The Legal Basics of a Startup Marketing Site

1. Blog
2. Ops, Teams & AI

By Saroj Jha · October 22, 2026 · 9 min read

Most startup marketing sites are built fast and checked later. In my view four things are worth getting right early, because fixing them after a complaint costs more than building them in: a site people with disabilities can use, sign-up terms a court would enforce, a privacy policy where the law expects one, and a clear view of what you own when AI wrote part of the page. None of this needs a lawyer to start, but have one review it before you rely on it. This is general information, not legal advice, and I am not a lawyer.

The rules are less mysterious than they sound. The Justice Department says the ADA applies to the goods and services businesses offer on the web but sets no single technical standard, so most teams build to WCAG 2.2 Level AA. A Ninth Circuit case shows that terms in tiny gray type did not bind users. California expects a conspicuous privacy policy wherever you collect personal information from its residents. And the Copyright Office says prompts alone do not make you the author of what AI produces.

1. Make the site usable by people with disabilities

The Justice Department’s web accessibility guidance says the ADA’s requirements apply to all the goods, services, privileges or activities offered by public accommodations, including those offered on the web, and that “a website with inaccessible features can limit the ability of people with disabilities to access” a business’s goods, services and privileges. It does not set one mandatory technical standard for private businesses. It names the Web Content Accessibility Guidelines (WCAG) and the Section 508 Standards as “helpful guidance”, and says businesses “have flexibility in how they comply”^[1].

In my view, WCAG 2.2 at Level AA is the reference most teams should build to, because it is the published standard the guidance points to. The guidance lists six examples of barriers; this table matches each to the WCAG 2.2 criterion that addresses it and to a check you can run this week.

One rule is binding and dated, but it applies to governments, not to you directly. The Justice Department’s 2024 rule requires state and local governments, including public school districts, to meet WCAG 2.1 Level AA. An interim final rule effective April 20, 2026 moved the compliance dates to April 26, 2027 for entities with a population of 50,000 or more, and to April 26, 2028 for smaller entities and special districts^[3]. If you sell to schools or public agencies, expect them to ask about your product’s accessibility as well as your site’s; the EdTech Marketing Playbook covers that review.

2. Show your terms where a court would expect to see them

If your sign-up or checkout binds people to terms, such as an arbitration clause or automatic renewal, how you show those terms decides whether they hold. In Berman v. Freedom Financial Network (2022), the Ninth Circuit set out a two-part test for terms a user never actually read: the website must provide “reasonably conspicuous notice of the terms to which the consumer will be bound”, and the consumer must take “some action, such as clicking a button or checking a box, that unambiguously manifests his or her assent to those terms”^[4].

The notice in that case failed. The court said it was “printed in a tiny gray font considerably smaller than the font used in the surrounding website elements”, and the hyperlinked words were in the same gray as the rest of the sentence, not in the color that signals a link. The court affirmed the order denying the defendants’ motion to compel arbitration, so the arbitration clause was not enforced.

The fix is cheap. Put one sentence directly above or beside the button, in readable type, that ties the click to the terms, as the court itself suggested: “By clicking the Continue >> button, you agree to the Terms & Conditions.” Make “Terms & Conditions” a link that looks like a link. In my view, do not rely on a footer link and continued use of the site.

If you sell subscriptions online, a federal law adds its own rules. Section 4 of the Restore Online Shoppers’ Confidence Act makes it unlawful to charge for goods or services sold online through a negative option feature, such as an automatically renewing subscription, unless you clearly and conspicuously disclose all material terms before taking billing information, obtain the consumer’s “express informed consent before charging”, and provide simple mechanisms to stop recurring charges^[5]. The FTC’s 2024 “click-to-cancel” rule, which would have added more, was vacated by the Eighth Circuit on July 8, 2025 because the Commission failed to follow procedural requirements^[6]. In March 2026 the FTC asked for public comment on a new rulemaking on negative option practices^[7]. Either way, the 2010 Act still applies.

3. Post a privacy policy if you collect personal information

California’s Online Privacy Protection Act requires the operator of a commercial website that collects personally identifiable information about California residents to “conspicuously post” its privacy policy. The statute’s definition of personally identifiable information includes a name, an e-mail address and a telephone number, so a newsletter form is enough. An operator is in violation only if it fails to post the policy within 30 days after being notified of noncompliance^[8].

The statute counts a text link on your homepage or first significant page as conspicuous if it includes the word “privacy” or is set off from the surrounding text^[9]. A footer link labelled “Privacy Policy” on every page is the usual way to do it. Other state laws and the cookie rules in Europe go further; AAJ’s article on privacy and advertising rules covers them.

4. Know what you own when AI wrote part of the page

The US Copyright Office’s January 2025 report on copyrightability says that, based on the functioning of current generally available technology, “prompts do not alone provide sufficient control” to make the person who wrote the prompt the author of the output. What a person contributes can still be protected: their own works of authorship that are perceptible in AI-generated outputs, “the creative selection, coordination, or arrangement of material in the outputs”, and creative modifications, judged case by case^[10].

The courts start from the same place. In March 2025 the D.C. Circuit held in Thaler v. Perlmutter that “human authorship is required for registration”^[11], and on March 2, 2026 the Supreme Court denied the petition for review^[12]. That case involved a work Thaler said was created by an AI system alone, so it does not tell you how much human editing is enough.

For a marketing site this matters in two places. First, a page that is mostly unedited AI output may be hard to protect if a competitor copies it, so in my view the pages you care about most, such as your positioning, case studies and research, should carry real human writing and editing. Second, if you ever register a work, the Copyright Office’s guidance says applicants “have a duty to disclose the inclusion of AI-generated content” and should exclude AI-generated content that is more than de minimis^[13]. Keep a short note of what a person wrote or changed on each important page; it costs a minute and answers the question if it ever comes up. AAJ’s article on using AI without losing your voice covers the writing side.

A one-hour checklist

• Run your five most visited pages through a contrast checker and a keyboard-only pass; fix what fails.
• Add alt text to meaningful images and captions to every video.
• Put one sentence tying the click to your terms next to every sign-up and checkout button, with a visible link.
• If you sell subscriptions, check that the price, renewal terms and how to cancel appear before payment, and that cancelling is simple.
• Link a privacy policy from every page footer, and check it covers the points California expects.
• Note what a person wrote or changed on your most important pages.

That will not make you compliant everywhere, and it is not a substitute for a lawyer reviewing your terms and privacy policy before you rely on them. It does remove the most common, cheapest-to-fix problems before anyone has to complain.

Method and limits

Every source was opened on its official page on October 22, 2026: the DOJ guidance and the Federal Register for the Title II rule, the Ninth, Eighth and D.C. Circuit opinions, the enrolled text of ROSCA, California’s official code site, the W3C recommendation of December 12, 2024, the Copyright Office report and registration guidance, and the Supreme Court docket. Quotes are verbatim; WCAG criteria are named by their W3C numbers. The rules differ by state and country, and cases turn on their facts. This is general information, not legal advice.