Start here. No expertise required.
People share their data.
What happens next?
If your app collects information about people, this is for you.
You may be building your first app, using an AI coding tool, or hiring someone to build software for your business. Start with the information moving through that software.
01 / Three ideas, in plain language
Privacy. Security. Responsible handling.
- Privacy asks: should we use it this way?
- What information do you collect? Why? What have you told people? What choices and rights do they have?
- Security asks: how do we protect it?
- Who can access the information? How is it stored and sent? What stops someone from seeing data they shouldn't?
- Responsible handling follows the whole journey.
- Collect what you need. Understand where it goes. Limit access. Decide when to remove it. Prepare for something going wrong.
A privacy policy is a statement. Your app's behavior is the proof.
02 / Ordinary features. Important questions.
You might already be doing this.
- “We save customer emails.”
- Who can see them? Are they only used for booking, or also marketing? Can a customer change a preference?
- “Parents create accounts for their kids.”
- Does the service collect children's information? How old are they? Are parental notice and permission requirements relevant? See the COPPA starting point →
- “We verify people with a face scan.”
- Are you creating biometric identifiers? What notice, permission, retention, and deletion rules should be reviewed? See the Illinois starting point →
- “We send conversations to an AI model.”
- Could they contain names, health details, or information about children? Which provider receives them? What are its retention and training settings?
03 / Why the law matters
Small doesn't always mean exempt.
Different rules cover different situations. Some depend on business size or data volumes. Others depend on children, biometric information, a security incident, or where and how you serve people.
For example, COPPA covers certain online services collecting information from children under 13. GDPR can cover a business outside the EU when it offers services to people there or monitors their behavior there.
Sources: FTC: COPPA ↗ · European Commission: GDPR scope ↗
Your business address is only one part of the picture. Your users, your data, your activities, and exemptions matter too.
04 / Your first five questions
Bring these to your builder.
- What information does the app collect? Include logs, uploads, analytics, and AI conversations.
- Where does it go? List databases, service providers, and AI tools.
- Who can access it? Check customers, staff, administrators, and vendors.
- How long do we keep it? Include backups and copies held by providers.
- How do people make a choice or ask for help? Explain what can be changed, deleted, or escalated.
These are useful starting questions, not a complete compliance checklist. The FTC's guide also explains minimization, safeguards, disposal, and incident planning.