Skip to content

Fictional product, illustrative draft. Not legal advice.

Open points

Law as of: 2026-10-20. These are the undetermined facts, national-law gaps, not-yet-settled rules and decisions reserved for counsel across the Shutterline document set. Each item states what is missing, why it matters, and what it would change if answered.

Facts missing from the client's message

  1. Member states beyond Germany, France and Spain. The client named Germany, France and Spain as the near-entirety of the EU user base but did not rule out other EU states. The EU consumer module in every document is drafted at directive level, which covers all three named states; the Germany module is drafted in full from the German transposition statutes. France's and Spain's own transpositions (standard-terms control, withdrawal mechanics, consumer-protection enforcement bodies) are not separately covered by this skill's references, so a France- or Spain-specific layer is not drafted here: only flagged. If the client sells into other EU states, the same gap applies there.
  2. Micro/small enterprise status under Commission Recommendation 2003/361/EC. This decides whether the DSA's Art. 20 to 24 duties (internal complaint-handling, out-of-court settlement, trusted-flagger routing) apply at all, since a micro or small enterprise is exempt from that Section unless designated a very large online platform. The skill's rules bar estimating this threshold from revenue, headcount or user figures (Recommendation 2003/361/EC sets specific ceilings this skill does not state). Shutterline's EUR 20 million turnover and 120 employees are the facts given; whether these cross the Recommendation's own ceilings is not something this draft determines. The documents are drafted assuming the fuller Art. 20 to 24 duty set applies (the safer default), since 2 million EU monthly active users strongly suggests the platform is not a small operation in substance, but the enterprise-size test itself turns on the Recommendation's own staff-headcount/turnover/balance-sheet figures, which must be checked against the actual consolidated figures (including any parent or affiliate) before relying on an exemption either way.
  3. Whether Shutterline is designated, or is approaching designation, as a very large online platform (VLOP) under DSA Art. 33. This skill's DSA reference file covers only Art. 1 to 32; Art. 33 and the VLOP-specific duties (systemic risk assessment, the Art. 14(5)-(6) summary/full-language terms duties, the Art. 24(2)-(4) active-recipient reporting) are out of scope and not drafted. With roughly 2 million EU monthly active users, Shutterline is well under the 45 million EU-user VLOP designation figure as generally understood, but that figure itself is not one this skill's references state, so treat VLOP status as a standing open point to re-check as the user base grows, not as settled by this draft.
  4. CCPA numeric thresholds. The skill's rule bars estimating a CCPA revenue or data-volume threshold from global turnover, user counts or market size. The client's EUR 20 million global annual turnover is not, by itself, the CCPA's own gross-revenue test (which is denominated in USD, applies to the business's own revenue in a specific prior calendar year and may be assessed on a US/California-linked basis depending on counsel's reading), nor does it answer the "100,000 or more consumers'/households' records bought, sold or shared" limb or the 50%-of-revenue-from-selling-personal-information limb. With 1.5 million US monthly active users, the volume limb is plausible but not confirmed, since "consumers" for that test is California residents specifically, not all US users. This draft does not assume CCPA applies in full; it drafts CalOPPA (which has no threshold and definitely applies) plus a conservative CCPA-style notice structure, and flags the CCPA full-compliance question (opt-out links, request-channel counts, deletion cascade, data protection assessments) as open pending counsel's threshold determination.
  5. Other US states. The client did not name specific US states beyond "United States" as a whole. Virginia, Colorado, Connecticut and Texas are covered in full by this skill's references; other states are covered only as flags in the state matrix. Given 1.5 million US monthly active users spread across an unspecified set of states, several of the Virginia-model states' own thresholds (100,000/25,000 consumers) are plausible to be crossed once a per-state breakdown is known. This draft does not attempt a state-by-state breakdown; it is an open point for counsel to run once usage-by-state data is available.
  6. Precise mechanics of "ads personalised to what a user has looked at and liked." The client described two ad types: plain contextual ads and behaviourally personalised ads based on on-platform activity. The draft assumes this personalisation uses only on-platform signals (views, likes) with no cross-site tracking, no SDK-based device fingerprinting and no third-party data purchase. If personalisation in fact draws on data from outside Shutterline (an ad-tech SDK, a data broker, cross-device matching), the cookie notice's third-party disclosure section and the privacy notice's recipient/legal-basis sections both need to be revisited, and the EU legal basis for that broader processing is almost certainly consent rather than legitimate interest in an even clearer way than already stated.
  7. International data transfers. The client stated photos, comments, messages and profile data sit on Shutterline's own EU servers. The draft assumes no processor (CDN, email delivery vendor, crash reporting, push notification service, customer support tool, cloud backup) sits outside the EEA. If any vendor is outside the EEA, the privacy notice's international-transfer section needs the specific transfer mechanism (adequacy decision or standard contractual clauses plus a transfer impact assessment) named, which this draft does not do because no vendor was identified.
  8. Minors and the product's actual design. The client gave a minimum age of 16 checked only by self-declared birth date. The draft does not assume the product is directed at, or predominantly used by, minors (hobby photography skews adult), but this is not independently confirmed; if any feature (public leaderboards appealing to teenagers, a "near me" discovery feature, default-open direct messages) suggests otherwise, the DSA's minors-facing-language duty and a more protective GDPR Art. 8 analysis would need to be added.
  9. Age floor across member states. Germany's own implementing choice within the GDPR Art. 8 band (13 to 16) is not stated in this skill's references (flagged in references/clauses/children-and-age.md). The 16-year minimum age the client chose clears the top of the EU band everywhere, so this is lower-risk than a lower age would be, but France's and Spain's own implementing figures are likewise not confirmed here.
  10. DPO, EU representative, and actual contact points. No named individual or department was given for the DSA's two mandatory points of contact (authorities; users), for a data protection officer, or for a non-EU legal representative (not applicable here since Shutterline is itself established in the EU, but the documents use bracketed placeholders throughout that must be filled in before publication).
  11. Whether Shutterline wants US arbitration/class-waiver language. Not stated. Drafted as the US-market default per the skill's conflicts analysis (references/conflicts.md C-1, C-2, C-11, C-12); confirm this is wanted before counsel review, since removing it is a simple edit but adding it later needs a fresh look at delegation-clause and McGill carve-out wording.

National law not covered by this skill's references

  1. France and Spain's own transposition detail. Standard-terms control, cancellation-flow specifics, and consumer-dispute-resolution body notices for France and Spain are not covered by any reference file this skill draws on; only Germany's national layer is covered in full. Treat every EU-consumer-module clause as the directive floor for France and Spain, with national-law verification as a standing item for local counsel in each state.
  2. UWG (German unfair-competition law). The marketing-communications clause notes that Germany's own transposition of unfair commercial practices rules (the UWG) sits alongside the EU-level UCPD rules this skill covers, but the UWG's own text is not covered here. Any German-specific advertising-practice question beyond the EU floor is for counsel.
  3. VLOP designation criteria (DSA Art. 33 onward). As above; this skill's DSA file stops at Art. 32.
  4. Whether a DSA "online platform" classification is correct at all. Shutterline is a hosting service that also disseminates user-provided content (photos, comments) to the public at the recipient's request, which is squarely the DSA's own "online platform" definition (Art. 3(i)), with no minor-ancillary-feature carve-out plausible given that content sharing is the whole product. This is treated as settled in this draft, not as an open point, but is stated here for completeness since the DSA file lists it as a standing item to confirm for every product.

Rules not yet, or only recently, in force

  1. Right to repair directive, Sale of Goods Directive repair-remedy extension (31 July 2026 trigger). Not relevant to Shutterline (no goods sold), noted only to confirm it was considered and excluded.
  2. BGH case law on the German cancellation confirmation page (judgment of 16 July 2026, I ZR 200/25) and the pending BGH hearing on a login-gated cancellation flow (5 November 2026, I ZR 272/25 and I ZR 275/25). Not directly relevant since Shutterline has no paid subscription for consumers to cancel (the service is free), but flagged because if Shutterline ever introduces a paid tier (e.g., ad-free or a pro photographer tier), the German cancellation-button regime (ยง 312k BGB) would then apply in full and these pending points would need to be re-checked against the state of the law at that time.
  3. EU Data Act, AI Act, right-to-repair and Product Liability Directive. Not relevant on the facts given (no connected product, no AI feature described, no goods sold, no digital content/service sold for a price). Noted as considered and excluded; revisit if the product adds an AI-based recommendation or moderation feature that interacts directly with users (the AI Act's Art. 50 transparency duties would then apply) or if Shutterline monetises in a way that brings the Digital Content Directive into play (see below).

Classification decisions made in this draft, stated so counsel can check them

  1. Shutterline is not a "digital content" or "digital service" contract for payment purposes in the Digital Content Directive sense, because the client stated the service is entirely free and funded by advertising, with no payment in money and no suggestion that personal data is processed beyond what the service itself needs plus advertising. The Digital Content Directive's "data as price" rule (Art. 3(1)) reaches a contract only where the trader processes the consumer's personal data for a purpose going beyond supplying the service or meeting a legal duty: and advertising-funded processing is arguably exactly that further purpose. This is flagged, not resolved: if counsel takes the view that ad-funded personalisation counts as "a price" under Art. 3(1) DCD, then the DCD's conformity, updates, and termination/export regime (and the EU consumer withdrawal-information documents) would need to be added to the document set, which this draft does not currently include. The terms of service state the no-money-price-position but flag this as a point for counsel's own view.
  2. No marketplace / P2B duties apply. Shutterline does not let users conclude distance contracts with traders through the platform (it is a photo-sharing and messaging community, not a marketplace), so the DSA's Art. 29 to 32 trader-onboarding duties and the P2B Regulation's business-user protections are treated as not applicable and are not drafted into any document. If Shutterline later adds a feature letting photographers sell prints or sessions through the platform, this needs a fresh pass.
  3. No EULA, subscription terms, or withdrawal-information document is included, because the service is free with no software licence granted to install, no subscription, and (on the current facts) no consumer contract that would trigger an EU withdrawal right (the withdrawal right under the Consumer Rights Directive attaches to a distance contract that is itself a sales, service or digital-content contract for a price or under a qualifying no-price-but-personal-data theory per point 19 above). If point 19 is resolved the other way, a withdrawal-information document becomes necessary.
  4. Data Processing Agreement not included. No third-party processor was named by the client (the hosting is on Shutterline's own servers), so no DPA is drafted. If any sub-processor is identified (per point 7 above), a DPA (or at minimum GDPR-compliant processor terms) would be needed for that vendor relationship, and a data-as-price / advertising-partner DPA may also be needed if any ad-tech vendor sits in the flow.

Decisions reserved for counsel, not made by this draft

  1. Whether the DSA micro/small enterprise exemption applies (point 2).
  2. Whether the CCPA's own numeric thresholds are crossed (point 4).
  3. Whether ad-funded processing makes Shutterline a Digital Content Directive "data as price" contract (point 19).
  4. Whether to include US mandatory arbitration and a class-action waiver (point 11), and if so, the exact carve-outs for California public-injunctive relief (McGill) and for sexual-assault/harassment claims (the Ending Forced Arbitration Act).
  5. Whether any additional US state beyond Virginia, Colorado, Connecticut and Texas needs its own privacy-notice layer, once a per-state user breakdown is available (point 5).