AI-Generated Code Copyright and Legal Basics for Apps

Part 2 is the only final guidance on who owns AI output. Build your ownership record around it.

Purely AI-generated code has no US copyright. Mixed code is judged case by case.

1. List every dependency, direct and indirect, with its license. Your package manager's lock file holds the full list.
2. Flag any GPL or AGPL license in a closed-source product. Permissive licenses such as MIT and Apache 2.0 still require attribution.
3. Run a similarity check on agent-written files with a software composition analysis (SCA) tool that includes similarity detection.
4. Record each flagged item, the scan date, and the person who decided what to do about it.
5. Repeat the scan before each release and after each new dependency.

Copyleft cannot attach to output that has no copyright. If an agent's output is unprotected, a license on it has little to bind, and the real exposure is copied code. That exposure grows when AI output closely tracks copyleft code and lands in a proprietary component.

GitHub offers a public code filter for Copilot suggestions, and its documentation explains how the filter works.

You are legally responsible for code you ship, regardless of who wrote it. Run license scanners before each release, and understand the difference between permissive and copyleft licenses.

• Record human decisions: the prompts you wrote, the reviews you made, and the edits you kept. Keep the commit history that shows them.
• Treat the code as a trade secret: keep the repository private, limit access, and do not publish the source.
• Use contracts with contractors and collaborators to set who owns the code and who can reuse it.
• Read the current business terms of each coding tool before you rely on any ownership or copyright promise.
• Rules outside the US differ. This page covers US rules only.

An application must disclose AI-generated material that is more than a de minimis amount, and disclaim it. The Copyright Office set this rule in its March 2023 guidance.

If Bookly's owner ever registers the code, the application must separate the human-written parts from the agent-written parts.

The open test case is Allen v. Perlmutter (D. Colo., No. 1:24-cv-2665). It concerns a heavily prompted and edited AI image. Summary judgment motions were briefed by January 2026. Its outcome could change how courts measure human input.

Ireland's Data Protection Commission has issued about EUR 4.04B in cumulative fines, led by Big Tech. Meta (EUR 1.2B) and LinkedIn (EUR 310M) are among the largest. The largest 2025 fine was EUR 530M, for international data transfers, issued in April 2025.

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on June 19, 2025, and its main parts commenced on February 5, 2026. It raised the PECR fine cap for electronic marketing and cookie breaches to the UK GDPR level: up to GBP 17.5M or 4% of global turnover. It also adds consent-free exceptions for some low-risk cookie uses, with strict conditions. Check the ICO's cookie guidance before you rely on one.

2025 in numbers: The ICO issued 31 enforcement actions and 15 fines in 2025, about half the number of actions in 2024. The average fine rose to about GBP 1.45M, so one case can cost a small app far more than the 2024 average did.

Bookly collects names, emails, phone numbers and booking history, so the policy must name each one. Update the policy when you add a new SDK, a new data type, or a feature that sends data to an AI service.

Apple lists a privacy policy URL as required in App Privacy Details, and Google Play also asks for a privacy policy link. Apple also accepts an optional Privacy Choices URL. A mismatch between the policy and the store labels can cause a rejection.

For Bookly, the store labels should list the same contact details, booking history and deposit data that the policy names. Keep one data list in the repository, and update the policy and both store forms from that list.

The Texas App Store Accountability Act (SB 2420) was enjoined on December 23, 2025. The Fifth Circuit stayed that injunction on May 28, 2026, so the law can be enforced while the case continues. Utah's law took effect May 7, 2026, and Louisiana's took effect July 1, 2026.

Bookly, as an illustration: if Bookly allows users under 18, read the age and parental-consent signals that the store provides, and act on them.

1. In the EU, load no non-essential tracker before the visitor chooses. Only cookies that the booking itself needs may set before a choice.
2. Put Accept and Reject on the same screen, with the same weight. Refusing must take no more steps than accepting.
3. Test the banner in a fresh browser profile. Confirm that no non-essential cookie sets before the choice, and that none keeps running after reject all.
4. For California visitors, show a Do Not Sell or Share link, and honor Global Privacy Control.
5. Store each visitor's choice, and let the visitor change it later from the site.

Bookly, as an illustration: in the EU, the analytics tool loads only after the client clicks Accept. In the UK, the team checks the ICO's cookie guidance before it treats any analytics cookie as exempt.

The salon owner can cancel or refund a booking. Write the rule the owner follows, and show it to the client before payment. Record every refund against the original payment.

Bookly, as an illustration: if the team adds an AI chatbot for client questions, EU users must be told they are talking to an AI system. Keep logs of what the app sends to the model provider, so you can show what the feature processed.

In the US, Colorado replaced its AI Act with SB 26-189 (signed May 14, 2026), a narrower automated decision-making framework effective January 1, 2027.

The average home page had 56.1 errors, up from 51 in 2025. Pages using ARIA attributes averaged 59.1 errors, against 42.0 for pages without them, about 41% more. WebAIM warns that this is a correlation, not proof that ARIA causes the errors. ARIA appears on 82.7% of pages.

Micro-enterprise exemption: Fewer than 10 employees AND annual turnover not exceeding 2M EUR (for service providers). There is also an "undue burden" exemption.

Requires compliance with EN 301 549, which incorporates WCAG 2.1 Level AA. Build to WCAG 2.2 AA to satisfy both. Accessibility widgets or overlays alone are not sufficient for conformance.

Penalties must be "effective, proportionate, and dissuasive" and are set individually by each member state, so maximum fines vary widely across the EU. Market-surveillance authorities can also order non-compliant products withdrawn from the market. The first court ruling under a national EAA law came from the Tribunal judiciaire de Lille on May 5, 2026. Enforcement is complaint-driven and still early.

On Google Play, an app with accounts must also offer in-app and web-linked deletion. The store section above lists the rules.

Bookly, as an illustration: a drag-only calendar slot picker, or a tiny tap target on the cancel button, fails WCAG 2.2 even if it passes 2.1.