Skip to content

Fictional product, illustrative draft. Not legal advice.

Open points

Law as of 20 October 2026. Drafts are for counsel review, not legal advice.

Undetermined facts (see reply.md for the questions these answer)

  • OP-1 -- California/New York thresholds, and whether the CCPA applies at all. No total unit count, revenue, or per-state household figures were given beyond "~140,000 units expected to be registered to California addresses in the first two years" and a New York concentration with no number. The CCPA's own thresholds are 100,000+ consumers/households whose data is bought, sold or shared per year, or $25,000,000+ revenue, or 50%+ revenue from selling/sharing (Cal. Civ. Code § 1798.140(d)(1)). The 100,000-consumer/household limb turns on the number of consumers or households whose personal information the business buys, sells or shares annually, not on units sold or registered; a unit-sales or registration count is not itself evidence of that limb, and the drafts elsewhere state that diagnostic data is not sold. We have not estimated this limb from the unit figure. The revenue limb ($25,000,000, adjusted for inflation; we do not state a current adjusted figure here, see below) is unanswered. CCPA applicability is therefore undetermined: it depends on the client's revenue answer and on whether diagnostic data, or any other personal information, is in fact sold or shared with a third party. The CCPA module is drafted in full in the privacy notice so it is ready to use once the answer is known, but it is marked there as conditional, not as a drawn conclusion. The exact calendar date CCPA duties would start, and whether Virginia (100,000 or 25,000-with-50%-revenue), Colorado (100,000 or 25,000-with-revenue), Connecticut (100,000 or 25,000-with-25%-revenue) or Texas (any volume, no SBA exemption) thresholds are crossed, remain open pending the client's actual figures. New York has no comprehensive state consumer-privacy statute in this skill's references (coverage-matrix.md), so New York privacy duties beyond GBL 527/527-a (auto-renewal only) are not drafted and stay an open point regardless of volume.
  • OP-2 -- Controller/processor role for Scout Cloud business subscribers. Not stated. We drafted Scout Cloud as a controller relationship throughout (Fernlook determines purposes and means of processing photo data for its own service purposes), since nothing in the facts describes a business customer instructing Fernlook on data processing the way a processor relationship would. If the client confirms a reserve/farm customer is itself a controller of personal data in photos (e.g., identifiable people captured by the camera) and directs Fernlook's processing of that content, a data processing agreement under GDPR Art. 28 would be needed in addition to the terms drafted here; this is not yet drafted.
  • OP-3 -- Species-suggestion feature's downstream use. Assumed to be a pure convenience label with no automated decision about a person and no use that "produces legal effects or similarly significantly affects" anyone (GDPR Art. 22(1)). The AI-features clause is drafted on this assumption. If the label is ever used by a third party (e.g., a reserve) to make an access/management decision about a person, the feature would need re-classification and possibly its own Art. 22 safeguards; not drafted.
  • OP-4 -- No biometric human-identification. Assumed true per the client's statement ("no AI-based decisions about people"). If the camera or app in fact performs human face recognition (distinct from wildlife species ID), this triggers GDPR Art. 9 special-category processing and the EU AI Act's biometric-categorisation rules (Art. 5(1)(g)), which are not drafted here.
  • OP-5 -- Marketplace sales structure. Assumed Fernlook sells directly to consumers through the two electronics retailers' marketplaces (agency/marketplace model, Fernlook is the trader of record, the retailer is an online intermediation service under the EU P2B Regulation). If instead the retailers buy wholesale and resell in their own name, Fernlook's EULA/Scout Cloud terms would not be the retailer's own customer contract on those sales, and the P2B Regulation point is moot; this would need separate review of Fernlook's own agreements with the two retailers (not drafted -- out of scope of the documents requested).
  • OP-6 -- Firmware support period. No figure given beyond "as long as we support the model." We inserted a placeholder of 5 years from last unit sold as an illustrative figure the client must replace with its actual commitment before publication; EU/German law requires a concrete, reasonably-expectable update period (DCD Art. 8(2), (3); SGD Art. 7(3), (4); § 475b BGB), and an open-ended phrase with no stated minimum is itself a conformity risk.
  • OP-7 -- App licence transferability with the camera. Assumed the desktop app licence is a feature of the camera hardware that transfers with it (consistent with "included in the camera price," a one-off fee with unlimited duration -- a sale for EU exhaustion purposes per UsedSoft). If the app licence is instead meant to be personal to the original purchaser regardless of hardware transfer, the EU resale mechanics drafted in the EULA (render-unusable-on-transfer) would need to be dropped for the EU module, which creates its own tension with EU exhaustion law (a non-transferable label does not block resale once the sale classification applies); flagged for counsel either way.
  • OP-8 -- No bundled free Scout Cloud tier. Assumed true per "no free trial on Scout Cloud." If a bundled free storage allotment exists, additional US auto-renewal disclosure timing (free-trial-conversion notices) would apply; not drafted.
  • OP-9 -- Children. The facts state no children's features and nothing aimed at a younger audience, so no COPPA or children's-data provisions have been built into the EULA or the privacy notice. If the client later tells us the product has a children's feature, or markets to a younger audience in any launch market, this needs reopening from scratch under references/clauses/children-and-age.md and references/us-federal/coppa.md, not patched onto the current drafts. The EULA's own age clause is a general adult/account-holder confirmation, not a COPPA compliance statement.
  • OP-10 -- Diagnostic data transit for non-subscribers. Assumed diagnostic/usage data (temperature, battery, Wi-Fi signal, firmware version, crash logs) transits Fernlook's servers for every connected camera regardless of Scout Cloud subscription, per the client's description that this data "is separate from the wildlife photos" and is sent "whenever the camera is online." Privacy notice drafted to cover this for all users, not only subscribers.
  • OP-11 -- Packaging/marketing claims. No specific durability, repairability or environmental claim text was given. The EU B2C checklist requires any such claim's qualifying detail to sit with the claim itself (UCTD Annex point 4a; Art. 12) and dated substantiation kept ready; this is flagged in implementation-requirements.md as a requirement to check once actual packaging/marketing copy exists, not drafted against specific text.

National law to verify (instruments applying at directive level only)

  • OP-12 -- Netherlands national transposition. The skill covers EU directive-level floor plus Germany in full; the Netherlands is a named launch market but has no dedicated reference file. Dutch national consumer-contract law (Burgerlijk Wetboek implementing the CRD, UCTD, DCD, SGD), the Dutch Cookiewet/Telecommunicatiewet provisions implementing the ePrivacy Directive, and any Dutch-specific withdrawal-form or cancellation-button equivalent to the German § 312k Kündigungsschaltfläche are not drafted here and must be checked by Dutch counsel before launch. We drafted the EU-directive-level consumer module for Dutch users and flagged German specifics (e.g., the online cancellation button) as Germany-only, not assumed to extend to the Netherlands.
  • OP-13 -- New York general consumer privacy law. As stated in OP-1, New York has no comprehensive privacy statute in this skill's references; only GBL §§ 527/527-a (auto-renewal disclosure) is covered. Any broader New York privacy-notice content duty is an open point for New York counsel.
  • OP-14 -- Other US states beyond California, Virginia, Colorado, Connecticut, Texas. The client named only Germany, Netherlands and US nationwide with California/New York concentrations; if sales occur nationwide (stated), every other enacted state privacy law in references/us-states/state-matrix.md (Utah, Iowa, Indiana, Delaware, Nebraska, New Jersey, Montana, Oregon, Kentucky, Rhode Island, Tennessee, Maryland, Minnesota, Oklahoma, Louisiana, Alabama, New Hampshire, Vermont) is a flag to check against its own threshold, not drafted in full. Given "nationwide" sales were stated, this is a live open point, not a hypothetical one -- Delaware's and Maryland's low thresholds (35,000/10,000-with-20%-revenue) in particular could be crossed well before California's, and in any case the CCPA's own applicability is itself unresolved (OP-1).

Rules that take effect later than the law-as-of date or around the product's launch

  • OP-15 -- EU repair and conformity amendments (Directive (EU) 2024/1799). Repairability becomes part of objective conformity, and the repair-remedy liability extension (12 months) applies, for a sale-of-goods contract concluded on or after 31 July 2026. The March 2027 launch falls after this date, so the EULA's warranty/conformity section includes the 31 July 2026-or-later provisions as the operative rule, not the pre-amendment text.
  • OP-16 -- Data Act switching-charge sunset (12 January 2027). Not directly applicable to this product (Scout Cloud is a consumer cloud storage add-on, not necessarily a Data Act "data processing service" in the Art. 25 switching-duty sense for a consumer product) -- flagged, not drafted, as whether Scout Cloud itself is a Data Act Chapter VI data-processing service is undetermined on the facts given (see annotations.md applicability table).
  • OP-17 -- EU AI Act intimate-image prohibition (Art. 5(1)(ba)). Takes effect 2 December 2026, before the March 2027 launch -- included in the Must-not list for the AI-features clause as a live rule at launch, not a future one.
  • OP-18 -- Colorado sensitive-data-sale consent amendment (approved 2025-05-23) and precise-geolocation radius change (1,750 to 1,850 feet) are both already in force before the law-as-of date and are reflected in the privacy notice's Colorado module if Colorado's threshold is crossed (see OP-1/OP-14).
  • OP-19 -- German cancellation-button login-step litigation. The BGH is due to rule 5 November 2026 (I ZR 272/25, I ZR 275/25) on whether a login step may sit between the German cancellation button and its confirmation page. The Scout Cloud terms are drafted with no login step, the safer design pending that ruling; this should be rechecked against the actual ruling before the March 2027 launch.
  • OP-20 -- BGH ruling on cancellation-confirmation-page content (16 July 2026, I ZR 200/25) confirming the page may carry no retention offer or pause option -- already decided and in force before the law-as-of date; reflected as settled law in the drafts, not as a future rule.

Decisions reserved to counsel (official-model options)

  • OP-21 -- Withdrawal information: goods variant vs. services variant used correctly? The camera purchase (one-off hardware sale) uses the goods variant of the Art. 246a EGBGB / CRD Annex I(A) model (period from receipt of goods); the Scout Cloud subscription uses the services/digital-service variant (period from conclusion). Both are drafted separately as the skill requires (see Document set rule). Counsel should confirm no single combined withdrawal notice is used for the bundled "camera + cloud" checkout flow, since that would misstate the trigger date for one of the two contracts.
  • OP-22 -- Choice of governing law for the EU consumer module. The core clause names Fernlook's home jurisdiction (Netherlands) with the Rome I mandatory-protection disclosure added, per the governing-law-and-jurisdiction clause file's EU consumers module. Counsel should confirm this is the business's actual preference rather than, for example, naming German law for German consumers specifically.
  • OP-23 -- US arbitration clause. Drafted with individual arbitration and a California public-injunctive-relief carve-out (McGill) for the US consumer module, per the standard US module in the skill's templates. Counsel should decide whether Fernlook in fact wants predispute arbitration for US consumers at all (a business decision, not a legal requirement) and set the arbitration provider/seat, which we left as a bracket.
  • OP-24 -- Whether a commercial/durability guarantee is offered at all. The warranty-and-conformity clause's optional "commercial guarantee" (Garantieerklärung / extended warranty) paragraph is left as a bracketed option; the client did not mention offering one beyond the statutory floor. If Fernlook wants to offer an extended warranty as a marketing feature, that decision and its terms are reserved to the client/counsel and not drafted.
  • OP-25 -- Severability fallback for an unfair EU term. Per references/conflicts.md's general open point, a severability clause does not let a court revise or reduce a term found unfair under the UCTD; counsel should not rely on the severability clause to rescue a specific EU-module clause found unfair at a later date.
  • OP-26 -- Whether the on-device species label is output an Art. 50 transparency duty reaches. The species-suggestion feature does not interact with a person through chat or voice and does not generate synthetic audio, image, video or text, so the Art. 50(1) interaction-disclosure duty and the Art. 50(2) synthetic-content marking duty do not appear to fit it on a plain reading. We have not treated this as settled, because the feature does produce an output (a label shown to the user) from an AI system, and whether that kind of output falls within any Art. 50 duty on these facts is a judgment call the skill's sources leave open rather than answer directly. Counsel should confirm whether Art. 50 reaches this specific feature before the AI-features clause in the EULA is treated as final.

Where the references are silent (stated, not filled from memory)

  • No reference file in this skill states a Dutch-specific prescribed button wording, cancellation-button duty, or Dutch model withdrawal form text; only the EU directive-level English/German models are given (references/prescribed-wording.md). Dutch-facing checkout and cancellation flows use the EU directive-level models with the Dutch language, not a Dutch national model, pending Dutch counsel's confirmation that this is sufficient.
  • No reference file states a California or federal revenue-adjustment figure for the CCPA's inflation-adjusted $25,000,000 threshold beyond the base figure; the exact current adjusted figure is not stated here and must be checked against the Attorney General's current published adjustment before relying on the revenue limb.
  • No reference file states the EU micro/small-enterprise ceiling figures under Recommendation 2003/361/EC; if Fernlook later asks whether any of its business customers (small nature reserves, farms) qualify as a microenterprise or small enterprise for Data Act Chapter II carve-out purposes, that figure must come from counsel checking the Recommendation directly, not from this skill's references.