20 Things to Check Before Launching Your App (So You Don't Get Sued)

1. Add a privacy policy

If your app collects any personal information (even just an email address), you need a privacy policy. Privacy laws such as Canada's PIPEDA (and Quebec's Law 25), Nigeria's Data Protection Act 2023 (NDPA), the EU's GDPR and California's CCPA/CPRA all expect you to tell people how you handle their data. The Apple App Store and Google Play also require a privacy policy link for every app.

Your privacy policy should explain:

• what information you collect and why;
• how you store and protect it, and for how long;
• which third parties receive it (payment, analytics, email providers);
• how users can access, correct or delete their data, and who to contact.

A ticketing platform, for example, may collect names, emails, payment details and which events someone attended.

Don't publish a generic template. A policy that doesn't match what your app actually does can cause more trouble than having none.

Ask your AI assistant: "List every piece of personal data this app collects, where it's stored and which third-party services receive it. Then draft a privacy policy based on those actual data flows, and mark anything a lawyer should review."

2. Stop collecting data you don't need

The simplest way to reduce privacy risk is to collect less.

If your app only needs an email address to create an account, why ask for a home address, date of birth and phone number? Every extra field is data you must protect, control access to, keep for a defined time and delete on request. Most privacy laws build this in as data minimisation: collect only what you need for a stated purpose.

Also check what ends up in places you don't think about: logs, analytics tools, error trackers and backups.

3. Check every form's consent

Review your sign-up, checkout, contact and newsletter forms:

• Is every field necessary?
• Does the user understand what they're agreeing to?
• Is marketing consent a separate, unticked checkbox?
• Is the privacy policy linked where the data is collected?
• Are optional things genuinely optional?

Creating an account should not quietly subscribe someone to promotional emails. In Canada, CASL requires express (or a valid form of implied) consent before sending commercial emails, and pre-ticked boxes don't count as express consent.

4. Audit your third-party SDKs and APIs

Your app probably relies on services you didn't build: payments, analytics, authentication, email and SMS, maps, chat widgets, ad pixels.

For each one, check:

• what data it collects and where it sends it;
• what permissions it requests (especially in mobile apps);
• whether its terms allow how you're using it;
• whether you still use it at all.

Remove unused SDKs and permissions. Using a third-party service doesn't hand them responsibility for your app's data practices: if their SDK collects data through your app, you're expected to disclose it, including in Apple's privacy labels and Google Play's Data safety form.

5. Build a data deletion process

Users should be able to ask for their data to be deleted, and most modern privacy laws give them that right. Mobile stores enforce it too: Apple and Google both require apps that let users create an account to also let them delete it, and Google Play also requires a web link for deletion requests.

A "Delete my account" button is only the start. Decide:

• which records get deleted, and which you must keep (for example, transaction records for tax purposes);
• how deletion reaches third-party services (email lists, analytics, payment customer records);
• what happens to backups and logs;
• how you confirm to the user that it's done.

Deleting an account typically means removing the profile, revoking active sessions and unsubscribing the user from emails, while keeping the invoices the law requires you to keep.

6. Handle children's data properly

If your app is aimed at children, or children are likely to use it, stricter rules apply:

• US: COPPA requires verifiable parental consent before collecting personal data from children under 13.
• EU: GDPR sets the age for consenting on your own at between 13 and 16, depending on the country.
• Canada: the Privacy Commissioner's position is that children under 13 generally can't give meaningful consent themselves.

These rules can also limit targeted advertising and profiling. An "I am 18 or older" checkbox doesn't make you compliant if your app clearly appeals to kids. Look at your real audience and design for it.

7. Add a cookie policy

Cookies and similar technologies (local storage, tracking pixels, SDKs) remember users, measure traffic and power advertising, and not all of them serve the same purpose. Your cookie policy (often a section of your privacy policy) should list what you use, what each one does and how users can change their choices.

8. Add a cookie consent banner that actually works

Where consent is required, you must get it before non-essential cookies and trackers load:

• EU and UK: opt-in consent is required for anything that isn't strictly necessary.
• Quebec (Law 25): tracking features must be off by default.
• Elsewhere: the rules vary.

If you have users in these places, assume you need a proper banner.

A good banner:

• explains the categories (necessary, analytics, marketing);
• makes "Reject" as easy as "Accept";
• doesn't load analytics or ad scripts until the user agrees;
• remembers the choice and lets users change it later.

The most common bug is a banner that says "Accept" but loads Google Analytics and the Meta Pixel on page load anyway. Open your browser's Network tab, reject everything and check what still loads.

9. Write clear terms of service

Your terms set the rules for using your app. Depending on the business, they cover:

• user responsibilities and what's prohibited;
• account suspension and termination;
• payments, subscriptions and cancellations;
• who owns uploaded content;
• liability limits and how disputes are handled.

If users can sell tickets, list properties, upload content or deal with each other, your terms need to cover that.

Terms of service are not a magic shield. Clauses that conflict with consumer protection law can be unenforceable, especially against consumers.

10. Create a refund and cancellation policy

People should know before they pay:

• which purchases can be refunded, and the deadlines and conditions;
• how to cancel a subscription;
• how and when refunds are paid;
• any exceptions the law requires.

If someone buys a ticket for an event that gets cancelled and there's no clear refund process, you'll end up with angry customers, chargebacks and possible complaints to consumer protection agencies. Set the rules before someone pays, not after something goes wrong.

11. Remove hidden fees

Show the full price, including mandatory fees, before the customer commits. This is now explicit law in several places:

• Canada: "drip pricing", advertising a price that can't actually be paid because mandatory fees are added later, is a deceptive marketing practice under the Competition Act (amended in 2022).
• US: since May 2025, the FTC's fees rule requires the total price, including mandatory fees, to be shown up front for live-event tickets and short-term lodging.

If a ticket is advertised at $30 and every buyer must pay a $5 service fee, show $35. Government taxes are treated differently in some places, so check the rules where you sell.

12. Remove dark patterns

A dark pattern is a design that pushes people into choices they wouldn't otherwise make. Regulators in Canada, the US and the EU actively look for them. Common examples:

• cancelling is far harder than signing up;
• fake countdown timers or "only 2 left!" when it isn't true;
• paid extras pre-selected at checkout;
• a "Reject" button that's hidden or greyed out;
• guilt-trip wording ("No thanks, I don't like saving money").

They might lift conversions briefly, but they destroy trust and create legal risk. Let users understand the offer, compare their options and leave or cancel easily.

13. Remove fake reviews and testimonials

Never publish invented testimonials, fake ratings or AI-generated "customer" quotes. Since October 2024, the US FTC's rule on fake reviews allows penalties for fake or AI-generated reviews and for buying them, and Canada's Competition Bureau treats fake reviews as deceptive marketing.

If you use testimonials:

• make sure they're real and you have permission to use them;
• disclose if the reviewer was paid or got something free;
• don't hide negative reviews to make your rating look better.

If users can post reviews on your platform, add moderation and clear rules against fraud.

14. Remove claims you can't back up

Does your site say "100% secure", "the best platform in Canada" or "guaranteed to save you money"? Advertising law expects you to be able to prove claims like that.

Check your homepage, pricing page, app store listing and onboarding for statements about:

• security and privacy;
• speed and uptime;
• savings or earnings;
• AI accuracy;
• environmental impact ("green", "carbon neutral");
• awards, certifications and customer numbers.

Replace "completely secure" with what you actually do: "Payments are processed by Stripe and data is encrypted in transit and at rest."

15. Show who runs the business

Users should be able to see who operates the app and how to reach you. Depending on where you operate and what you sell, you may need to show:

• your legal business name;
• a contact email or form;
• a business address or registration details (the EU requires these for online businesses, and Germany is particularly strict);
• tax or registration numbers;
• for marketplaces, who the actual seller is.

App stores also require a support contact. You don't need to publish your home address if the law doesn't require it. Use a business address or a mailbox service.

16. Add an unsubscribe link to marketing emails

Every marketing email should:

• clearly identify who sent it;
• include a working unsubscribe link;
• stop the emails promptly once someone unsubscribes.

The rules where your recipients are:

• Canada (CASL): the unsubscribe link must keep working for at least 60 days after the email is sent, and you must act on it within 10 business days.
• US (CAN-SPAM): you have 10 business days to honour an opt-out.
• EU: GDPR and the ePrivacy rules apply.

Transactional emails (receipts, password resets, booking confirmations) are treated differently from promotional ones. Just don't slip marketing into them.

17. Add alt text to images

Screen readers read out alt text, so meaningful images need a short description of what they show or do:

• Product image: describe the product and what matters about it.
• Event poster: include the event name, date and venue if they aren't written elsewhere on the page.
• Icon button: say what it does ("Close", "Search"), not what it looks like.
• Decorative image: use empty alt text (alt="") so screen readers skip it.

Don't stuff alt text with keywords for SEO.

18. Fix colour contrast

Text that looks fine on your screen can be unreadable for people with low vision, or for anyone in bright sunlight. WCAG 2.2 AA requires:

• 4.5:1 contrast for normal text;
• 3:1 for large text;
• 3:1 for buttons, form borders, icons and focus indicators.

Check buttons, links, form labels, error messages, placeholder text, badges and disabled states, in both light and dark mode if you have both. Browser DevTools and free tools like the WebAIM contrast checker will flag failures.

19. Make keyboard navigation work

Some people use only a keyboard or assistive technology. Unplug your mouse and check that you can:

• reach every link, button and form field with Tab, in a sensible order;
• activate them with Enter or Space;
• always see which element is focused;
• open and close menus and dialogs, with focus returning to where it was;
• never get stuck inside a component.

Use real HTML elements (<button>, <a>, <input>) instead of clickable <div>s. They work with keyboards and screen readers for free.

20. Check your font, image and software licences

Just because something is online doesn't mean you can use it commercially. Check the licences for:

• images, illustrations and icons;
• fonts (some free fonts are for personal use only);
• templates and UI kits;
• stock video and music;
• open-source packages, especially "copyleft" licences like GPL and AGPL, which can require you to share your own code.

Keep receipts and any required attribution. AI-generated assets don't automatically settle the question: check the tool's terms, and avoid prompting for recognisable logos, characters or artists' styles in commercial work.