Coverage and limits¶
The skill follows the law as of 20 October 2026. "Covered" means a reference file states the rules for that topic in that jurisdiction. "Flag" means the skill raises the topic as an open point or covers only a narrow part of it. "Not covered" means you get an open point telling you to check that law separately.
Topic by jurisdiction¶
| Topic | EU law | Germany | US federal | California | New York | Other US states |
|---|---|---|---|---|---|---|
| Formation and assent | covered | covered | covered | covered | not covered | not covered |
| Standard terms control | covered | covered | flag | covered | not covered | not covered |
| Withdrawal and cancellation | covered | covered | not covered | flag | flag | not covered |
| Auto-renewal | covered | covered | covered | covered | covered | flag |
| Warranties and conformity | covered | covered | covered | not covered | not covered | not covered |
| Liability | covered | covered | flag | covered | not covered | not covered |
| Licensing and EULA | covered | covered | covered | not covered | not covered | not covered |
| Privacy notice | covered | covered | flag | covered | not covered | covered |
| Cookies and tracking | covered | covered | flag | covered | not covered | flag |
| Children | covered | flag | covered | not covered | not covered | not covered |
| Platform and user content | covered | not covered | covered | not covered | not covered | not covered |
| Dispute resolution | covered | covered | covered | covered | not covered | not covered |
| Choice of law | covered | covered | flag | not covered | not covered | not covered |
Notes on the table:
- Germany applies the EU regulations (GDPR, Digital Services Act, Data Act, Rome I, Brussels Ia) directly, so a "not covered" cell for Germany means there is no extra German statute in the skill on top of the EU rule.
- California and New York in full means the state statutes listed below. For any other topic, the skill uses the US federal rules and flags the state law for separate review.
- Other US states: Virginia, Colorado, Connecticut and Texas privacy laws have their own reference files. The remaining state privacy laws in force, and those that take effect later, are a matrix of thresholds and duties to check. Auto-renewal statutes of states other than California and New York are not included.
Instruments¶
EU. Consumer Rights Directive 2011/83/EU with the withdrawal function of Directive (EU) 2023/2673 and the duties added by Directive (EU) 2024/825; Unfair Contract Terms Directive 93/13/EEC; Unfair Commercial Practices Directive 2005/29/EC; Digital Content Directive (EU) 2019/770; Sale of Goods Directive (EU) 2019/771; right to repair Directive (EU) 2024/1799; e-Commerce Directive 2000/31/EC; GDPR (EU) 2016/679 with the standard contractual clauses of Decisions (EU) 2021/914 and 2021/915 and EDPB guidelines; ePrivacy Directive 2002/58/EC on cookies; Digital Services Act (EU) 2022/2065; P2B Regulation (EU) 2019/1150; Data Act (EU) 2023/2854; AI Act (EU) 2024/1689 transparency duties; Software Directive 2009/24/EC; Geo-blocking Regulation (EU) 2018/302; Product Liability Directive (EU) 2024/2853; Rome I and Brussels Ia; and the judgments of the Court of Justice the reference files cite.
Germany. BGB §§ 305 to 310 (standard terms), §§ 312 to 312m (consumer contracts and distance selling, including the order button and the cancellation button), §§ 327 to 327u (digital products), §§ 355 to 361 (right of withdrawal, including the electronic withdrawal function of § 356a), §§ 433 to 445c and 474 to 479g (sale of goods); EGBGB Art. 246, 246a, 246c with the model withdrawal information and form; DDG § 5 (Impressum); TDDDG § 25 (cookie consent); UrhG §§ 69a to 69g (software); VSBG §§ 36, 37 (consumer dispute resolution notice); BDSG exceptions to data subject rights.
US federal. FTC Act section 5 and the FTC guidance on dark patterns and online disclosures; ROSCA and the status of the Negative Option Rule; ESIGN and the online assent cases; Federal Arbitration Act and the arbitration cases; Magnuson-Moss Warranty Act with 16 C.F.R. Parts 700 to 703; COPPA and the COPPA Rule; 47 U.S.C. § 230; 17 U.S.C. §§ 117 and 512; CAN-SPAM.
US states. California Automatic Renewal Law, CCPA with its regulations, CalOPPA, Civil Code §§ 1668, 1670.5 and 1751; New York General Business Law §§ 527 and 527-a; the Virginia, Colorado, Connecticut and Texas privacy acts; Illinois BIPA; Washington My Health My Data Act; and a matrix of the other state privacy laws.
Not covered¶
- national law of EU member states other than Germany beyond the EU directives and regulations (the skill drafts at directive level and lists the national rules to verify as open points);
- the law of the United Kingdom;
- US states outside the matrix, and state law on topics marked "not covered" above;
- sector rules such as HIPAA, GLBA, PCI DSS or financial services law;
- employment, tax and export control law.
When a request touches one of these, the skill says so for that part and continues with the rest.
Law changes after 20 October 2026¶
Several rules in the references take effect later, for example the Product Liability Directive, which applies to products placed on the market after 9 December 2026, and state privacy laws and amendments starting in 2027 and 2028. The skill lists such rules in the open points with their date when your launch falls after it. Rules made after 20 October 2026 are not in the skill; check them before you rely on a draft.