docs/LEGAL-COMPLIANCE.md

SwitchLingo — Legal Risk & Compliance Map (Nexi, 2026-11-07)

Plain-English working document, not legal advice. Have a California attorney review before charging money.

Federal

Law	What it means for us	What SwitchLingo does
DMCA §512(c) (copyright safe harbor)	Users upload or link other people's videos. Safe harbor needs fast takedowns, a repeat-infringer policy, and a designated agent registered with the Copyright Office	Report form with all DMCA notice elements and a sworn statement; instant removal; blocklist of identical files; repeat-infringer policy in the Terms. ⏳ Thai: register the agent
TAKE IT DOWN Act (FTC enforcement since May 2026; ~$53k per violation)	Sites that host user content must remove non-consensual intimate imagery (including AI fakes) within 48 hours and remove identical copies	Public report form (no login); auto-removal on submission; SHA-256 blocklist for identical copies; good-faith removal
FTC Act §5 (deception)	Don't mislead people about AI voices or results	Visible "AI translated" label and metadata on every video; "never the real person" notices; accuracy disclaimer
COPPA (actual-knowledge standard for general-audience sites)	Collecting data from under-13s needs parental consent; a neutral age screen is the accepted method, and kids must not be able to just go back and change their answer	Neutral age screen with truthful-age disclaimer; "Under 13" locks the device for 30 days; under 13 blocked; 13–17 in Teen mode (no cloning, recordings, premium voices or payments; Clean mode forced, enforced on the server); 18+ full features
ROSCA (online subscriptions)	Clear terms, express consent, easy cancellation	Built into the paid-plans section of the Terms; enforced when checkout is built

State

Law	What it means	What SwitchLingo does
Cal. Civ. Code §3344 + common-law right of publicity	Using someone's voice or likeness without consent	Voice cloning requires a "my voice / I have permission" checkbox (enforced on the server; otherwise cloning switches off); "voice/likeness" complaints are auto-removed
Tennessee ELVIS Act (2024)	Liability for making available a tool whose primary purpose is producing a person's voice without authorization	Our primary purpose is translation; cloning is optional, needs a consent statement, and is labeled. Consent is logged per job (terms version + time)
Illinois BIPA / Texas CUBI / Washington biometric law	Voiceprints are biometric identifiers; collecting them needs written consent and a retention policy (active class actions in 2026)	Voice profiles are computed in memory only, never stored, never used to identify anyone. Contributed recordings need explicit consent and are kept as audio only, deletable on request. Disclosed in the Privacy Policy
California AI Transparency Act (SB 942/AB 853), operative Aug 2, 2026	Applies to GenAI providers with 1M+ monthly users: visible and hidden AI disclosures plus a detection tool	Not covered yet, but compliant in advance: visible label + embedded metadata (system, version, date, content ID). Detection tool due once we near 1M users
California Age-Appropriate Design Code (age-estimation rule in effect since the Mar 2026 Ninth Circuit ruling)	Covers CCPA-size "businesses" (~$26M+ revenue or 100k+ consumers' data sold/shared) likely to be accessed by kids	Not covered yet. Teen mode already applies child-level protections. Revisit at scale
California AB 1043 (Digital Age Assurance Act)	Operating systems send age signals to apps (≈2027)	Applies if we ship a phone app: request and honor the OS age signal
Cal. Penal Code §632 (all-party consent to record)	Recording people without consent is illegal	Warning on the Record tab; banned in the Terms
CalOPPA / CCPA	Any site collecting personal info from Californians must post a privacy policy; CCPA rights apply at larger scale	Privacy Policy posted; deletion/access requests via form; honored for everyone
State election deepfake laws	Deceptive AI media of candidates near elections	Banned in Acceptable Use; complaints auto-removed
California Automatic Renewal Law (amended July 1, 2025)	Paid plans: clear disclosures, express consent (stored 3 years), trial-ending notice, annual reminder, cancel online with no obstruction, 7–30 day price-change notice	Must be built into checkout (next task)

Platform and contract risk

• Downloading from Facebook, Instagram or TikTok links can break those sites' terms. Mitigation: the user is responsible (Terms), personal-use framing, and file upload is always available.
• Model licenses: NLLB is non-commercial → swapped for MADLAD-400 (Apache-2.0). Free Edge voices come from an unofficial endpoint → move paid plans to Azure Speech before charging.

Safeguards in the product (live)

• Consent checkbox before every job (18+, rights to the video, Terms) — enforced on the server
• Voice-clone consent — enforced on the server
• Visible "AI translated · SwitchLingo" label on every video + embedded ai_generated metadata
• Terms, Privacy Policy, Report/Contact page linked in the footer and on every result
• Instant removal and identical-copy blocking on intimate, voice, copyright and harm reports
• Admin review: /api/admin/reports?token=…, restore via /api/admin/restore
• No IP addresses on disk; uploads deleted after 24h; no accounts, ads or tracking cookies

Thai's to-do list

1. Register a DMCA designated agent: copyright.gov/dmca-directory, $6, renew every 3 years. Use the business address, not home.
2. SwitchLingo belongs to Nova R&D Labs (novard.ai). Confirm Nova R&D Labs' exact legal entity (e.g. an LLC registered with the CA Secretary of State) so the Terms can name it, and keep SwitchLingo's money and accounts under it.
3. Attorney review of Terms and Privacy before charging money.
4. Consider tech E&O + cyber insurance before the paid launch.