring copyright right letting a news publisher charge for, or block, a platform's online use of its articles, beyond hyperlinks and short excerpts. The press publishers' right is a neighboring right created by the 2019 Digital Single Market copyright directive, giving a press publisher its own exclusive right to authorize or charge for an online service's reproduction of its publications. Member states each transpose the right into national law, and every version excludes private or non-commercial use, bare hyperlinks, and individual words or very short extracts, leaving how short counts as very short to national implementation and litigation. No comparable federal right exists in the United States, where a similar claim instead runs through the narrower and largely preempted hot-news misappropriation doctrine.

Privacy notice Law family

A standalone law requiring a website, app or online service that collects personal data to post a privacy policy saying what it collects and who it shares it with. This family covers laws whose duty is the privacy policy itself. A website, app or online service that collects personal data from a jurisdiction's residents must post a policy where users will see it and list the kinds of data it collects and the kinds of parties it shares them with; some laws also require it to describe how a user can review or change that data and how the service responds to a browser's Do Not Track signal. A general privacy statute usually carries a notice duty of its own. This family holds the laws that impose the duty on their own, which often reach operators too small for the general statute.

Processes biometric data App activity

Your app collects or analyzes a physical or behavioral trait, such as a fingerprint, a face, or a voiceprint, to identify or verify a person. This covers a face-unlock feature, a fingerprint login, and a voiceprint used to confirm a caller's identity. Storing an ordinary photo a user uploads for their profile does not count unless your app extracts a biometric template from it. Declaring it puts privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: processes_biometrics

In the activity registry: what triggers it, and the law it brings into scope

Processes de-identified data App activity

Your app strips or replaces the identifiers in personal data so it no longer points to a person, or receives, shares or links data that has been through that. This covers a step that tokenizes, masks or removes names and ids before analytics or sharing, a pseudonymization or anonymization pipeline, a dataset your app receives or licenses that is described as de-identified, and joining such a dataset with another. Encryption alone does not count. Pseudonymized data usually stays personal data, so an app that does this also declares processes_personal_data. Declaring it puts privacy law in scope, along with any other law that names this activity.

In an app profile: processes_deidentified_data

Processes personal data App activity

Your app collects, stores, uses, or shares information about a person who can be identified, such as a name, an email address, an account, a location, or a device ID. This covers user accounts and sign-in, a contact or sign-up form, analytics that follow visitors, and an order or support history kept for each customer. An anonymous total that can no longer be tied to anyone does not count. Declaring it puts privacy law, cybersecurity law and product-liability law in scope, along with any other law that names this activity.

In an app profile: processes_personal_data

In the activity registry: what triggers it, and the law it brings into scope

Processes voice recordings App activity

Your app records, stores, or analyzes a person's spoken voice, whether a call, a voice memo, or a voice command. This covers a call-recording feature, a voice-command assistant, and a voicemail transcription tool. Text a user typed themselves does not count, even if your app later reads it aloud. Declaring it puts privacy law and product-liability law in scope, along with any other law that names this activity.

In an app profile: processes_voice

In the activity registry: what triggers it, and the law it brings into scope

Processor (GDPR)

You process personal data on behalf of a controller. The General Data Protection Regulation (GDPR)'s term in Article 4(8) for an organization that processes personal data for a controller rather than for its own purposes, and a role a LexLint declaration asks about under personal-data law. A hosted service that stores its customers' records is usually one.

United States	service provider. California's word under the California Consumer Privacy Act (CCPA); most other state privacy acts say processor.

Procurement conditions Law family

Accessibility a vendor must meet to sell software or services to a public body. This family covers rules that make accessibility a condition of selling to the public sector: a procurement law or purchasing rule that requires the products a public body buys to meet an accessibility standard, and so reaches the vendor through the contract. It applies when you sell to a public body, whatever else the law says about your product, and is the duty that a declaration of selling to the public sector brings into view.

Product liability Law family

Who pays when a defective product injures someone or damages their property, and whether software counts as a product. This family covers the laws that make a maker, importer or supplier answer for harm a defective product causes, usually without the injured person having to prove fault. In the EU, Directive (EU) 2024/2853 treats software as a product, however it is supplied, for products placed on the market from December 2026, and lets a court order the defendant to disclose evidence and presume a defect when it does not. The older national laws under the 1985 Product Liability Directive still govern products placed on the market before then, and each country outside the EU has its own act, which may or may not reach software on its own.

Product manufacturer (EU AI Act)

You put a product on the EU market under your own name with an AI system inside it as a safety component, which makes you that system's provider. The AI Act's role, set out in Article 25(3), for the maker of a product covered by the EU product-safety law listed in Annex I whose high-risk AI system ships in that product under the maker's name, and a role a LexLint declaration asks about.

Product security requirements Law family

Rules requiring a manufacturer of an internet-connected device to build in baseline security features, such as a unique password, before the device can be sold. Connected-device security statutes require a manufacturer to equip a device that connects to the internet or another network with security features appropriate to what it does and what data it handles. A recurring requirement bans a single default password shared across every unit, requiring instead either a unique preprogrammed credential or a forced setup step before first use. Some versions extend the duty to importers and distributors, and a national or EU-level version can point to a government-set technical standard rather than listing requirements in the statute itself.

Provider (EU AI Act)

You develop an AI system or general-purpose AI model, or have one developed, and put it on the EU market or into service under your own name or trademark, paid or free. The AI Act's maker role, defined in Article 3(3), and a role a LexLint declaration asks about. Most of the Act's duties for a high-risk system and for a general-purpose model fall on the provider.

United States	developer. Colorado's word for the party that builds an AI system or substantially modifies one.

Provides a general-purpose AI model App activity

The company behind your app puts a general-purpose AI model on the market under its own name, one that performs a wide range of distinct tasks. This covers a company that offers its own large language, image or multimodal model through an API, as downloadable weights or inside its own product. The EU AI Act calls it the provider of a general-purpose AI model (Article 3(63)), and its Articles 53 to 55 set that provider's duties. Calling someone else's model, or a light fine-tune of one for a single task, does not count on its own; a modification on the scale of the original training can make you the provider of the modified model. Declaring it puts AI law in scope, along with any other law that names this activity.

In an app profile: provides_general_purpose_ai_model

In the activity registry: what triggers it, and the law it brings into scope

Provides cloud services App activity

The company behind your app offers it to customers as a hosted service, under a contract, that stores or runs their own data or workloads. This covers a hosted database or file store, a business application your customers sign in to and keep their records in, such as a sales pipeline or a project tracker, and a platform customers deploy their own code on. The EU Data Act calls this a data processing service and counts infrastructure, platform and software services alike. Running your own app on somebody else's cloud does not count on its own, and neither does a shop, a publication or a game that people only visit. Declaring it puts cybersecurity law and cloud-service law in scope, along with any other law that names this activity.

In an app profile: provides_cloud_services

Provides financial services App activity

The company behind your app holds a financial-services license, as a bank, lender, insurer, securities firm, payment provider or crypto-asset provider, or supplies software to a firm that does. This is a status of the company that runs or supplies the app, not a feature of the app. Declare its license class too: Is a bank, Is a lender, Is an insurer, Is a securities firm, Is a payment provider or Is a crypto-asset provider. Declared alone, it is answered with every class's rules, and the lint asks which class applies. An app that only moves money or takes card payments, without holding a license or supplying a firm that does, does not count. Declaring it puts AI law, privacy law and cybersecurity law in scope, along with any other law that names this activity.

In an app profile: provides_financial_services

In the activity registry: what triggers it, and the law it brings into scope

Provides telecom services App activity

Your app carries other people's calls, texts, or internet traffic, rather than only using someone else's network to reach its own users. This covers a voice-over-internet calling service, a text-messaging carrier, and an internet service provider's own app. A messaging app that rides on top of the public internet, without operating network infrastructure itself, does not count in the same way. Declaring it puts cybersecurity law in scope, along with any other law that names this activity.

In an app profile: provides_telecom_services

In the activity registry: what triggers it, and the law it brings into scope

Public body (LexLint question)

A public body runs this software. One answer to the question a LexLint declaration asks about public bodies. A duty that binds a public body then reads as the caller's own, and lexlint.io/gov sets out what the answer routes.

Publishes adult content App activity

Your app hosts or distributes sexually explicit material, or other content a jurisdiction classifies as harmful to minors. This covers an adult video site, a forum that hosts explicit images its users upload, and a livestreaming service in that category. A mainstream app that removes an occasional user-posted image once it is flagged does not count in the same way. Declaring it puts age-gating law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: publishes_adult_content

In the activity registry: what triggers it, and the law it brings into scope

Records calls App activity

Your app records, transcribes, or monitors people talking to each other, on a phone or video call or in a meeting. This covers a call-center recording feature, a notetaker that joins a video meeting, and a tool that saves a session for later review. A call your app only carries from one person to another, without keeping or reading it, does not count. A voice assistant a caller talks to is Processes voice recordings, and so is recording your own voice alone: Records calls is for people talking to each other. Declaring it puts communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: records_calls

In the activity registry: what triggers it, and the law it brings into scope

Records text chat App activity

Your app keeps what users type in a chat, or a vendor's chat feature inside it receives the text as it is typed, whether a person or an assistant answers. This covers a live-chat window whose vendor keeps the transcript, a support widget that forwards messages to an agent, an assistant whose conversations you store, and a session-replay tool that captures what users type. A form your app only saves does not count, and an assistant that keeps no transcript and passes nothing to a vendor is Deploys a chatbot alone. Declaring it puts communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: records_text_chat

In the activity registry: what triggers it, and the law it brings into scope

Regulation Instrument type

A regulation is a rule an agency issues under authority a statute gives it. A regulation is written by an executive agency or ministry rather than a legislature, using rulemaking power a statute delegates to it, and it fills in detail the statute leaves open, such as a technical standard or a filing procedure. Once in force it binds in the same way a statute does. It differs from guidance, which only states how the agency currently reads a rule and carries no binding force of its own in most regimes.

Relies on a digital identity App activity

Your app accepts a digital identity wallet, a verifiable credential or an identity-verification service's result to check who a person is, their age or another attribute. This covers a European Digital Identity Wallet or mobile driving license verifier, a library that checks verifiable credentials or attestations, and an identity-verification service whose result your app acts on, whether it asks for identity, an age or another attribute. Sign-in with a password, or a social sign-in that only links an account, does not count. Declaring it puts digital-identity and e-signature law in scope, along with any other law that names this activity.

In an app profile: relies_on_digital_identity

Reuses other publishers' content App activity

Your app republishes, excerpts, links to, or indexes content another publisher made first: headlines, articles, snippets, or images. This covers a news-aggregation app that lists headlines linking out to original articles, a digest that quotes a short excerpt from each story it summarizes, and a search or preview feature that shows thumbnails or snippets of other sites' pages. Linking to a single article a user pastes in themselves, with no ongoing collection, does not count. Declaring it puts reuse law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: aggregates_content

In the activity registry: what triggers it, and the law it brings into scope

Runs an essential service App activity

Your app supports infrastructure a government has designated essential, such as energy, water, transport, or health delivery. This covers a utility's outage-reporting app, a hospital scheduling system, and a transit operator's ticketing platform. A general productivity app a utility happens to use for internal memos does not count on its own. Declaring it puts cybersecurity law in scope, along with any other law that names this activity.

In an app profile: operates_essential_service

In the activity registry: what triggers it, and the law it brings into scope

Sector security regimes Law family

Cybersecurity duties that apply only to operators in a designated sector, such as telecoms, energy, banking, or health, rather than to businesses generally. Rather than one cybersecurity law binding every company, a jurisdiction can designate certain sectors, commonly telecommunications, energy, banking, transport, water, and health, and impose risk-management duties only on operators there. A national authority typically has power to designate which specific operators count as covered, based on the scale of harm a disruption would cause. The EU's NIS2 framework is one influential model, requiring member states to identify essential and important entities and hold them to proportionate security measures, though sector-specific duties exist independently in other countries' telecommunications and utilities statutes.

Security baseline statutes Law family

A general duty on a business holding personal information to keep reasonable security measures in place, regardless of its industry, size, or sector. These statutes set a baseline security duty for a business, not tied to any one sector, that owns, licenses, or maintains personal information: implement and maintain reasonable security procedures appropriate to the sensitivity of the data and the size of the business. Some versions also extend the same standard to a vendor handling the data by contract, and to the secure disposal of records once they are no longer needed, and add a liability shield reducing certain damages if the business followed a recognized security framework at the time of a breach. The pattern arose state by state in the United States rather than from one national law.

Sends automated outreach App activity

Your app contacts people through automated calls, texts, or messages that a person did not individually compose and send. This covers an automated phone campaign, a bulk text reminder service, and a voice call generated by a speech model rather than recorded by a person. A single email a staff member writes and sends by hand does not count, even if a template supplied the boilerplate. Declaring it puts AI law, communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: automated_outreach

In the activity registry: what triggers it, and the law it brings into scope

Sends automated texts App activity

Your app sends text or picture messages to phone numbers by itself. This covers a marketing text campaign, an appointment reminder service, and an agent that texts people. A message a person types and sends each time does not count. It implies Sends automated outreach, so the rules written for every channel reach it too. Declaring it puts AI law, communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: sends_automated_texts

In the activity registry: what triggers it, and the law it brings into scope

Sends commercial email App activity

Your app sends marketing or other commercial email by itself. This covers a newsletter, a promotional campaign, and a cold-email sequence. A receipt or a password reset alone does not count, and neither does an email a person writes and sends by hand. It implies Sends automated outreach, so the rules written for every channel reach it too. Declaring it puts AI law, communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: sends_commercial_email

In the activity registry: what triggers it, and the law it brings into scope

Sends faxes App activity

Your app sends faxes by itself, directly or through a fax service. This covers a fax broadcast and an advertising fax sent through an online fax service. A fax a person sends by hand does not count. It implies Sends automated outreach, so the rules written for every channel reach it too. Declaring it puts AI law, communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: sends_faxes

In the activity registry: what triggers it, and the law it brings into scope

Sensitive categories of personal data Law family

A subset of personal data, such as health, biometric, or racial and religious information, that privacy law subjects to stricter handling rules than ordinary data. Privacy and data protection laws single out certain categories of personal data, typically health, biometric, genetic, racial or ethnic origin, religious belief, sexual orientation, and criminal history, for tighter handling rules than ordinary personal data. Processing this category needs a narrower legal basis, such as explicit consent or a specific statutory exception, rather than the general grounds that cover routine data. The General Data Protection Regulation (GDPR)'s Article 9 list is the most widely referenced version and shapes how other countries and US states define their own sensitive or special categories, though the exact list, and how narrowly a term like biometric data is defined, differs by jurisdiction.

Serves a sanctioned destination App activity

Your app is offered to people in a country under comprehensive US sanctions. Declaring Cuba, Iran or North Korea as a jurisdiction sets it for you. This covers an app or service offered to people in Cuba, Iran or North Korea, whether or not the declaration lists those jurisdictions. An app that offers nothing in those countries does not count. Declaring it puts export-control and sanctions law in scope, along with any other law that names this activity.

In an app profile: serves_sanctioned_destination

Serves under-18s App activity

Your app is used by, or knowingly allows, people under the age of eighteen, whether or not it was designed for them. This covers a general-audience social app that in practice has a large under-18 user base, and a game marketed to teenagers. An app that requires and enforces an adult-only signup, and takes real steps to keep minors out, does not count in the same way. Declaring it puts age-gating law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: serves_minors

In the activity registry: what triggers it, and the law it brings into scope

Ships a consumer interface App activity

Your product has a website, app or other screen that members of the public use to buy, book, read or reach a service. This covers a storefront, a booking or sign-up flow, a news or reference site, a portal where customers manage an account, and a mobile app's screens, whether you built them or a vendor hosts them. A tool only your own staff use, such as an admin console or an internal dashboard, does not count, and neither does an API with no screen of its own. Distributing an app through an app store is Ships a mobile app, which can apply beside this one. Declaring it puts digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: ships_consumer_interface

In the activity registry: what triggers it, and the law it brings into scope

Ships a mobile app App activity

Your app is distributed as a native application for a phone or tablet, through an app store or a direct install. This covers an iOS or Android app listed in an app store, and a sideloaded app installed directly onto a device. A browser-based site with no installable app does not count on its own. Declaring it puts age-gating law, cybersecurity law, product-liability law and digital-accessibility law in scope, along with any other law that names this activity.

In an app profile: ships_mobile_app

In the activity registry: what triggers it, and the law it brings into scope

Ships encryption App activity

Your app implements cryptography, or bundles a library that does, beyond calling the platform's own secure-connection or cryptography APIs. This covers a cryptography library in the dependency tree or in vendored source, a custom cipher, and a bundled secure-connection stack or end-to-end encryption of your own. Calling HTTPS through the platform's stock client does not count. Declaring it puts export-control and sanctions law in scope, along with any other law that names this activity.

In an app profile: ships_encryption

Signatures and records Law family

When an electronic signature or record counts in place of a handwritten one or paper, and what keeping it requires. This family covers the laws that give electronic signatures, seals and records legal effect, and the conditions that effect depends on: in the United States, the Electronic Signatures in Global and National Commerce Act and the states' Uniform Electronic Transactions Act, and in the EU, the eIDAS Regulation's rule that an electronic signature may not be refused only for being electronic. Where a law requires a record in writing, an electronic one has to stay accurate and reachable by everyone entitled to it for as long as the record must be kept.

Snippet reproduction Law family

Copyright exceptions letting a news aggregator quote a short excerpt, or excluding bare facts and news items from protection altogether, without the publisher's permission. Copyright law in a given country commonly excludes bare facts and news of the day from protection outright, so an aggregator reporting the same underlying facts a competitor first published is not infringing merely by doing so. Separately, a copyright statute's quotation or press-review exception lets anyone reproduce a short excerpt of a protected work, including a news article, for purposes such as commentary or informing the public, usually conditioned on crediting the source. Where a jurisdiction has also created a press publishers' right, that right can narrow the exception for an excerpt longer than very short, and that boundary is where most disputes over snippets turn.

Social media and minors Law family

Laws requiring a social media platform to check a user's age, get parental consent for a minor's account, or limit messaging and advertising for young users. This family covers statutes regulating how a social media or online platform treats users who are, or may be, minors: estimating or verifying a user's age, requiring verifiable parental consent before a minor can hold an account, and restricting features such as direct messages, targeted advertising, or an algorithmic feed for an account flagged as a child's. A version can set a confidence threshold a platform must clear before treating a user as an adult, or instead focus on monitoring duties, such as detecting child sexual abuse material, or on a platform's own default safety settings for minor accounts. The applicability threshold and the age cutoff both vary by jurisdiction.

Specific illegal content Law family

Rules aimed at one kind of illegal content, such as terrorist content or child sexual abuse material, each with its own removal or reporting duty. This family covers regimes written for a particular category of illegal content rather than for hosting in general: the EU rule that terrorist content be removed within one hour of a removal order, duties to detect or report child sexual abuse material, and regimes for the non-consensual sharing of intimate images. Each sets its own clock and its own authority, on top of whatever general hosting rules apply.

Statute Instrument type

A law passed by a legislature. A statute is the text a legislature debated, amended, and passed through its ordinary lawmaking process, carrying a citation once it is enacted. It binds whoever it applies to once it is in force, unlike a bill, which binds no one until it is enacted, or guidance, which only explains how a regulator reads a law that already exists. A regulation usually fills in the detail a statute leaves to an agency, while the statute itself sets the underlying duty.

Supplier to a financial entity (LexLint question)

You supply this software to a bank, insurer or other regulated financial entity. The other answer to the financial-services question. A duty that binds the financial entity is then shown as the customer's, and a duty that binds its technology suppliers as the caller's.

Supplier to a public body (LexLint question)

You sell this software to public bodies or run it for them. The other answer to the public-body question. A duty that binds a public body is then shown as the customer's, and a duty that binds its suppliers as the caller's.

Switching and interoperability Law family

A law that lets a customer of a hosted cloud service move to another provider, or use several at once, without obstruction or switching charges. This family covers laws that remove the obstacles to leaving a cloud service or using more than one at a time: the contract terms that make switching workable, the information a provider must give before and during the contract, limits on switching and egress charges, functional equivalence, and open interfaces. The EU Data Act's cloud chapters are the first of them, and national cloud laws can carry the same duties. It usually names the services it covers, the notice and transition periods, any exemption for custom-built services, the date a charge ban applies from, and the authority that checks the market.

Telephone contact Law family

Rules restricting unsolicited telemarketing calls and faxes, including do-not-call registries, consent duties, and a ban on transmitting faked caller ID. This family covers statutes restricting telephone and fax contact made for marketing purposes: do-not-call registries a business must screen against before calling, consent requirements before an automated or live marketing call, and record-keeping duties proving that consent was given. A related but distinct rule bans deliberately transmitting false or misleading caller ID information to defraud or cause harm, without restricting a caller's own right to block its caller ID. The consent standard, opt-in, opt-out, or a do-not-call list, and whether business-to-business calls are covered, both vary by jurisdiction.

Text and data mining (TDM) opt-out Law family

A copyright exception letting anyone mine text and data from lawfully accessible works, unless the rightsholder has opted out with a machine-readable signal. The 2019 Digital Single Market copyright directive created a general exception letting anyone reproduce and extract lawfully accessible copyrighted works, including online news content, to mine text and data for patterns and information, unless the rightsholder has opted out. A rightsholder opts out with an appropriate, typically machine-readable, reservation, commonly read as covering signals aimed at blocking AI training and similar automated mining. A narrower, opt-out-proof version of the same exception exists for research organizations and cultural-heritage institutions mining for scientific research, and each EU member state transposes both versions into its own copyright statute.

Tracks devices App activity

Your app identifies or follows a specific phone, browser, or other device across visits, or across other sites and apps. This covers a device-fingerprinting technique, an advertising identifier your app reads, and a tracking cookie set for a returning visitor. A session token that only keeps a single visit logged in, and is discarded when the visit ends, does not count in the same way. Declaring it puts communications law and product-liability law in scope, along with any other law that names this activity.

In an app profile: tracks_devices

In the activity registry: what triggers it, and the law it brings into scope

Trains models App activity

Your app uses data to train or fine-tune a machine learning model, rather than only calling a model someone else already trained. This covers building a recommendation model from user activity, fine-tuning a language model on your own documents, and training an image classifier on photos users upload. Calling a third-party model's inference API without training or fine-tuning anything does not count. The duties only the provider of a general-purpose AI model or a frontier developer owes are on those two roles, declared on their own. Declaring it puts scraping and crawling law, AI law and product-liability law in scope, along with any other law that names this activity.

In an app profile: trains_models

In the activity registry: what triggers it, and the law it brings into scope

Transparency and process Law family

The process duties that come with moderating users' content: explaining decisions, handling complaints and appeals, and publishing reports about moderation. This family covers what a platform owes the people whose content it moderates and the public: a statement of reasons when it removes or restricts content, an internal complaint and appeal process, access to out-of-court dispute settlement, clear terms of service and periodic transparency reports. Some duties apply only above a size threshold, such as the EU's very large online platforms, which also carry risk-assessment and audit duties.

Unfair competition Law family

A general legal ban on unfair commercial conduct between competitors, used in some countries to reach data scraping that copyright and trade-secret law do not cover. Unfair competition law is a general prohibition, found in a country's commercial or competition code, on conduct that is deceptive or otherwise unfair toward a competitor or consumer, distinct from the narrower doctrines of copyright and trade secret law. A jurisdiction can apply or amend this general clause to reach conduct such as scraping or acquiring a rival's data by evading its technical access controls, or free-riding on a competitor's investment or effort. Because the clause is general rather than data-specific, its reach into scraping depends on how that jurisdiction's courts have applied it, and the remedy is usually an administrative or civil order rather than a criminal one.

Vulnerability and incident reporting Law family

Duties requiring an organization to report a cybersecurity incident or a discovered vulnerability to a government authority, usually within a fixed number of hours. These statutes require an organization, often one designated as operating essential or important infrastructure, to notify a national cybersecurity authority on discovering a vulnerability, a near-incident, or an actual security incident that meets a materiality threshold. A common pattern sets a short initial notification window, often within 24 hours of becoming aware, followed by a fuller assessment within a longer window such as 72 hours, and sometimes a final report within a set number of weeks. Some versions also add duties to monitor for risk continuously, synchronize system clocks to a trusted time source, and retain logs, so an incident can be reconstructed accurately afterward.

§ · Acronyms

Every acronym the site annotates, with the sentence its tooltip carries. The same sentence appears wherever the acronym does.

A2A Agent2Agent: Agent2Agent: an open protocol for agents to talk to each other, hosted by the Agentic AI Foundation.
ACCC Australian Competition and Consumer Commission: Australian Competition and Consumer Commission: the national consumer-protection and competition regulator, which also acts against software under the Australian Consumer Law.
ADMT automated decision-making technology: Automated decision-making technology: the term California's privacy rulemaking uses for systems that make or substantially replace human decisions about people.
AEDE: Asociación de Editores de Diarios Españoles, the Spanish newspaper publishers' association the 2014 press levy was named after.
BIPA Biometric Information Privacy Act: Biometric Information Privacy Act: the Illinois statute that requires written consent before a biometric identifier such as a faceprint or voiceprint is collected, and gives the person a private right of action.
CAI: Commission d'accès à l'information: Quebec's access-to-information and privacy regulator, the strongest of Canada's provincial commissioners since Law 25.
CCPA California Consumer Privacy Act: California Consumer Privacy Act: the state privacy law, amended by the CPRA in 2020, that the other US state acts are modeled on or written against.
CFAA Computer Fraud and Abuse Act: Computer Fraud and Abuse Act: the main United States federal statute on unauthorized access to computer systems.
COPPA Children's Online Privacy Protection Act: Children's Online Privacy Protection Act: the US federal statute requiring verifiable parental consent before collecting personal information from children under 13.
CPPA California Privacy Protection Agency: California Privacy Protection Agency: the dedicated privacy regulator California created in 2020, the only one of its kind in the United States.
CPRA California Privacy Rights Act: California Privacy Rights Act: the 2020 ballot measure that amended the CCPA and created the CPPA.
CRA Cyber Resilience Act: Cyber Resilience Act: the EU regulation that makes the manufacturer of a product with digital elements, software included, responsible for its security, its vulnerability handling and its incident reporting.
CSIRT computer security incident response team: Computer security incident response team: the national or sector body that receives cyber incident reports under EU law.
DCO Developer Certificate of Origin: Developer Certificate of Origin: a line on a commit by which its author states they have the right to contribute the change.
DMCA Digital Millennium Copyright Act: Digital Millennium Copyright Act: the United States statute whose section 1201 prohibits circumventing technological measures that control access to copyrighted works.
DPA data protection authority: Data protection authority: the competent authority for personal-data law in a jurisdiction, called a supervisory authority in the GDPR.
DPIA data protection impact assessment: Data protection impact assessment: the written risk assessment the GDPR requires before high-risk processing, about harm to the people whose data is used.
DSA Digital Services Act: Digital Services Act: the EU regulation on online intermediaries, with the heaviest duties on very large online platforms and search engines.
DSM Digital Single Market: Digital Single Market: the EU's 2019 copyright directive, whose Article 4 lets rightsholders reserve their works against text and data mining.
ECOA Equal Credit Opportunity Act: Equal Credit Opportunity Act: the United States fair-lending statute whose adverse-action notice duty applies however a credit decision was made, including by a model.
EDPB European Data Protection Board: European Data Protection Board: the EU body that issues guidance and binding decisions on how data protection law is applied across member states.
EMV expected monetary value: Expected monetary value: likelihood times loss, summed over scenarios; the number the LexLint Risk Score is built on.
FAIR Factor Analysis of Information Risk: Factor Analysis of Information Risk: the Open Group standard that prices cyber risk as loss event frequency times loss magnitude; LexLint borrows its structure.
FTC Federal Trade Commission: Federal Trade Commission: the US consumer-protection regulator that enforces privacy and data security through its unfairness and deception authority and sector rules.
GDPR General Data Protection Regulation: General Data Protection Regulation: the EU's data protection law, which governs any processing of personal data about people in the EU, wherever the processor is.
GEMA: The German collecting society that licenses performance and reproduction rights in music on behalf of composers, lyricists and publishers.
GLBA Gramm-Leach-Bliley Act: Gramm-Leach-Bliley Act: the United States statute whose safeguards rule governs how financial institutions protect customer data, with a breach-notification duty since 2024.
GNI gross national income: Gross national income: GDP plus net income from abroad; Ireland's modified version, GNI*, strips out what multinationals route through the country.
GPAI general-purpose AI: General-purpose AI: a model that can serve many different tasks, such as a large language model; the EU AI Act sets specific duties for providers of these models.
GRC governance, risk, and compliance: Governance, risk, and compliance: the category of tool a risk register is exported to, and the vocabulary its fields are named in.
GVA gross value added: Gross value added: an industry's output minus what it bought in, the measure LexLint uses for the size of a jurisdiction's software sector.
HIPAA Health Insurance Portability and Accountability Act: Health Insurance Portability and Accountability Act: the United States statute whose privacy, security and breach-notification rules govern protected health information.
ICO Information Commissioner's Office: Information Commissioner's Office: the United Kingdom's data protection authority, which also enforces the electronic-marketing rules.
IETF Internet Engineering Task Force: Internet Engineering Task Force: the open standards body that develops the core protocols of the internet, published as numbered documents in the RFC series.
ISIC International Standard Industrial Classification: International Standard Industrial Classification: the United Nations industry taxonomy whose divisions J62 and J63 are software and information services.
JTC Joint Technical Committee: Joint Technical Committee 1 of ISO and IEC: the committee that writes the international standards for information technology, through which SPDX became ISO/IEC 5962:2021.
LGPD: Lei Geral de Proteção de Dados: Brazil's general data protection law, in force since 2020, which includes a right to review of decisions made solely by automated processing.
LLM large language model: Large language model: an AI model that reads and generates text, the kind behind coding agents and chatbots.
LRS LexLint Risk Score: LexLint Risk Score: likelihood times impact on a one-to-twenty-five scale, banded, from cited defaults in the law library and the app's own exposure inputs.
MCP Model Context Protocol: Model Context Protocol: the open standard coding agents use to discover and call external tools such as LexLint.
NAICS North American Industry Classification System: North American Industry Classification System: the US, Canadian, and Mexican industry taxonomy; software publishers are 5112 and computer systems design is 5415.
NDJSON newline-delimited JSON: Newline-delimited JSON: a file holding one JSON record per line, so it can be streamed and filtered without loading the whole thing.
NIS2: The second Network and Information Security Directive: the EU directive that sets cybersecurity risk-management and incident-reporting duties for essential and important entities.
NIST National Institute of Standards and Technology: National Institute of Standards and Technology: the US standards body whose AI Risk Management Framework supplies the role names in AI governance.
OAIC Office of the Australian Information Commissioner: Office of the Australian Information Commissioner: Australia's privacy regulator under the Privacy Act 1988.
OSAA Open Secure AI Alliance: Open Secure AI Alliance: an industry coalition, a Linux Foundation directed fund since September 2026, working on the security of AI agent systems.
PDPA Personal Data Protection Act: Personal Data Protection Act: Singapore's personal-data statute of 2012, enforced by the PDPC; Thailand and Malaysia have acts of the same name.
PDPC Personal Data Protection Commission: Personal Data Protection Commission: Singapore's data protection authority, which publishes its enforcement decisions in full.
PEP Python Enhancement Proposal: Python Enhancement Proposal: the numbered design document through which a change to Python or to its packaging standards is proposed, discussed and accepted.
PIA privacy impact assessment: Privacy impact assessment: the older, public-sector name for a data protection impact assessment, still the term in Canada and in US federal agencies.
PII personally identifiable information: Personally identifiable information: the older US term for personal data, narrower than the legal definition because it is built around identifiers.
QA quality assurance: Quality assurance: the testing that decides software is fit to ship.
RDAP Registration Data Access Protocol: Registration Data Access Protocol: the newer lookup that is replacing Whois for domain registration records, returning the same registrant details with the same redactions.
RFC Request for Comments: Request for Comments: the numbered document series in which internet standards are published.
RSL Really Simple Licensing: Really Simple Licensing: an industry-consortium scheme, launched in 2025, for publishing machine-readable license terms for AI use of web content.
RSS Really Simple Syndication: Really Simple Syndication: a feed format a site publishes so a reader can fetch its new items on a schedule.
SAFE Shared AI Findings Exchange: Shared AI Findings Exchange: the Open Secure AI Alliance's compact for reporting and learning from AI incidents. Voluntary to join, and not law.
SARIF Static Analysis Results Interchange Format: Static Analysis Results Interchange Format: the standard file that code-scanning tools and build pipelines exchange findings in, and one of the formats a LexLint run exports as.
SBOM Software Bill of Materials: Software bill of materials: a machine-readable list of the components a piece of software is built from, each with its version, its supplier and often its license.
SEC Securities and Exchange Commission: Securities and Exchange Commission: the United States regulator of listed companies, whose Form 8-K Item 1.05 makes a registrant disclose a material cybersecurity incident.
SME small or medium-sized enterprise: Small or medium-sized enterprise: under the EU AI Act an SME pays the lower of a fine's fixed cap and its turnover percentage, not the higher.
SOCAN Society of Composers, Authors and Music Publishers of Canada: Society of Composers, Authors and Music Publishers of Canada: the Canadian performing-rights society that licenses music on behalf of its members.
SPDX Software Package Data Exchange: Software Package Data Exchange: the Linux Foundation project whose license list gives each license a standard short identifier, such as Apache-2.0 or GPL-2.0, that files and package metadata can carry.
SSE server-sent events: Server-sent events: a one-way stream from server to client over HTTP, used by the older MCP transport that streamable HTTP replaced.
TCPA Telephone Consumer Protection Act: Telephone Consumer Protection Act: the United States statute on automated calls and texts, which the Federal Communications Commission has read to cover calls made with an AI-generated voice.
TDM text and data mining: Text and data mining: automated analysis of text or data, such as crawling pages to extract information or to train a model.
TLD top-level domain: Top-level domain: the last part of a domain name, such as .com or .ai.
UETA Uniform Electronic Transactions Act: Uniform Electronic Transactions Act: the model United States state law under which a contract may be formed by the interaction of electronic agents, with no person reviewing the exchange.
URI Uniform Resource Identifier: Uniform Resource Identifier: a string that names a resource in one agreed form, of which a web address is one kind.
URN Uniform Resource Name: Uniform Resource Name: the permanent, location-independent name UnGovr assigns to every government entity, which stays valid even if the entity's page moves.
VLOP very large online platform: Very large online platform: a platform the European Commission has designated as reaching 45 million or more monthly users in the EU, which the Digital Services Act gives extra duties.
VLOSE very large online search engine: Very large online search engine: a search engine designated on the same 45 million user threshold as a very large online platform, and carrying the same extra Digital Services Act duties.
VPN virtual private network: Virtual private network: a service that carries a connection through another server, so a request appears to come from that server's address.
WAMCA: The Dutch collective-action act of 2020 that allows opt-out damages claims by representative foundations, which made the Netherlands a preferred venue for EU-wide claims.
WARC Web ARChive: Web ARChive: the file format web archives use to store a fetched response as received, with its headers and the time it was fetched.

How the words are chosen. One definition per term, in the usage of the United States bar, because that is where most of LexLint's readers meet the law. A regime that says it differently gets a row under the definition rather than a second definition, so a reader who declares a home jurisdiction can be shown their own word in the text with ours underneath it. None of this is legal advice.

In cybersecurity usage	incident. An incident is any event that compromises a system's security; only an incident that reaches personal data is a breach in the legal sense, and the notification duty attaches to the legal one.
United States	breach of the security of the system. The fifty state breach-notification statutes each define it; most exclude encrypted data where the key was not taken.

United States	opt-in, affirmative authorization. Required for sensitive data under the state acts, for children's data under Children's Online Privacy Protection Act (COPPA), and for biometric identifiers under Illinois law.
In software usage	consent banner. The cookie banner is one consent mechanism, for one duty, and is not the same thing as a lawful basis for the processing behind it.

United States	business and service provider. California's terms under the California Consumer Privacy Act (CCPA); other state acts say controller and processor.
In software usage	data owner and vendor. Engineering and procurement usage that maps loosely; a vendor that decides what to do with the data is a controller whatever the contract calls it.

United States	data protection assessment, privacy impact assessment. The state acts say data protection assessment; US federal agencies have done privacy impact assessments under the E-Government Act since 2002, which is where the older privacy impact assessment (PIA) term comes from.
Canada	privacy impact assessment. Required of federal institutions by Treasury Board policy and of private organizations by Quebec's Law 25.

United States	consumer. The state privacy acts say consumer, and several exclude employees and business contacts from the definition.
In software usage	user. A user is whoever operates the product; a data subject is whoever the data describes, which includes people who never used it.

United States	personal information, personally identifiable information (PII). Personally identifiable information is the older, narrower US notion built around identifiers; the state privacy acts define "personal information" broadly enough to match the EU term.
In cybersecurity usage	PII. Security frameworks still use PII as a data classification label; it under-includes inferences and pseudonymous identifiers that privacy law covers.

In economics usage	gross value added (GVA), International Standard Industrial Classification (ISIC) J62 and J63. Gross value added is output minus intermediate consumption; the sector is divisions J58.2, J62, and J63 of the international industrial classification, and North American Industry Classification System (NAICS) 5112, 5415, and 518 in North America.
In economics usage	modified gross national income, gross national income (GNI). Ireland's statistical office publishes GNI to strip out the profit and intellectual property that multinationals route through the country, the canonical measure of the produced-versus-booked gap.