HOW TO READ THIS GUIDE

START WITH APPLICABILITY

Map your entity, operating locations, target markets, user ages, data flows and money flows.

Serving customers abroad can create additional duties. EU GDPR coverage can arise through an EU establishment, targeted offers or monitoring. Website accessibility alone does not settle coverage.

EVIDENCE AND PRACTICAL ADVICE

Official laws and regulator guidance support the legal examples. Triggers simplify those examples; controls are practical recommendations.

AgentX priorities are an inference from its described features. This guide does not establish that AgentX has breached a law.

PENALTIES NEED CONTEXT

A maximum fine, private damages award and refund are different remedies.

A missing policy, undeleted upload or exposed backend does not automatically produce the viral video's fixed charge per user. Liability depends on the applicable rule, facts and enforcement pathway.

THE SCOPE IS DELIBERATELY DEFINED

This is a broad checklist for digital startups, rather than an exhaustive worldwide inventory.

Sector licences, tax details, sanctions, immigration, competition and other specialist issues need separate reviews when relevant. Legal examples were checked on 30 September 2026.

PRIVACY AND USER DATA

01. MISSING OR INACCURATE PRIVACY POLICY

Trigger: Your notice omits actual collection, purposes or recipients.

Control: Match disclosures to the product and vendors; update them when practices change.

02. NO VALID BASIS FOR PROCESSING

Trigger: Personal data is processed without an applicable legal basis.

Control: Record the basis for each purpose. Consent is one possible basis; identify the conditions for your choice.

03. COLLECTING EXCESSIVE DATA

Trigger: You request information beyond what the stated purpose needs.

Control: Justify each field and permission. Remove unnecessary identity, location and sensitive data requests.

04. REUSING DATA FOR ANOTHER PURPOSE

Trigger: Service data is reused for marketing, profiling or training without the required assessment.

Control: Check purpose compatibility, legal basis and disclosure before reuse.

05. BUNDLING OPTIONAL MARKETING CONSENT

Trigger: Optional marketing permission is forced into service signup.

Control: Use separate, clear choices where consent is required; preserve evidence and allow withdrawal.

06. SENDING DATA TO UNREVIEWED VENDORS

Trigger: Personal data reaches vendors without reviewing their role and safeguards.

Control: Map recipients, purposes and retention. Document controller/processor responsibilities and required disclosures.

07. IGNORING OVERSEAS TRANSFER RULES

Trigger: Hosting or vendor access transfers data abroad without required safeguards.

Control: Map destinations and select a valid transfer mechanism where required.

08. KEEPING DATA TOO LONG

Trigger: Uploads, accounts or logs outlive their justified purpose.

Control: Set deletion or review periods and record lawful retention exceptions. Include vendor copies and backup handling.

09. IGNORING DATA RIGHTS REQUESTS

Trigger: Access, correction, erasure or consent-withdrawal requests go unanswered.

Control: Provide a request channel, verify identity proportionately and track applicable deadlines and exceptions.

10. ASSUMING OUTSOURCING ENDS RESPONSIBILITY

Trigger: The startup assumes its vendor carries every data obligation.

Control: Document responsibilities, instructions and oversight. Review vendor incidents, subcontractors and deletion commitments.

11. TRACKING BEFORE REQUIRED CONSENT

Trigger: Cookies needing permission load before consent.

Control: Block those trackers until consent. Distinguish strictly necessary cookies, explain purposes and support withdrawal.

12. CHILDREN'S DATA WITHOUT SAFEGUARDS

Trigger: A covered service collects children's data without required protections.

Control: Assess child-directed use and actual knowledge of under-13 users. Apply required parental notice, verifiable consent and limits.

SECURITY AND BREACH HANDLING

13. PUBLIC ACCESS TO PRIVATE UPLOADS

Trigger: Files intended to be private are accessible without adequate protection.

Control: Check storage exposure and access permissions. Use appropriate authorization for private files.

14. ACCESS TO ANOTHER CUSTOMER'S RECORDS

Trigger: A changed identifier reveals another user's records.

Control: Verify user and tenant permissions for relevant requests, exports and file access.

15. UNNECESSARY STAFF OR CONTRACTOR ACCESS

Trigger: People retain access beyond their role or contract.

Control: Limit privileges, review access and revoke it promptly when responsibilities end.

16. SENSITIVE DATA IN LOGS AND DEBUG TOOLS

Trigger: Passwords, documents or personal data appear in logs or diagnostics.

Control: Minimize sensitive logging and control access to monitoring and debugging systems.

17. MISSING BREACH NOTIFICATION DEADLINES

Trigger: A reportable breach is discovered without a notification process.

Control: Document all breaches. Under GDPR, notify the regulator within 72 hours of awareness unless risk is unlikely; high-risk cases require user communication.

18. UNSUPPORTED SECURITY CLAIMS

Trigger: You promise anonymity, encryption or complete security beyond verified practice.

Control: Keep evidence for each claim and review the wording when architecture or vendors change.

AI PRODUCTS AND CONTENT

19. CONFIDENTIAL UPLOADS USED BY PROVIDERS

Trigger: Provider training or reuse conflicts with your privacy or confidentiality promises.

Control: Check actual settings, contracts and retention before promising confidential handling.

20. ADDING TRAINING AFTER A DIFFERENT PROMISE

Trigger: Customer material is repurposed for model training without required review.

Control: Assess compatibility and legal basis; honor existing commitments and make required disclosures.

21. MISSING REQUIRED AI INTERACTION DISCLOSURE

Trigger: A covered AI interaction lacks the required disclosure.

Control: Assess provider/deployer duties and disclose AI interaction clearly where required. Review exceptions and transition provisions.

22. UNLABELLED DEEPFAKES OR MANIPULATED CONTENT

Trigger: Covered synthetic content is published without required transparency.

Control: Assess deepfake labels, public-interest text disclosures and provider marking duties. Different content and roles have different rules.

23. UNSUPPORTED AI PERFORMANCE PROMISES

Trigger: Marketing claims accuracy, capabilities or results without adequate evidence.

Control: Substantiate claims for the advertised conditions and communicate material limitations.

24. PROMISING EXCLUSIVE RIGHTS TO PURE AI OUTPUT

Trigger: You promise exclusive copyright for output lacking sufficient human authorship.

Control: Explain rights by jurisdiction. Document human contributions and review provider terms and third-party rights.

25. COMPANION BOTS WITHOUT CRISIS SAFEGUARDS

Trigger: A covered companion chatbot lacks required self-harm protocols or disclosures.

Control: Assess the statutory definition and implement required safeguards. Bots used only for listed business or productivity functions are excluded.

AI RULES DEPEND ON FUNCTION AND ROLE

EU Article 50 transparency obligations apply from 2 August 2026, with a limited transition for older systems' output marking.

California SB 243 targets companion chatbots. Injury caused by a violation can support actual damages or $1,000 per violation, whichever is greater.

SUBSCRIPTIONS, CHECKOUT AND REFUNDS

26. RECURRING PAYMENTS WITHOUT CLEAR CONSENT

Trigger: Auto-renewal charges start without express affirmative consent.

Control: Present renewal terms and retain a reliable record of consent.

27. HIDDEN BILLING TERMS

Trigger: Price, billing frequency or minimum commitment is obscured.

Control: Show material contract terms before purchase and provide the required confirmation.

28. OBSCURED FREE-TRIAL CONVERSION

Trigger: A trial converts to paid billing without clear renewal terms.

Control: Explain the conversion and charges; send the notices required for the trial's duration.

29. CANCELLATION IS UNNECESSARILY DIFFICULT

Trigger: Users face obstructive steps to end recurring services.

Control: Provide required cancellation methods. Online enrolment must support online cancellation without obstruction or delay.

30. CHARGING AFTER EFFECTIVE CANCELLATION

Trigger: Billing continues despite an effective cancellation.

Control: Synchronize account status with the payment provider, verify stopping charges and resolve incorrect payments.

31. MISSING RENEWAL OR PRICE-CHANGE NOTICES

Trigger: Required annual reminders or other notices are missed.

Control: Schedule notices by contract and trigger. Retain delivery records and cancellation instructions.

32. MANDATORY FEES ADDED LATE

Trigger: Unavoidable charges appear after the advertised price or required disclosure stage.

Control: Show the required total costs before the consumer commits.

33. NO-REFUND TERMS OVERRIDE STATUTORY RIGHTS

Trigger: A policy purports to remove mandatory consumer remedies.

Control: Preserve statutory rights and review exceptions, product type and applicable national rules.

34. IMMEDIATE DIGITAL ACCESS WITHOUT WITHDRAWAL HANDLING

Trigger: Immediate digital delivery is treated as automatically ending withdrawal rights.

Control: Check the applicable exception and obtain required express consent and acknowledgment before performance.

35. TAKING PAYMENT WITHOUT REASONABLE DELIVERY PROSPECTS

Trigger: Payment is accepted despite inadequate grounds to expect delivery as promised.

Control: Check fulfilment capacity, communicate material limitations and handle remedies appropriately.

CANCELLATION LAW HAS CHANGED

The FTC's 2024 click-to-cancel rule was vacated. The FTC began another rulemaking process in March 2026.

Other federal and state subscription duties remain relevant. A process taking longer than signup does not automatically equal the video's fixed penalty.

MARKETING, REVIEWS AND OUTREACH

"CLAIMS IN ADVERTISEMENTS MUST BE TRUTHFUL"

36. CREATING OR BUYING FAKE REVIEWS

Trigger: Invented customer experiences, including AI-generated ones, are used as reviews.

Control: Use genuine experiences. Check the rule's knowledge standards and hosting exceptions.

37. REWARDS CONDITIONAL ON POSITIVE REVIEWS

Trigger: Compensation is tied to favorable review sentiment.

Control: Keep any incentive independent of sentiment and disclose material incentives.

38. HIDDEN PAID OR INSIDER RELATIONSHIPS

Trigger: Relevant paid, employee, influencer or affiliate connections are concealed.

Control: Disclose material connections clearly and assess your role in procuring testimonials.

39. COMPANY RANKINGS PRESENTED AS INDEPENDENT

Trigger: A controlled review site is represented as independent.

Control: Disclose ownership and commercial connections; avoid unsupported independence claims.

40. UNSUPPORTED INCOME OR PERFORMANCE CLAIMS

Trigger: You promote earnings, savings, health benefits or performance without adequate evidence.

Control: Substantiate claims and qualify them accurately for the relevant users and conditions.

41. INVENTED SCARCITY, DISCOUNTS OR COUNTDOWNS

Trigger: Urgency or price claims misrepresent the offer.

Control: Use accurate stock, dates and comparison prices; review promotional wording and records.

42. MARKETING WITHOUT REQUIRED OUTREACH HANDLING

Trigger: Commercial email misses required identification, address or opt-out duties.

Control: Use accurate headers, provide required details and honor unsubscribe requests. Other jurisdictions may require consent.

CODE, CONTENT AND OWNERSHIP

43. FREELANCER PAYMENT WITHOUT NECESSARY IP RIGHTS

Trigger: You assume paying for code or design automatically transfers copyright.

Control: Use an appropriate written assignment or licence. Check ownership rules and work-for-hire limits.

44. FOUNDERS' EXISTING IP HAS NO DOCUMENTED COMPANY RIGHTS

Trigger: A founder contributes pre-existing work without documenting company rights.

Control: Record ownership and grant or assign the necessary rights; check prior employer and licence restrictions.

45. COMMERCIAL ASSETS WITHOUT ADEQUATE LICENCES

Trigger: Images, music, fonts, templates or code are used beyond permission.

Control: Verify commercial use, adaptation, redistribution and attribution conditions for each asset.

46. TREATING OPEN SOURCE AS UNRESTRICTED

Trigger: Software use or distribution breaches its licence.

Control: Review attribution, compatibility and source obligations. GPL, AGPL and permissive licences have different triggers.

47. A DOMAIN NAME IS ASSUMED TO CLEAR TRADEMARK RISK

Trigger: Brand investment proceeds without reviewing conflicting marks.

Control: Search relevant trademark classes and markets. Domain or company registration alone does not settle infringement risk.

48. INFRINGING USER CONTENT WITHOUT REQUIRED SAFEGUARDS

Trigger: You assume hosting immunity without satisfying eligibility conditions.

Control: Review notice handling, designated-agent registration and other applicable safe-harbor requirements.

MARKETPLACES, PAYMENTS AND WORKERS

49. HOLDING OR MOVING FUNDS WITHOUT REGULATORY REVIEW

Trigger: Customer money flows create regulated payment activity.

Control: Map custody, accounts, instructions and settlement; confirm permissions and provider responsibilities before launch.

50. ASSUMING THE ESCROW LABEL SOLVES LICENSING

Trigger: Funds are called escrow without reviewing the actual arrangement.

Control: Identify who legally holds, controls and releases money, and who handles disputes and refunds.

51. CHANGING TOKENS WITHOUT CLASSIFICATION REVIEW

Trigger: Credits gain transfer, cash-out or multi-seller payment features.

Control: Assess the actual facility, issuer and exemptions before changing its functions. Single-purpose credits require separate analysis.

52. UNLICENSED EMPLOYMENT PLACEMENT ACTIVITY

Trigger: The service falls within regulated employment-agency operations.

Control: Assess actual matching and placement functions and obtain a licence or confirm an exemption where applicable.

53. INDEPENDENT LABELS FOR EMPLOYEE RELATIONSHIPS

Trigger: Actual control and economic dependence conflict with the contractor label.

Control: Review how work operates under the applicable classification test; track rule and enforcement changes.

54. ASSUMING SMALL PLATFORMS HAVE NO DUTIES

Trigger: Size is treated as a complete exemption.

Control: Classify the service and identify applicable intermediary, hosting and platform duties. Small-business exemptions cover particular rules.

PAYMENT RULES CHANGED IN INDONESIA

Bank Indonesia's framework covers payment activities and relevant industry participants, with licensing and cooperation requirements.

For AgentX, a payment gateway integration still needs a review of who controls the funds and what each party actually does.

WORKER CLASSIFICATION IS FACT-SENSITIVE

The DOL fact sheet distinguishes current private-litigation rules from its enforcement position and notes a 2026 proposed rule.

Check the current law in each worker's jurisdiction. Scheduling, control, dependence and actual business independence deserve review.

REGISTRATION, CONTRACTS, FUNDING AND ACCESS

55. MISSING REQUIRED INDONESIAN PSE REGISTRATION

Trigger: An electronic service meets registration criteria but is unregistered.

Control: Assess offering, transaction, digital-content, communication and data-processing functions. Keep registered details current.

56. INTERNET BUSINESS WITHOUT REGISTRATION OR TAX REVIEW

Trigger: Operating online is assumed to remove business obligations.

Control: Confirm entity registration and separately assess taxes, records and filings in relevant jurisdictions.

57. STANDARD TERMS REMOVE PROTECTED CONSUMER RIGHTS

Trigger: Terms unfairly exclude remedies or shift liability.

Control: Review standard clauses under applicable consumer law; mandatory protections can limit enforceability.

58. SELLING INVESTMENT INTERESTS WITHOUT A VALID PATHWAY

Trigger: Shares or other securities are offered without registration or a valid exemption.

Control: Select an offering pathway and meet its conditions before solicitation or sale.

59. PUBLIC FUNDRAISING UNDER AN INCOMPATIBLE EXEMPTION

Trigger: An offer is advertised publicly under a pathway that restricts solicitation.

Control: Check the exemption's advertising and investor conditions before publishing.

60. INACCESSIBLE SERVICE INTERFACES

Trigger: Covered services create barriers through signup, checkout or content.

Control: Review applicability and improve keyboard access, labels, contrast and accessible alternatives.

APPLYING THE CHECKLIST TO AGENTX

AGENTX: SUGGESTED FIRST PRIORITIES

1. Customer funds and escrow structure.
2. Indonesian PSE registration.
3. Personal data and AI vendor handling.
4. Client–agent IP ownership.
5. Subscription billing and cancellation.
6. Worker and employment-agency classification.

This is a proposed review order, subject to actual operations.

AGENTX: TRACE ONE TRANSACTION

Choose an Assignment or Bounty.

Trace payment → custody → verification → release → fees → refund or dispute. Identify the responsible party at each stage.

For off-platform outcomes, document accepted evidence, fraud checks and appeal handling before promising instant rewards.

AGENTX: TRACE ONE DATA JOURNEY

Choose a CV, chat message or uploaded file.

Trace collection → permissions → storage → AI provider → output → logs → deletion. Compare the actual journey with your public promises.

Record recipients, locations, retention and who can access each copy.

TURN THE CHECKLIST INTO OWNED ACTIONS

For each applicable trap, record:

Owner → evidence → gap → action → deadline.

Prioritize financial custody, sensitive data and blocked user rights. Then align terms, privacy notices and product behavior. Repeat the review when markets, vendors or features change.

DOCUMENTS AND BEHAVIOR MUST AGREE

A policy cannot fix a contradictory product flow.

Build controls into signup, checkout, uploads, billing, payouts and account closure. Keep enough evidence to explain what users agreed to and what the system actually did.

SOURCES AND VERIFICATION

SOURCES 01–02

01. EU: EDPB data security guidance

02. US: FTC AI privacy and confidentiality commitments

The source field links to the first reference; the page link opens the second.

SOURCES 03–04

03. US: SEC general solicitation

04. Indonesia: Personal Data Protection Law

The source field links to the first reference; the page link opens the second.

SOURCES 05–06

05. Hong Kong: Six Data Protection Principles

06. EU: GDPR business guidance

The source field links to the first reference; the page link opens the second.

SOURCES 07–08

07. EU: GDPR processing principles

08. EU: Cookies and online privacy

The source field links to the first reference; the page link opens the second.

SOURCES 09–10

09. US: COPPA guidance

10. EU: EDPB breach guidance

The source field links to the first reference; the page link opens the second.

SOURCES 11–12

11. EU: AI Act Article 50 transparency guidance

12. US: Copyright and AI authorship

The source field links to the first reference; the page link opens the second.

SOURCES 13–14

13. California: SB 243 companion chatbots

14. California: Automatic Renewal Law guidance

The source field links to the first reference; the page link opens the second.

SOURCES 15–16

15. US: FTC negative-option rulemaking, March 2026

16. EU: Consumer Rights Directive

The source field links to the first reference; the page link opens the second.

SOURCES 17–18

17. EU: Unfair contract terms

18. Hong Kong: Unfair trade practices

The source field links to the first reference; the page link opens the second.

SOURCES 19–20

19. US: FTC reviews and testimonials rule

20. US: FTC advertising and marketing

The source field links to the first reference; the page link opens the second.

SOURCES 21–22

21. US: CAN-SPAM business guidance

22. US: Works made for hire, Circular 30

The source field links to the first reference; the page link opens the second.

SOURCES 23–24

23. US: Copyright for visual and graphic artists

24. GNU: Licence obligations and compatibility

The source field links to the first reference; the page link opens the second.

SOURCES 25–26

25. US: USPTO trademark process

26. US: DMCA notice handling and safe harbors

The source field links to the first reference; the page link opens the second.

SOURCES 27–28

27. Indonesia: PBI 10/2025 payment industry rules

28. Hong Kong: E-wallets and stored value

The source field links to the first reference; the page link opens the second.

SOURCES 29–30

29. Hong Kong: Employment agency licensing

30. US: Worker classification, DOL Fact Sheet 13

The source field links to the first reference; the page link opens the second.

SOURCES 31–32

31. EU: Digital Services Act questions and answers

32. Indonesia: Private PSE registration criteria

The source field links to the first reference; the page link opens the second.

SOURCES 33–34

33. Hong Kong: Internet business registration

34. US: SEC securities offering pathways

The source field links to the first reference; the page link opens the second.

SOURCES 35–35

35. US: ADA web accessibility guidance

The source field links to the first reference; the page link opens the second.

VERIFICATION AND LIMITS

Sources include statutes, regulator guidance and the original GNU licence guidance. Important privacy, consumer and ownership themes were compared across authorities.

Their jurisdictions and legal force differ. Simplified controls are original recommendations; a concrete assessment needs actual documents, money flows and product behavior.