The Top 12
12 things app owners believe that the law does not
Ranked by how much of the world disagrees. Every number below is counted from the LexLint corpus when this page is built, and every one of them links to the instruments it came from.
-
1216 of 216
“Data behind a login is no different from a public page.”
Every jurisdiction we hold a determination for treats an authenticated page differently from an open one. Not one of them reads a login as decoration.
Seen in practice Meta Platforms v. Bright Data (N.D. Cal. 2024). The court held Meta's terms reach a user who is logged in, so scraping the same pages logged out breached no contract. Meta dropped the case. The login was the hinge the whole dispute turned on, and it turns both ways. Source -
2214 of 216
“Training a model on data we scraped is fine.”
Commercial text and data mining is affirmatively permitted in two of them. Everywhere else it is prohibited, unsettled, or conditioned on an opt-out you have to actually honour.
Prohibited in 73, unsettled in 108, allowed with an opt-out in 30.
Seen in practice Thomson Reuters v. Ross Intelligence (D. Del., 11 February 2025), the first US federal ruling to reject a fair-use defence for AI training data. The court found the copying commercial and not transformative. Ross has appealed to the Third Circuit, which heard argument in June 2026. Source -
3192 of 216
“Worst case, we get a cease-and-desist.”
Getting past a technical measure is criminal in most of the world, not a civil matter to be settled by letter. The letter is the good outcome.
Criminal in 170, criminal and civil together in 22.
Seen in practice No single case stands in for this one, because the exposure is written into the statutes themselves. Under 17 U.S.C. 1204 a first wilful circumvention offence for commercial advantage carries up to five years and a $500,000 fine. -
4188 of 216
“It was published openly, so we are exempt.”
A carve-out for publicly available data is the exception rather than the rule. Where it exists it is usually narrower than the word 'public' suggests.
Seen in practice Clearview AI built its database entirely from photographs people had published themselves, and was fined anyway: 30.5 million euro by the Dutch DPA in September 2024, 20 million each in Italy and France, and 7.5 million pounds by the UK ICO. Source -
5175 of 216
“robots.txt is the opt-out.”
Most jurisdictions recognise no statutory opt-out mechanism at all, so there is nothing for robots.txt to be the opt-out for. Honouring it is good manners and it discharges no duty.
robots.txt is recognised as the mechanism in 32 and TDMRep in 1. Separately, it is a non-binding notice in 176 and carries evidentiary or statutory weight in 40.
Seen in practice Kneschke v. LAION, Higher Regional Court of Hamburg, 10 December 2025. On the machine-readable reservation of rights the court accepted a reservation written in ordinary language in the website's terms. A crawler reading only robots.txt would not have seen it. Source -
6170 of 216
“We never clicked anything, so their terms do not bind us.”
Browsewrap enforceability turns on how the notice was presented, which is a decision the site made and can evidence. It is a question about their design, not about your clicking.
Enforceable outright in 5, unsettled in 41.
Seen in practice Chabolla v. ClassPass (9th Cir., 27 February 2025) held the terms unenforceable: no screen gave reasonably conspicuous notice, and nothing asked the user to do anything that unambiguously signalled assent. Both halves are things the operator controls. Source -
7170 of 216
“There is no AI law here yet.”
Narrowly true and widely misread. An absent AI statute does not suspend the privacy, copyright, contract and computer-misuse law that already governs what you are doing.
A binding AI-training law is in force in 31, pending in 12.
Seen in practice Italy's Garante fined OpenAI 15 million euro on 20 December 2024 over ChatGPT: no lawful basis for the training data, transparency failures, and weak age checks. Every finding rests on the GDPR. No AI statute was needed, or used. Source -
8156 of 216
“Personal data stops being personal once it is public.”
A name in a public directory is still a name. Most data protection regimes cover personal data wherever it was found, and being easy to collect is not a lawful basis for keeping it.
Seen in practice The UK ICO's 7.5 million pound Clearview penalty survived appeal in October 2023. The images were public, the scraping was lawful to perform, and the processing was still a breach. Source -
9153 of 216
“Faces and voices are not really biometrics.”
Face and voice sit inside the sensitive category in most regimes, which is the tier with the extra consent, assessment and retention duties attached.
Biometric processing triggers 394 in-force instruments across 85 countries, voice 339 across 83.
Seen in practice Facebook paid 650 million dollars in 2021 to settle an Illinois class action over face recognition in photo tagging. The subject was ordinary uploaded photographs, not fingerprints at a turnstile. SourceJurisdictions /l/eu-2016-679-9 /l/us-il-740-ilcs-14-1-14-5-14-10-14-15-14-25
-
10151 of 216
“A page anyone can open is carved out.”
In most jurisdictions the question of whether an openly reachable page is carved out has no settled answer, and a handful answer it no outright. Unsettled is not the same as permitted.
Answered yes in 65, no in 16, unsettled in the rest.
Seen in practice hiQ Labs won on the Computer Fraud and Abuse Act at the Ninth Circuit, on exactly the reasoning that the pages were open to anyone, and still ended with a 500,000 dollar judgment and a permanent injunction in December 2022. Winning the access question settled less than it looked like. Source -
11137 of 216
“There is no IP right in it, so there is no claim.”
Most jurisdictions let a contract create a claim exactly where intellectual property law declines to. The absence of a property right is the beginning of the analysis, not the end.
Seen in practice LinkedIn never established an intellectual property right in the profiles hiQ collected. It won on its user agreement instead, and that was enough for a 500,000 dollar judgment and an injunction ending the business. Source -
12127 of 216
“Facts are not copyrightable, so the dataset is ours.”
A dataset can be protected as a database even where each fact in it is free, either by a dedicated right or through the originality of the selection and arrangement.
A full sui generis database right in 41, compilation originality in 84.
Just below the line
The next 2 by the same ranking. The cut at 12 is a cut, not a cliff, and these are what the page would have said next.
-
13111 of 197
“Only the regulator can come after us.”
In-force instruments across most of the countries we cover give the individual a right to sue directly. A regulator can be persuaded to deprioritise a case. A claimant cannot.
Seen in practice Illinois sets statutory damages at 1,000 dollars for each negligent violation and 5,000 for each reckless one, with no regulator involved at any point. Settlements under that one statute had passed 2 billion dollars by 2023. SourceJurisdictions /l/us-il-740-ilcs-14-20-as-amended-by-p-103-0769-sb /l/gb-uk-gdpr-82-83-data-protection-2018-169
-
1492 of 197
“We will deal with a breach when one happens.”
The duty is a clock, and it starts before you have finished working out what happened. The plan is the thing that has to exist beforehand, not the investigation.
Seen in practice Late notification sits in the GDPR's lower penalty tier, which still reaches 10 million euro or 2 percent of worldwide turnover. Italy's OpenAI decision included exactly this: a March 2023 breach the regulator was never told about. SourceJurisdictions /l/eu-2016-679-33-34 /l/us-ca-cal-civ-1798-82-as-amended-by-sb-446-2025
LexLint reports on every one of these
Jurisdiction by jurisdiction, from what you declare your app does in a
committed lexlint.yml, with the citation and the freshness
date beside each finding.
claude plugin marketplace add ungovr/lexlint
See a full run →
How this is counted
Two populations, and the page never mixes them. A jurisdiction measure is counted over the 216 jurisdictions for which we hold a posture determination on crawling, mining and terms. An instrument measure is counted over the 197 countries holding a law in force in the topics LexLint publishes. Each item prints its own population for that reason, because “127 of 216” and “216 of 216” are not the same kind of claim.
16 candidate beliefs are measured on every build and the top 12 are shown. Nothing here is a claim about what LexLint users most often get wrong: it is a claim about how widely the law disagrees with a belief, which is a different thing and the one we can count. Enforcement examples are researched rather than counted, and an item with nothing on point says so instead of reaching for something approximate.
Is the legal risk real? is the companion to this page, and the corpus is where every number above can be checked.