@prestyj/cli 5.28.0 → 5.29.0

package/assets/skills/compliance-guard/references/lawsuit-vectors.md

@@ -1,6 +1,6 @@
 # Lawsuit & Demand-Letter Vectors
 
-How a small app actually gets sued or extorted, ranked by real base rate rather than statutory maximum. Snapshot **11 Aug 2026** — verify any date, amount, or case posture before stating it as current.
+How a small app actually gets sued or extorted, ranked by real base rate rather than statutory maximum. Snapshot **11 Aug 2026**, spot re-verified 3 Oct 2026 (see `provenance.md`) — verify any date, amount, or case posture before stating it as current.
 
 **The core asymmetry:** most regulators do not chase solo developers. Private plaintiffs and demand-letter mills do, because the process is automated: a bot scans public sites for a technical fingerprint, a letter goes out, and settling is cheaper than defending. Optimise against *fingerprints*, not against theoretical liability.
 
@@ -8,7 +8,7 @@ How a small app actually gets sued or extorted, ranked by real base rate rather
 
 ## 1. Web accessibility demand letters — highest base rate
 
-**Who:** serial plaintiff firms filing thousands of federal suits a year, plus a much larger volume of pre-suit letters. Filings have grown year over year **[V]**; small e-commerce is the primary target.
+**Who:** serial plaintiff firms filing thousands of federal suits a year, plus a much larger volume of pre-suit letters. Federal website-accessibility filings were 3,117 in 2025, up 27% on 2024, and over 5,000 counting state courts **[S]**; e-commerce is the primary target, and pro se filings drafted with AI tools are rising **[S]**.
 
 **Fingerprint they scan for:** automated scanners on the homepage and checkout. Missing `alt`, unlabeled form inputs, missing form `<label>`/`aria-label`, low contrast, no visible focus indicator, keyboard traps in modals and menus, inaccessible custom dropdowns, images of text, missing page language, empty links/buttons with icon-only content, and — the defect generated code produces most reliably — **a clickable `<div>` or `<span>` carrying an `onClick` with no `<button>`, no `role`, no `tabIndex`, and no key handler**, which is simply invisible to keyboard and screen-reader users.
 
@@ -35,7 +35,7 @@ How a small app actually gets sued or extorted, ranked by real base rate rather
 
 **Scale:** pen-register-style claims have become a dominant share of active privacy litigation, driven by ordinary analytics and ad tools **[V]**. Statutory damages of **$5,000 per violation** are the leverage **[V]**.
 
-**Relief status:** California SB 690 would strip private rights of action for the pen-register sections only, and as amended in July 2026 it does **not** touch §631 wiretap claims **[V]**. Do not plan around it; re-verify its status before advising.
+**Relief status:** California SB 690 was signed on 30 September 2026 and is operative 1 January 2027: private suits under the pen-register/trap-and-trace section (§638.51) over a website or app are removed (Attorney General only), with retroactive reach to pending claims filed within the prior two years **[U]** (consistent across law-firm reports; the leginfo text was not retrieved). It does **not** touch §631/§632 wiretap claims, which remain the main pixel/session-replay/chat-widget theory **[S]**. The fix is unchanged: consent-gate every third-party request.
 
 **Fingerprint:** any third-party request firing on page load before consent — Meta/TikTok/LinkedIn pixels, GA, session replay, chat widgets, A/B tools. Server-side tagging does **not** cure it if the third party still receives the data.
 
@@ -53,7 +53,7 @@ How a small app actually gets sued or extorted, ranked by real base rate rather
 
 **Trigger:** collecting a face geometry, fingerprint, voiceprint, iris, or similar identifier from a person in Illinois — with **no volume threshold**, so a single user creates exposure. Consent must be a **written release obtained before collection**, and you must publish a retention and destruction schedule **[V]**.
 
-**Damages:** $1,000 negligent / $5,000 intentional **per person**, plus fees. A 2024 amendment limits recovery to a single accrual per person rather than per scan, which materially reduced exposure but not filing volume **[V]**.
+**Damages:** $1,000 negligent / $5,000 intentional **per person**, plus fees. The August 2024 amendment (SB 2979) limits recovery to one per person per collection method rather than per scan, and the Seventh Circuit held on 1 Apr 2026 (*Clay v. Union Pacific*) that it applies to cases already pending **[S]**. Exposure dropped, filing volume did not: a class of thousands is still serious money.
 
 **Fingerprint in code:** face detection or recognition SDKs, `face_embedding`/`descriptor`/`template` columns, voice embeddings, liveness checks, photo auto-tagging, avatar generation from a selfie. Face *detection* without identification is contested **[U]** — do not rely on it as a defence.
 
@@ -73,7 +73,7 @@ How a small app actually gets sued or extorted, ranked by real base rate rather
 
 ## 5. Subscription / auto-renewal class actions
 
-**Trigger:** auto-renewal or free-trial conversion with disclosures that are not clear and conspicuous *adjacent to the enrolment control*, no separate affirmative consent, or a cancellation path harder than the signup path **[V]**. California's amended auto-renewal law broadened what is actionable **[V]**; a federal click-to-cancel rule was vacated in 2025, so **state law and general deception rules are the live risk** — do not tell a user the federal rule saves them **[V]**.
+**Trigger:** auto-renewal or free-trial conversion with disclosures that are not clear and conspicuous *adjacent to the enrolment control*, no separate affirmative consent, or a cancellation path harder than the signup path **[V]**. California's amended auto-renewal law broadened what is actionable **[V]**; the federal click-to-cancel rule was vacated in July 2025 and the FTC only restarted rulemaking with an advance notice in March 2026, so **state law and general deception rules are the live risk** — do not tell a user the federal rule saves them **[S]**.
 
 **Fingerprint:** trial logic with no reminder job; a cancel flow that emails support; terms shown behind a link rather than adjacent to the button; no stored record of what the user was shown.
 

package/assets/skills/compliance-guard/references/provenance.md

@@ -2,7 +2,7 @@
 
 ## Snapshot
 
-These references were compiled on **11 August 2026** from primary and first-tier sources: EUR-Lex and the Official Journal, EDPB, national data protection authorities, ICO, Ofcom, the European Commission, the FTC, CPPA, state legislature and AG sites, US federal court opinions, the Copyright Office, NIST, OWASP, PCI SSC, and platform developer documentation.
+These references were compiled on **11 August 2026** and spot re-verified on **3 October 2026** (see *Re-verification log* below) from primary and first-tier sources: EUR-Lex and the Official Journal, EDPB, national data protection authorities, ICO, Ofcom, the European Commission, the FTC, CPPA, state legislature and AG sites, US federal court opinions, the Copyright Office, NIST, OWASP, PCI SSC, and platform developer documentation.
 
 ## Confidence markers
 
@@ -21,7 +21,7 @@ Re-verify these before relying on them, in rough order of volatility:
 1. **US state AI laws** — effective dates have moved repeatedly, some are enjoined, some were repealed and replaced mid-cycle, and federal preemption efforts are active.
 2. **State privacy law scope** — new states take effect on 1 January and 1 July cycles; thresholds and cure periods change.
 3. **EU AI Act dates** — amended in July 2026; any guidance written before mid-2026 is unreliable on the high-risk timeline.
-4. **EU data/ePrivacy reform** — the data-protection half of the Digital Omnibus was still in negotiation at snapshot time and is **not law**. Do not build to proposed cookie or browser-signal provisions.
+4. **EU data/ePrivacy reform** — the data-protection half of the Digital Omnibus is **not law**; at 3 Oct 2026 it was in first reading with no Council mandate. Do not build to proposed cookie or browser-signal provisions.
 5. **EU–US transfer framework** — valid at snapshot, with an appeal pending.
 6. **Wiretap/pixel litigation** — statutory reform and appellate decisions are actively reshaping which theories survive.
 7. **Age-verification and minors' laws** — rapid state adoption plus constitutional litigation.
@@ -40,3 +40,42 @@ Re-verify these before relying on them, in rough order of volatility:
 When web access is available, verify in this order before making a claim the user will act on: (1) the effective date, (2) whether the law survived litigation, (3) the threshold and whether the user is over it, (4) the penalty and whether a private right of action exists. Prefer the statute, the regulator's own guidance, or the court's opinion over secondary commentary — law-firm blog posts were a recurring source of the errors corrected during this research, including at least one widely-repeated claim about an EU obligation that does not exist.
 
 When web access is unavailable, say so, cite the snapshot date, and mark the affected findings as needing verification.
+
+## Re-verification log — 3 October 2026
+
+**Pass 1** (secondary sources): CA SB 690 signed 30 Sep 2026; Colorado SB 26-189; FCC TCPA revocation order reportedly adopted 30 Sep 2026; FTC negative-option ANPRM March 2026; Data Omnibus first-reading status; AI Omnibus dates; Texas SB 2420.
+
+**Pass 2** (primary sources preferred):
+
+| Item | Result | Source tier | File |
+|---|---|---|---|
+| UK DUAA commencement | Main provisions 5 Feb 2026 (SI 2026/82); s.164A complaints 19 Jun 2026 | **Primary**: legislation.gov.uk SI 2026/82, SI 2026/31 | `eu-uk.md` |
+| CPPA ADMT / risk assessment / audits | Effective 1 Jan 2026; ADMT 1 Jan 2027; RA attestation 1 Apr 2028; audits 2028/29/30 by revenue | **Primary**: cppa.ca.gov rulemaking page + 23 Sep 2025 announcement | `us.md` |
+| TAKE IT DOWN §3 | Enforced from 19 May 2026; 48h removal; FTC complaint portal | **Primary**: ftc.gov press releases (May 2026) | `us.md` |
+| Colorado SB 26-189 | Repeal-and-reenact confirmed; 1 Jan 2027 date from secondary only → **[U]** | Primary (partial): leg.colorado.gov bill page | `us.md` |
+| EU Data Act | Applies 12 Sep 2025; Art 3(1) design duty 12 Sep 2026 (Art 50) | Statute text via secondary mirror + law firms (EUR-Lex not fetched) | `eu-uk.md` |
+| EAA transitional | 28 Jun 2030 cap for pre-2025 service contracts (Art 32); "2027 vs 2030" conflict resolved | Statute text quoted in secondary sources | `eu-uk.md` |
+| COPPA | Effective 23 Jun 2025; compliance 22 Apr 2026 (90 FR 16918) | Secondary (consistent citations to FR) | `us.md` |
+| ADA Title II | DOJ IFR 20 Apr 2026: 26 Apr 2027 / 26 Apr 2028 (FR Doc 2026-07663) | Secondary + SBA Office of Advocacy (federalregister.gov blocked the fetch) | `us.md` |
+| ADA Title III trend | 3,117 federal web suits in 2025 (+27%) | Secondary (Seyfarth tracker) → [S] | `us.md`, `lawsuit-vectors.md` |
+| GPC states / new laws | 12 GPC states unchanged; IN, KY, RI live 1 Jan 2026 without GPC duty | Secondary → GPC list kept [V] from August, 2027 laws [U] | `us.md` |
+| UK OSA | Fines ongoing; categorised register July 2026 | Secondary (Ofcom roadmap page partly) → [S] | `eu-uk.md` |
+| PCI DSS 4.0.1 | Future-dated reqs mandatory 31 Mar 2025; v4.0 retired 31 Dec 2024 | Secondary (pcisecuritystandards.org not fetched) → [S] | `security-baseline.md` |
+| WA MHMDA + health-data laws | Damages: actual, treble to $25,000 (corrected from "$7,500/violation"); NY HIPA not law | Secondary → [S] | `us.md` |
+| BIPA | SB 2979 per-person cap retroactive (7th Cir. *Clay v. Union Pacific*, 1 Apr 2026) | Secondary (multiple firms quoting opinion) | `us.md`, `lawsuit-vectors.md` |
+| App-store laws | Utah → 6 May 2027 (HB 498), PRA 31 Dec 2026; Louisiana → 1 Jul 2027 (HB 977); CA AB 1043 1 Jan 2027 | Secondary → [S]; Alabama [U] | `us.md` |
+| Reg (EU) 2026/1744 | Pass 3: OJ text opened (eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744): OJ 24.7.2026, in force 3rd day; Art 5(1)(ba)/(bb) + Art 50(2) legacy 2 Dec 2026; Annex III 2 Dec 2027; Annex I 2 Aug 2028 → **[V]**. 2 Feb 2027 watermark date not found → [U] | Primary | `eu-uk.md`, `sector-gates.md` |
+| Delete Act / DROP | Pass 3: 1 Aug 2026, 45-day cadence, DROP account duty → **[V]** (cppa.ca.gov/data_brokers/) | Primary | `us.md` |
+| Texas TRAIGA HB 149 | Pass 3: signed 22 Jun 2025, effective 1 Jan 2026 → **[V]** (capitol.texas.gov History HB149, 89R) | Primary | `us.md` |
+| CA SB 243 reporting | Pass 3: leginfo unreachable; 1 Jul 2027 reporting start from secondary → [S] | — | `us.md` |
+| CA SB 690 | leginfo fetch failed → retroactivity detail **[U]** | — | `lawsuit-vectors.md` |
+| FCC TCPA order | fcc.gov page not found; stays **[U]** | — | `us.md` |
+| Texas SB 2420 | No court order opened → **[U]** | — | `us.md` |
+
+Marker rule applied in pass 2: **[V]** only where a primary source was actually opened (legislation.gov.uk, cppa.ca.gov, ftc.gov, leg.colorado.gov); secondary-only facts are **[S]**; earlier-pass items without primary confirmation are **[U]**. Items whose [V] dates from the 11 Aug snapshot keep it.
+
+**Pass 3 (3 Oct 2026) still unverified:** leginfo (SB 243/942/AB 853/AB 2013) timed out; nysenate.gov and legiscan 403; CRA (Reg 2024/2847) EUR-Lex and digital-strategy pages returned empty; DPF appeal (C-703/25 P) not fetched. Those claims keep their prior markers.
+
+**Still unverified after pass 2:** primary text for Reg 2026/1744, SB 690, the FCC order, Colorado's effective date, the Title II IFR, COPPA FR text, PCI SSC documents, and Ofcom's register. Not re-checked at all: genetic-privacy state list, VPPA, NY SAFE for Kids, Delete Act/DROP, CA SB 942/AB 2013/SB 243, Texas TRAIGA, CRA, DSA, NIS2, DPF appeal, consent-or-pay, adult-content AV state count, everything in `sector-gates.md`, `artifacts.md`, `trigger-map.md`, `exposure-triage.md`.
+
+Pass 1 sources: whitecase.com, acompli.ie, fenwick.com, procopio.com, seyfarth.com, troutmanprivacy.com, burr.com, commlawgroup.com, mslawgroup.com, kelleydrye.com, crowell.com, mofo.com, recordinglaw.com. Pass 2 adds: legislation.gov.uk/uksi/2026/82, cppa.ca.gov/regulations/ccpa_updates.html, cppa.ca.gov/announcements/2025/20250923.html, ftc.gov/news-events/news/press-releases/2026/05/ftc-begins-enforcing-take-it-down-act, leg.colorado.gov/bills/sb26-189, reedsmith.com (Title II IFR), advocacy.sba.gov, adatitleiii.com, wsgr.com (Data Act), lw.com and davispolk.com (COPPA), insideprivacy.com (BIPA), loeb.com and recordinglaw.com (Utah/Louisiana), enzuzo.com (MHMDA), 360advanced.com (PCI), reedsmith.com (OSA).

package/assets/skills/compliance-guard/references/sector-gates.md

@@ -2,7 +2,7 @@
 
 Domains where **building the thing is the problem**, not the privacy policy. Evaluate these *before* any other checklist: if the product cannot lawfully exist as described, nothing downstream matters.
 
-Snapshot **11 Aug 2026**. Markers: **[V]** verified · **[S]** re-verify · **[U]** genuinely unresolved.
+Snapshot **11 Aug 2026**, spot re-verified 3 Oct 2026 (see `provenance.md`). Markers: **[V]** verified · **[S]** re-verify · **[U]** genuinely unresolved.
 
 Each entry gives the trigger, the **safe subset** a small dev can ship, and the **red line** that means stop.
 
@@ -107,7 +107,7 @@ The test is **prize + chance + consideration**. Remove one leg or you need a lic
 - **Screening or scoring people** — assembling or evaluating consumer information for eligibility decisions makes you a **consumer reporting agency**: permissible purpose, maximum possible accuracy, dispute handling, and adverse-action notices **[V]**. "It's just an AI background check" does not escape this; it is the classic small-company FCRA class action.
 - **Credit** — adverse-action notices must state **specific principal reasons**. A black-box model that cannot articulate reasons is itself the violation **[V]**.
 - **Housing and insurance** — disparate-impact exposure and rating regulation apply regardless of intent.
-- **EU** — these are Annex III high-risk categories under the AI Act, with obligations from Dec 2027 **[V]**.
+- **EU** — these are Annex III high-risk categories under the AI Act, with obligations from 2 Dec 2027 (Reg 2026/1744) **[V]**.
 
 ---
 
@@ -149,7 +149,7 @@ Product descriptions or code signals → regime → the one-line warning to show
 | "loot box", "gacha" | Consumer-protection and gambling rules | Disclose real-money value and drop rates; cash-out crosses into gambling. |
 | "users upload photos/videos" | DMCA, CSAM reporting, NCII takedown | Register a DMCA agent, build a CSAM reporting path, and ship a 48-hour NCII takedown flow. |
 | "voice clone of [celebrity]", "sounds like [artist]" | Right of publicity, digital-replica laws | Cloning an identifiable voice without consent is actionable in a growing number of states. |
-| "nudify", "undress", sexualised image of a real person | Federal criminal statutes, NCII law, EU AI Act Art 5 | Criminal territory, not a grey area. Refuse. |
+| "nudify", "undress", sexualised image of a real person | Federal criminal statutes, NCII law, EU AI Act Art 5(1)(ba) (from 2 Dec 2026, per Reg 2026/1744) **[V]** | Criminal territory, not a grey area. Refuse. |
 | "we scrape LinkedIn" or any logged-in source | Anti-hacking statutes, contract, GDPR | Authenticated scraping revives criminal-statute exposure, and EU personal data needs a documented lawful basis. |
 | "train on scraped user photos/posts" | GDPR, TDM opt-outs, AI Act | Public availability is not consent; machine-readable opt-outs must be honoured and a training-data summary published for the EU. |
 | "under 13", kids' game, school rollout | COPPA, FERPA, state student-privacy laws | Verifiable parental consent or a signed school agreement is required before any collection, and no ad SDKs. |

package/assets/skills/compliance-guard/references/security-baseline.md

@@ -2,7 +2,7 @@
 
 Security is the fastest route from "small app" to "regulatory incident": a breach triggers notification duties, class actions in states with a breach private right of action, and the deception theory that your privacy policy promised protection you did not provide. This file is the pre-deploy floor, weighted toward the failure modes that AI-generated and rapidly built apps produce most often.
 
-Snapshot **11 Aug 2026**. Verify version numbers and vendor terms before asserting them.
+Snapshot **11 Aug 2026**, spot re-verified 3 Oct 2026 (see `provenance.md`). Verify version numbers and vendor terms before asserting them.
 
 ---
 
@@ -79,7 +79,7 @@ Academic and vendor studies through 2024–2026 consistently find a substantial
 ## Payments
 
 - Use hosted fields/checkout from your processor so PAN never touches your origin. This is what keeps your PCI scope minimal.
-- Payment-page script integrity and script inventory requirements now apply to pages that take card data **[S]** — verify the current PCI DSS requirement numbers and SAQ eligibility with your processor before advising, since eligibility differs between fully hosted redirect and embedded-fields integrations.
+- PCI DSS v4.0.1 is the only active version (v4.0 retired 31 Dec 2024), and all 51 formerly future-dated requirements have been mandatory since **31 March 2025**, with no remaining grace period **[S]**. For web checkouts the ones that bite are 6.4.3 (inventory, authorise and integrity-check every script on the payment page) and 11.6.1 (detect unauthorised changes to payment-page scripts and security headers) **[S]**. Confirm SAQ eligibility with your processor before advising: it differs between a fully hosted redirect and embedded fields/iframes.
 - Verify webhook signatures; make handlers idempotent; never grant entitlements from a client-side success callback.
 - Reconcile: entitlement state must derive from the processor's record, not from your optimistic write.
 - Store only the processor's customer/payment-method reference, never card data.

package/assets/skills/compliance-guard/references/trigger-map.md

@@ -2,7 +2,7 @@
 
 Observable fact → what it triggers → what to actually do. This is the routing index; depth lives in the jurisdiction and vector files.
 
-Status markers: **[V]** verified against a primary source in the 11 Aug 2026 snapshot · **[S]** snapshot claim, re-verify date/threshold before asserting · **[U]** uncertain or contested, present as uncertain.
+Status markers: **[V]** verified against a primary source (11 Aug 2026 snapshot, spot re-verified 3 Oct 2026 — see `provenance.md`) · **[S]** snapshot claim, re-verify date/threshold before asserting · **[U]** uncertain or contested, present as uncertain.
 
 ---
 
@@ -100,15 +100,15 @@ Status markers: **[V]** verified against a primary source in the 11 Aug 2026 sna
 
 | Observed fact | Triggers | Do this |
 |---|---|---|
-| User-facing chatbot | EU AI Act Art 50 disclosure **[V]**; several US state chatbot-disclosure laws **[V]** | Persistent "you are talking to an AI" disclosure, not buried in terms |
-| Companion / emotional / therapy-adjacent chatbot | Companion-AI laws + AI-therapy bans **[V]** | **Gate** — crisis protocol, minor protections, and in some states you cannot offer therapy at all |
+| User-facing chatbot | EU AI Act Art 50 disclosure **[V]**; several US state chatbot-disclosure laws **[V]** | Persistent "you are talking to an AI" disclosure, not buried in terms. See `eu-uk.md` §3 (Art 50) and `us.md` §5 |
+| Companion / emotional / therapy-adjacent chatbot | Companion-AI laws + AI-therapy bans **[V]** | **Gate** — `sector-gates.md` §1 and §5, `us.md` §2 (CA SB 243, PRA) and §5. Crisis protocol, minor protections, and in some states you cannot offer therapy at all |
 | Scoring emotion, confidence, engagement or sincerity from face/voice in **hiring, work, or education** | EU AI Act Art 5(1)(f) **prohibited practice** **[V]** | **ILLEGAL in the EU — remove the feature.** Not curable by disclosure or consent. See `eu-uk.md` Art 5 |
 | Inferring race, ethnicity, gender, religion, union membership or sexual orientation from a photo, face or voice | EU AI Act Art 5(1)(g) **prohibited** **[V]**; discrimination law everywhere | **ILLEGAL in the EU — delete the field and the model.** Also a discrimination claim if it touches any decision |
 | Building a face database by scraping images from the web or CCTV | EU AI Act Art 5(1)(e) **prohibited** **[V]** | **ILLEGAL in the EU.** Also BIPA and scraping exposure |
 | Cross-context "trust score" or "reputation score" affecting unrelated treatment | EU AI Act Art 5(1)(c) social scoring **[V]** | **Gate** — narrow the score to the context it was collected for |
-| Generated images/audio/video | Synthetic-content marking duties **[V]** | Machine-readable provenance (C2PA-style) + visible label where required |
+| Generated images/audio/video | Synthetic-content marking duties **[V]** | Machine-readable provenance (C2PA-style) + visible label where required. EU: Art 50(2)/(4), legacy systems by 2 Dec 2026 — `eu-uk.md` §3. CA SB 942/AB 853 if >1M monthly users — `us.md` §2. Sexual deepfakes of real people: `sector-gates.md` §6 |
 | AI in hiring, lending, housing, insurance, education, essential services | High-risk/ADS regimes **[V]** | Notice, human review, bias testing, records, adverse-action reasons. LAWYER item |
-| Training or fine-tuning on user data | Lawful basis, notice, opt-in expectations, training-data disclosure laws **[S]** | Default to opt-out-by-default = off; document data sources; check vendor terms |
+| Training or fine-tuning on user data | Lawful basis, notice, opt-in expectations, training-data disclosure laws **[S]** | Default to opt-out-by-default = off; document data sources; check vendor terms. CA AB 2013 (no size threshold) — `us.md` §2 |
 | Agent with tool access / code execution | Prompt injection, exfiltration, cost abuse | See `security-baseline.md` §9 — this is a security blocker, not a policy item |
 | Sending user PII to an LLM vendor | Processor relationship, transfers, retention | Sign the DPA, use zero/limited-retention endpoints, redact before send, disclose the vendor |
 | Marketing claims like "AI-powered", "99% accurate", "fully automated" | Deceptive-claims enforcement **[V]** | Keep a dated substantiation file mapping each claim to evidence |

package/assets/skills/compliance-guard/references/us.md

@@ -1,6 +1,6 @@
 # United States
 
-Snapshot **11 Aug 2026**. Markers: **[V]** verified against a primary/first-tier source · **[S]** snapshot, re-verify · **[U]** contested or fast-moving.
+Snapshot **11 Aug 2026**, spot re-verified 3 Oct 2026 (see `provenance.md`). Markers: **[V]** verified against a primary/first-tier source · **[S]** snapshot, re-verify · **[U]** contested or fast-moving.
 
 **PRA** = private right of action. This is the field that matters most for a small company: regulator-only laws are a compliance project, PRA laws are a lawsuit.
 
@@ -23,11 +23,11 @@ Also note **Texas and Nebraska have no revenue or volume threshold** — they ap
 
 ## 1. State comprehensive privacy laws
 
-**In force in 2026: 20 states** (CA, VA, CO, CT, UT, TX, OR, MT, IA, DE, NE, NH, NJ, TN, MN, MD, IN, KY, RI, and Florida's narrower law which applies only above $1B revenue) **[V]**. Enforcement is AG-only; penalties commonly $7,500–$10,000 per violation **[V]**. Cure periods are expiring across states **[S]**.
+**In force in 2026: 20 states** (CA, VA, CO, CT, UT, TX, OR, MT, IA, DE, NE, NH, NJ, TN, MN, MD, and — from 1 Jan 2026 — IN, KY, RI; plus Florida's narrower law which applies only above $1B revenue) **[S]**. Enforcement is AG-only; penalties commonly $7,500–$10,000 per violation **[S]**. Cure periods are expiring across states during 2026 **[S]**. Further states have enacted laws taking effect from 2027 **[U]** on the exact list — re-check before advising.
 
 Thresholds range from 25,000 consumers (Montana) to 175,000 (Tennessee); 10,000 consumers where a share of revenue comes from selling data (RI, DE, NH, MD); Maryland pairs a 35,000-consumer threshold with the strictest data-minimisation and sensitive-data rules, and bans the sale of sensitive data outright **[V]**.
 
-**Universal opt-out / Global Privacy Control — the cheapest high-value engineering task.** As of 1 Jan 2026, twelve states require honouring it (CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX); Virginia-template states do not **[V]**.
+**Universal opt-out / Global Privacy Control — the cheapest high-value engineering task.** As of 1 Jan 2026, twelve states require honouring it (CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX); Virginia-template states, including the 2026 newcomers Indiana, Kentucky and Rhode Island, do not **[V]**. California's regulations effective 1 Jan 2026 also require the business to display whether the signal was honoured (11 CCR §7025(c)(6)) **[S]**. California, Colorado and Connecticut have run a coordinated GPC enforcement sweep **[S]**.
 
 ```
 Read the Sec-GPC: 1 request header and navigator.globalPrivacyControl.
@@ -55,12 +55,12 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 **Applicability:** for-profit doing business in CA meeting any one of — annual gross revenue over ~$26.6M (CPI-adjusted), buying/selling/sharing PI of 100,000+ CA consumers or households a year, or 50%+ of revenue from selling/sharing PI **[V]**. Penalties per violation with a higher tier for intentional violations or those involving minors. **Consumers may sue only over certain breaches** ($107–$799 per consumer per incident) — there is no general PRA for policy or opt-out-link failures **[V]**.
 
-**2026 regulations package (effective 1 Jan 2026)** **[V]**:
-- *Risk assessments* — begin 1 Jan 2026, complete for ongoing activities by 31 Dec 2027, first certified reports 1 Apr 2028. Triggered by sensitive PI, targeted ads to minors, ADMT for significant decisions, or training ADMT.
-- *ADMT* — pre-use notice, access, and opt-out for automated decision-making about significant decisions (including employees, contractors, applicants). **Compliance deadline 1 Jan 2027.**
-- *Cyber audits* — only above revenue plus scale thresholds; first certifications from 2028. A pre-revenue startup is out of scope.
+**2026 regulations package (effective 1 Jan 2026; approved by OAL 22 Sep 2025, per cppa.ca.gov)** **[V]**:
+- *Risk assessments* — required before starting covered processing from 1 Jan 2026; complete for pre-2026 ongoing activities by 31 Dec 2027; attestation plus summary to the CPPA by 1 Apr 2028. Triggered by sensitive PI, targeted ads to minors, ADMT for significant decisions, or training ADMT.
+- *ADMT* — pre-use notice, access, and opt-out (or a qualifying exception) for automated decision-making about significant decisions (including employees, contractors, applicants). **Compliance deadline 1 Jan 2027**; ADMT deployed after that date must comply before first use. Targeted advertising alone is not a significant decision.
+- *Cyber audits* — only above revenue plus scale thresholds; first certifications due 1 Apr 2028 (>$100M revenue), 1 Apr 2029 ($50–100M), 1 Apr 2030 (<$50M) **[V]**. A pre-revenue startup is out of scope.
 
-**Delete Act / DROP** — if you sell PI of consumers you have no direct relationship with, you are a data broker. **No revenue threshold.** Registration plus, **from 1 Aug 2026**, processing consumer deletion requests through the state mechanism every 45 days with downstream deletion directives; per-day penalties apply whether or not you registered **[V]**. Enforcement has already hit companies of exactly this size. Ask at design review: *do we sell PI of people who never used us?*
+**Delete Act / DROP** — if you sell PI of consumers you have no direct relationship with, you are a data broker. **No revenue threshold.** Registration plus, **from 1 Aug 2026**, processing consumer deletion requests through the state mechanism every 45 days with downstream deletion directives; per-day penalties apply whether or not you registered **[V]** (1 Aug 2026 / 45-day cadence re-confirmed on cppa.ca.gov/data_brokers, 3 Oct 2026). All brokers operating in 2025 or 2026 must have a DROP account **[V]**. Enforcement has already hit companies of exactly this size. Ask at design review: *do we sell PI of people who never used us?*
 
 **Breach notice (SB 446)** — since 1 Jan 2026, notify affected California residents within **30 calendar days** of discovery, and report to the AG within **15 calendar days** of notifying individuals **[V]**.
 
@@ -68,7 +68,7 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 **AB 2013 training-data transparency** — **no size threshold**. Developers of generative AI systems made available to Californians must publish training-data documentation; compliance required from 1 Jan 2026 and on substantial modification **[V]**. Catches small fine-tuners, not mere API consumers.
 
-**SB 243 companion chatbots — the highest-risk new law for small AI apps.** Effective 1 Jan 2026. Applies to chatbots sustaining a relationship or human-like emotional engagement (excludes customer-service bots, limited game NPCs, voice assistants). Requires non-human disclosure, mental-health crisis protocols, and minor protections including blocking sexual content and enforcing breaks. **PRA: YES** — minimum $1,000 damages plus fees, and UCL pairing can reach individuals personally **[V]**.
+**SB 243 companion chatbots — the highest-risk new law for small AI apps.** Effective 1 Jan 2026. Applies to chatbots sustaining a relationship or human-like emotional engagement (excludes customer-service bots, limited game NPCs, voice assistants). Requires non-human disclosure, mental-health crisis protocols, and minor protections including blocking sexual content and enforcing breaks; annual reporting to the state Office of Suicide Prevention is reported to start 1 Jul 2027 **[S]** (bill text not reachable 3 Oct 2026). **PRA: YES** — minimum $1,000 damages plus fees, and UCL pairing can reach individuals personally **[V]**.
 
 **Employment ADS regulations** under state anti-discrimination law add notice and recordkeeping duties for automated decision systems **[S]**.
 
@@ -76,7 +76,7 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 ## 3. Children and teens
 
-**COPPA amended Rule — full compliance date 22 Apr 2026** **[V]**. Trigger: a child-directed service, or actual knowledge of collecting personal information from under-13s. Mixed-audience services may age-screen. Concrete changes:
+**COPPA amended Rule (16 CFR Part 312, 90 FR 16918) — effective 23 June 2025, full compliance date 22 Apr 2026, now passed and enforceable** **[S]** (secondary sources citing the Federal Register; FR text not opened). The FTC issued a February 2026 policy statement limiting enforcement where children's data is collected solely for age verification, but only for operators compliant in every other respect **[S]**. Trigger: a child-directed service, or actual knowledge of collecting personal information from under-13s. Mixed-audience services may age-screen. Concrete changes:
 
 - **Separate** verifiable parental consent for disclosing children's data to third parties (including for targeted advertising).
 - New **data-retention limits** and a **published written retention policy** — indefinite retention is prohibited.
@@ -84,13 +84,19 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 - A written children's information security programme with vendor due diligence.
 - Parent review/deletion flows must cover biometric data.
 
-**App Store Accountability Acts (TX, UT, LA, AL, CA)** — these impose duties on **app developers**, not just the stores **[V]**. Texas SB 2420 is in effect after appellate and Supreme Court refusals to freeze it (which is not a ruling on constitutionality) **[V]**; Utah developer requirements from 6 May 2026; Louisiana 1 July 2026; California 1 Jan 2027 **[V]**. Build: consume the store's age-signal API, branch features on age category, store only a category flag, re-request consent on significant app changes. Some states allow private suits.
+**App Store Accountability Acts (TX, UT, LA, AL) and California's Digital Age Assurance Act** — these impose duties on **app developers**, not just the stores **[V]**. Status as of 3 Oct 2026:
+- **Texas SB 2420** — in effect since the Fifth Circuit's 4 June 2026 stay pending appeal; the Supreme Court declined to block it; the merits appeal continues **[U]** (secondary sources only; court orders not opened).
+- **Utah** — HB 498 (2026) pushed the main store/developer duties to **6 May 2027**, removed AG enforcement, and left a private right of action effective **31 Dec 2026** **[S]**.
+- **Louisiana** — HB 977 (signed 15 May 2026) pushed the effective date to **1 July 2027** **[S]**.
+- **California AB 1043** — effective **1 Jan 2027**: OS-level self-declared age brackets; developers must request the age signal and are then treated as having actual knowledge of the user's age range; no per-download parental consent; AG enforcement up to $2,500 negligent / $7,500 wilful per violation **[S]**.
+- **Alabama** — enacted; effective date not re-verified **[U]**.
+Build: consume the store/OS age-signal API, branch features on age category, store only a category flag, re-request consent on significant app changes.
 
 **NY SAFE for Kids** — final rules July 2026, effective **25 Jan 2027**, targeting platforms with addictive feeds **[V]**.
 
 **Adult content age verification** — 26 states with live laws following the 2025 Supreme Court decision upholding Texas's law **[V]**. Typical trigger is ≥1/3 sexual material harmful to minors, a few with no threshold. Use a third-party verifier returning a boolean; retain nothing reconstructable; geo-route per state. Several states allow private suits.
 
-**TAKE IT DOWN Act §3 (NCII) — enforced from 19 May 2026, and it reaches tiny platforms** **[V]**. Any site, app or service that hosts user content must publish a plain-language notice-and-removal process usable by **users and non-users**, and remove reported non-consensual intimate imagery — including AI-generated — plus known identical copies **within 48 hours**. Non-compliance is trivially detectable: a regulator just checks whether the notice exists. Build `/report/ncii`, an acknowledgement + 48h SLA timer, hash-based re-upload suppression, and a footer link.
+**TAKE IT DOWN Act §3 (NCII) — enforced by the FTC from 19 May 2026, and it reaches tiny platforms** **[V]** (ftc.gov press release, May 2026). The FTC runs a complaint portal (TakeItDown.ftc.gov) and has sent warning letters **[V]**; violations are treated as violations of an FTC rule, so civil penalties per violation apply **[S]** on the exact inflation-adjusted amount. Any site, app or service that hosts user content must publish a plain-language notice-and-removal process usable by **users and non-users**, and remove reported non-consensual intimate imagery — including AI-generated — plus known identical copies **within 48 hours**. Non-compliance is trivially detectable: a regulator just checks whether the notice exists. Build `/report/ncii`, an acknowledgement + 48h SLA timer, hash-based re-upload suppression, and a footer link.
 
 **CSAM reporting** — providers must report apparent child sexual abuse material to the national tipline as soon as reasonably possible after obtaining actual knowledge, with a **one-year preservation** duty; there is no general proactive monitoring mandate **[V]**. Register a point of contact, define an escalation path, and never re-transmit the material except to the tipline or law enforcement.
 
@@ -100,7 +106,7 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 **HIPAA usually does *not* cover a direct-to-consumer wellness app** — it reaches covered entities and their business associates. You become a business associate the moment you handle PHI *on behalf of* a covered entity, which requires a BAA, Security Rule compliance, and 60-day breach notice **[V]**. If you are not HIPAA, you are in the consumer-health-data regime below.
 
-**Washington My Health My Data Act — the top small-company landmine.** **No revenue or volume threshold**, in effect since 2024 **[V]**. "Consumer health data" is defined broadly enough to include precise location that could indicate seeking health services. Requires a **standalone** consumer-health-data privacy policy at its own link, **separate consent for collection**, **separate consent for sharing**, and a **distinct signed authorisation to sell**, plus a geofencing prohibition and processor contracts. **PRA: YES**, via the state consumer-protection act, up to $7,500 per violation **[V]**. The first class action targeted an ordinary ad SDK collecting location. Any period tracker, fitness, mental-health, or symptom app — or anything collecting precise location — is squarely in scope. Nevada has a similar regime without a PRA **[V]**.
+**Washington My Health My Data Act (RCW 19.373) — the top small-company landmine.** **No revenue or volume threshold**, in effect since 31 Mar 2024 (small businesses from 30 June 2024) **[V]**. "Consumer health data" is defined broadly enough to include precise location that could indicate seeking health services. Requires a **standalone** consumer-health-data privacy policy at its own link, **separate consent for collection**, **separate consent for sharing**, and a **distinct signed authorisation to sell**, plus a geofencing prohibition and processor contracts. **PRA: YES**, via the state Consumer Protection Act: actual damages, trebling up to $25,000, and fees; the AG can separately seek civil penalties **[S]**. The lawsuits on record (from Feb 2025) target ad SDKs and website/app tracking, not hospitals **[S]**. Any period tracker, fitness, mental-health, or symptom app — or anything collecting precise location — is squarely in scope. Nevada (SB 370) and Connecticut have similar consent and geofencing rules without a PRA; New York bans geofencing health facilities; New York's broader Health Information Privacy Act had not become law at 3 Oct 2026 **[S]**.
 
 **Illinois BIPA** — see `lawsuit-vectors.md` §3. Required **before first capture**: written notice of collection and specific purpose, notice of the retention schedule and destruction guidelines, a **written release**, a publicly available retention/destruction policy, no profiting from biometrics, and reasonable-care storage **[V]**. Texas and Washington have AG-enforced analogues.
 
@@ -114,8 +120,8 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 ## 5. AI laws
 
-- **Colorado** — the original AI Act was delayed and then repealed/replaced with a narrower automated-decision framework; assume a scaled-back regime effective **1 Jan 2027** and verify the enrolled text before building **[U]**.
-- **Texas TRAIGA** — effective 1 Jan 2026, reaching out-of-state developers whose AI is accessible to Texas users. Intent-based liability for AI that promotes self-harm, facilitates crime, discriminates, or produces prohibited deepfakes. AG-only with a 60-day cure; **safe harbour for documented NIST AI RMF-aligned compliance** **[V]**. Practical step for a small dev: a one-page RMF-aligned policy plus retained prompt/eval logs.
+- **Colorado** — SB 24-205 never took effect: SB 26-189 (signed 14 May 2026) repealed and replaced it with a narrower automated-decision-making (ADMT) disclosure law effective **1 Jan 2027** — point-of-interaction notice, post-adverse-decision explanation, correction and human-review rights for consequential decisions. Repeal-and-reenact confirmed on leg.colorado.gov **[V]**; the 1 Jan 2027 date and obligation detail come from law-firm summaries **[U]** until the enrolled text is read. AG implementing rules are still to come; re-check them before building **[S]**.
+- **Texas TRAIGA (HB 149)** — signed 22 Jun 2025, effective 1 Jan 2026 (capitol.texas.gov bill history, 3 Oct 2026), reaching out-of-state developers whose AI is accessible to Texas users. Intent-based liability for AI that promotes self-harm, facilitates crime, discriminates, or produces prohibited deepfakes. AG-only with a 60-day cure; **safe harbour for documented NIST AI RMF-aligned compliance** **[V]**. Practical step for a small dev: a one-page RMF-aligned policy plus retained prompt/eval logs.
 - **Illinois HB 3773** — from 1 Jan 2026, using AI with a discriminatory *effect* in employment violates the state human-rights act; intent is no defence **[V]**.
 - **NYC Local Law 144** — annual independent bias audit plus published summary and candidate notice for automated employment decision tools used for NYC roles **[V]**.
 - **Mental-health AI** — Illinois bans AI delivering mental-health treatment or clinical decisions outright; Nevada, Utah and Tennessee restrict or require disclosure; treat "AI therapist" as a **hard gate** **[V]**.
@@ -129,11 +135,11 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 - **FTC Act §5** — any statement in your privacy policy, marketing page, app-store listing or in-app copy that is not literally true of your code is deception. Dark patterns in consent and cancellation flows are deception/unfairness; failure to maintain reasonable security is unfairness **[V]**. No federal PRA, but most state UDAP analogues have one.
 - **Consumer Reviews and Testimonials Rule** — prohibits fake, incentivised-by-sentiment, and undisclosed insider reviews, with civil penalties in the tens of thousands per violation; enforcement is active **[V]**.
-- **Negative option / click-to-cancel** — the federal rule was vacated in 2025 and a new rulemaking is under way **[V]**. Do not tell a user they are safe: ROSCA and ~25 state auto-renewal laws still govern, and California's amended law broadened liability **[V]**.
-- **TCPA** — see `lawsuit-vectors.md` §4. Consent records, revocation handling on any channel, quiet hours in the recipient's timezone, DNC scrubbing, carrier campaign registration **[V]**. Exact effective dates of the universal-revocation mandate are reported inconsistently **[U]**.
+- **Negative option / click-to-cancel** — the 2024 rule was vacated by the Eighth Circuit on 8 July 2025; the FTC published a new advance notice of proposed rulemaking in March 2026, so no new federal rule is in force **[S]**. The FTC keeps pleading the same three duties (disclose terms, express informed consent, easy cancel) under §5 and ROSCA. Do not tell a user they are safe: ROSCA and roughly 30 state auto-renewal laws still govern, and California's amended law broadened liability **[V]**.
+- **TCPA** — see `lawsuit-vectors.md` §4. Consent records, revocation handling on any channel, quiet hours in the recipient's timezone, DNC scrubbing, carrier campaign registration **[V]**. Revocation: opt-outs must be honoured within 10 business days **[S]**. The 2024 "revoke-all" rule was deferred to 31 Jan 2027; on 30 Sept 2026 the FCC reportedly adopted a revised order (informational opt-outs may be limited to that message category; marketing opt-outs still stop all marketing; senders may designate exclusive opt-out methods if disclosed clearly), effective 30 days after Federal Register publication **[U]** until the published text is checked. Build to the strict reading: any STOP-type reply stops all marketing on every channel.
 - **CAN-SPAM** — accurate headers and subject, advertising identification, **valid physical postal address**, working opt-out honoured within **10 business days** and functional for 30 days after send; you are liable for your sending platform and affiliates **[V]**.
 - **State breach notification** — all states; deadlines and AG-notice thresholds vary; several sector rules add shorter clocks **[V]**.
-- **ADA accessibility** — Title II has fixed rule deadlines for public entities; Title III private-business exposure is driven by private litigation rather than a technical rule **[V]**. WCAG 2.1 AA is the practical benchmark.
+- **ADA accessibility** — **Title II** (state and local government, including their contractors' web and app content): a DOJ interim final rule of 20 Apr 2026 moved the WCAG 2.1 AA compliance dates to **26 Apr 2027** (population ≥50,000) and **26 Apr 2028** (smaller entities and special districts); the technical standard is unchanged and DOJ signalled further review **[S]** (law-firm and SBA Office of Advocacy reports; the Federal Register text was not retrieved). **Title III** (private businesses) has no technical rule and no deadline — exposure is private litigation, which rose in 2025: 3,117 federal website suits, up 27% on 2024, over 5,000 counting state courts, with e-commerce the main target **[S]**. WCAG 2.1 AA is the practical benchmark; build to 2.2 AA.
 - **GLBA Safeguards Rule** — "financial institution" is far broader than banks and catches many fintech, lending, tax-prep and advisory products: written InfoSec programme, a named qualified individual, MFA, encryption, vendor oversight, and 30-day regulator notice for larger incidents **[V]**.
 - **FCRA** — if you assemble or use consumer reports for employment, tenant, credit or insurance decisions: permissible purpose, **standalone** disclosure plus authorisation, pre-adverse-action packet with a waiting period, adverse-action notice. **PRA: YES**, with heavy class-action volume over standalone-disclosure defects **[V]**.
 - **ECOA/Reg B and FHA** — adverse-action notices with **specific principal reasons** within 30 days. A black-box model that cannot articulate reasons is itself the violation **[V]**. **PRA: YES.**
@@ -145,8 +151,8 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 1. California CIPA (trackers, pixels, chat widgets, session replay) — $5,000 per violation, no threshold **[V]**
 2. ADA Title III accessibility (plus state statutory damages) **[V]**
 3. TCPA/SMS — $500–$1,500 per message, uncapped **[V]**
-4. Illinois BIPA — per-person statutory damages, a single in-state user suffices **[V]**
-5. Washington MHMDA — up to $7,500 per violation, extremely broad health-data definition **[V]**
+4. Illinois BIPA — per-person statutory damages ($1,000 / $5,000), a single in-state user suffices; the 2024 per-person cap applies retroactively to pending cases (Seventh Circuit, *Clay v. Union Pacific*, 1 Apr 2026) **[S]**
+5. Washington MHMDA — actual damages trebled up to $25,000 plus fees, extremely broad health-data definition **[S]**
 6. Auto-renewal claims via state consumer statutes **[V]**
 7. CCPA breach claims — $107–$799 per consumer, filed reflexively after AG breach reports **[V]**
 8. California SB 243 companion chatbots — new, untested, minimum $1,000 plus fees **[V]**
@@ -161,4 +167,4 @@ Honouring GPC for **every** visitor is the safe default: it satisfies the strict
 
 ## 8. Verify before relying
 
-Colorado's replacement AI law text and date · Vermont and Nebraska children's-code dates · the TCPA universal-revocation effective date · VPPA scope · state mini-TCPA and mini-wiretap lists · genetic-privacy specifics per state · SaaS sales-tax nexus.
+Colorado AG rules under SB 26-189 · Vermont and Nebraska children's-code dates · the FCC's revised TCPA revocation order (text and effective date) · Utah, Louisiana and Alabama app-store law dates and litigation · DOJ's further Title II review · state privacy laws taking effect in 2027 · VPPA scope · state mini-TCPA and mini-wiretap lists · genetic-privacy specifics per state · SaaS sales-tax nexus.