Reviews
Part of Reading government regulation for social media apps
Government regulation examples: six situations, and which channel handles each one
Six real government regulation examples, from Illinois BIPA to the EU Digital Services Act, and the channel each one actually arrives through.
Government regulation examples reach a small operator through six different channels, and the party in front of you is rarely the party that wrote the rule. Some arrive as a letter. Most arrive as a platform notice, a renewal questionnaire or a customer's vendor review.
What to take away
- Illinois BIPA reaches most app teams through a vendor contract rather than a regulator, because the vendor carries the statutory exposure, at $1,000 or $5,000 per violation.
- The EU Digital Services Act and the UK Online Safety Act both bind platforms directly, so your first contact is usually a notice-and-appeal queue.
- New York City Local Law 144 and Illinois BIPA both touch hiring and biometric tools, and both are enforced by the people who were screened.
- Age-verification rules in Texas and Utah land on the site or the app store, which is why a rejection notice can cite no statute at all.
- A threshold you crossed months ago produces no letter. The trigger has to be yours, and California's revenue line sits near $26 million.
Six situations, and what each one actually is
1. Illinois BIPA and the facial-recognition vendor. The Biometric Information Privacy Act, 740 ILCS 14, covers scans of face geometry and voiceprints. It carries a private right of action, so the channel is an Illinois state court claim, not an agency letter. Statutory damages run $1,000 per negligent violation and $5,000 for each intentional or reckless one, plus attorney's fees.
Two decisions frame the risk. Rosenbach v. Six Flags (2019) held that a person need not show actual harm to sue. Cothron v. White Castle (2023) held that a claim accrues with each scan. Facebook paid $650 million to settle a BIPA class action in 2021, and Google paid $100 million over Photos face grouping in 2022.
A timeclock or identity-verification vendor will ask you to sign its terms and confirm your consent flow, because the vendor carries the exposure. Ask which clause a demand rests on, and route anything live to Illinois counsel.
2. The EU Digital Services Act and the platform notice. Regulation (EU) 2022/2065 imposes notice-and-action, transparency and, for very large platforms, systemic risk duties on the platform itself. A very large online platform is one averaging more than 45 million monthly active users in the EU.
You meet the DSA as a removed post or a suspended account. Appeal through the platform's own route, then to an out-of-court dispute settlement body certified by the national Digital Services Coordinator. For most of the largest platforms that coordinator is Ireland's Coimisiun na Mean.
3. The UK Online Safety Act and the age-check demand. The Online Safety Act 2023 and Ofcom's children's codes push age assurance onto services likely to be accessed by children. Ofcom enforces, with fines up to 18 million pounds or 10% of qualifying global revenue, whichever is higher. Your first contact may be a hosting or payment provider asking what you do about it. That request is a contract condition, not a statutory demand on you.
4. New York City Local Law 144 and the hiring tool. Local Law 144 requires a bias audit by an independent auditor and published results for automated employment decision tools used on New York City candidates. Penalties run $500 for a first violation, $1,500 for each later one, and $500 for each day the violation continues. The obligation is the employer's, and complaints go to the city's Department of Consumer and Worker Protection. Your applicant tracking system or screening vendor sends the questionnaire.
5. Texas HB 1181 and the app store rejection. Texas HB 1181, effective September 1, 2023, requires adult sites to verify age and run health warnings, and the Texas Attorney General enforces it. Utah's SB 194 took the site-level route the same year, and Utah's 2025 app store law moved a version of the duty onto Apple and Google. A federal challenge has kept that app store rule unsettled, so check its status before you rely on it.
A rejected update citing an unnamed policy may sit on top of that. You appeal it as a platform rule, and the question of whether the law where you are requires it is not the question being asked.
6. The threshold nobody writes to you about. CCPA and CPRA duties attach at set figures: roughly $26 million in annual gross revenue, 100,000 consumers or households, or half of revenue from selling or sharing personal information. Enforcement sits with the California Privacy Protection Agency and the Attorney General. No one sends you a letter when you cross.
The EU AI Act, Regulation (EU) 2024/1689, phases in by date and by role: prohibitions from February 2, 2025, general-purpose AI duties from August 2, 2025, and high-risk duties from August 2, 2026. Nobody notifies you. The trigger has to be set by you, against the metric the rule uses rather than the one you report internally.
Which channel, and who to talk to
| What it looks like | What it usually is | Who can change it |
|---|---|---|
| Vendor terms asking about consent | Illinois BIPA exposure passed by contract | Your counterparty, on scope and timing |
| A removed post or suspended account | DSA or Online Safety Act duties on the platform | The platform's appeal route, then a DSA dispute body |
| A renewal questionnaire on hiring tools | NYC Local Law 144 and DCWP, the employer's duty | Your broker or the buyer |
| A rejected app store update | Texas HB 1181 or Utah's 2025 app store law, the store's duty | The store's appeal process, at Apple or Google |
| A letter from a regulator | A direct obligation under one of the rules above | Qualified counsel, before you reply |
| Nothing at all, and a rule now applies | A CCPA or EU AI Act threshold you crossed | You, by monitoring it |
The routes themselves, and how each instrument reaches a small operator, are set out in how regulation actually reaches you.
What each situation teaches about evidence
The transferable lesson is not the rule. It is what you would have needed to have kept.
Evidence to keep per situation
- Pass-through demandcontract clause and date told
- Platform rejectionnotice text and policy name
- Rejectioncopy of policy on that date
- Questionnairelast time's answers, for consistency
- Thresholdthe metric, tracked, with crossing date
For a BIPA vendor demand: the contract clause it rests on, your written consent and retention policy, and the date you were told. For a platform removal: the notice text, the policy name cited, and a copy of the policy as it stood that day.
For a Local Law 144 questionnaire: the bias audit and the published results, so your answers stay consistent. For a threshold: the metric, tracked, with the date you crossed it.
None of that requires a system. It requires somebody to own the folder.
Two mistakes that recur in all six
The first is treating the loudest demand as the binding one. A vendor with a deadline gets attention that a quiet statutory obligation does not, and the quiet one has the longer tail.
The second is answering the question that was asked rather than the question that matters. A vendor review asks whether you have a policy. The useful internal question is whether the policy describes what actually happens, because the review is not the last time somebody will ask.
Getting the document into a defensible shape is a separate exercise, laid out in the internal policy skeleton, and the pre-launch version of these checks is in the readiness run list.
Using a real example without misusing it
Naming a statute is not a prediction. Illinois BIPA settlements, DSA enforcement and state age-verification injunctions are all live and all moving. The European Commission has opened formal DSA proceedings against platforms including X, TikTok and AliExpress, and nothing here forecasts how any of them ends.
If a situation on this page resembles one you are in, the next step is the primary source and, where anything material is at stake, a qualified adviser in the relevant jurisdiction.
Primary means the official text. What such a system holds is described by its own publisher, as in the National Archives' account of the Federal Register. How a text gets there at all is described in one country's explanation of how laws are made and in the European Commission's account of its own law-making process.
Nothing here states what any rule requires of you. How to read the instrument once you have found it is a separate exercise.
Common questions
A platform demand and a legal requirement conflict. Which wins?
Neither overrides the other, because they are different systems. A service can prohibit what the law permits, and its permission protects you from nothing. Where the two genuinely cannot both be satisfied, that is a question for counsel in your jurisdiction rather than a support ticket.
Can I refuse a customer's vendor review?
Commercially, sometimes. Scope is more negotiable than existence. Ask which of their own obligations each section serves, and the template questions tend to fall away.
How do I catch a threshold before I cross it?
Pick the metric the rule uses, not the metric you report internally. Put a reminder against a number below the threshold rather than at it, and date the crossing when it happens.
