Legal work is rarely optional. You are going to pay for it at some point; the real question is when. Bring someone in early, and most issues are relatively inexpensive to address. Wait until you have a founder dispute, an exposed database, a copycat, or a buyer asking for years of documentation, and the cost—both financially and operationally—rises quickly.
I ran legal at Cal AI through its rapid growth and eventual sale to MyFitnessPal. It was a calorie-tracking app built by a couple of teenagers and a recent college graduate, and it scaled at an extraordinary pace. Along the way, we dealt with a founder dispute, copycat apps, an opportunistic trademark filing, an accessibility claim, and a closing timeline that few people thought we could meet. Since then, I have seen versions of the same issues arise again and again at other fast-growing companies.
Founders are not careless. They are focused on building, hiring, shipping, growing, and solving the problem directly in front of them. They are simply not always thinking about the legal protections that can prevent today’s small issue from becoming tomorrow’s very expensive problem.
Here are eight situations worth addressing before they become crises.
Scenario #1: A co-founder quits
Cal AI’s first legal problem started before I joined.
Early on, the team gave someone the co-founder title and (gulp!) vested equity. Six weeks later, that same co-founder quit citing worries about the calorie counts and personal liability. Don’t contact me. Don’t use my name. I want nothing to do with this, he said. He asked for a pittance to go away, and we thought even that was too much.
Then the company started making serious money. Suddenly, the co-founder who had texted the team that he was unequivocally “out” was claiming he didn’t mean it.
We are still in court. While the original operating agreement had no clear exit provision, a later amendment did. From our perspective, the facts are black and white. In court, the judge even read his own texts aloud, verbatim — and it will still cost millions of dollars and time no founder has.
Decide the breakup while everyone is still friends
Write it down while everybody still likes each other. Your founder documents should cover:
- What leaving means, and the process for doing it
- What happens to equity when someone walks
- A cap table that won’t need reconstructing afterwards
- Non-disparagement, agreed while you’re still buddies, so nobody takes anybody down later
And don’t vest anyone immediately. Even if it’s your best friend from high school, if they’re in it for the long run, let there be a cliff and a vesting schedule. Otherwise, it can turn into a long-term marriage.
Scenario #2: Your app gets copied
One day, I went into the App Store and searched “Cal AI.” Ten Cal AIs came up. Not Calorie AI. Not names that sounded vaguely similar. Ten apps using our name.
That is the reality of building a successful consumer app today. Anyone can vibe-code something that looks remarkably similar to your product in an afternoon.
Copycats are a permanent game of whack-a-mole. You take one down, another pops up, and every one of them creates confusion and takes a piece of your market. But you can’t enforce rights you never protected. For your brand, that starts with your trademark.
When should you file a trademark?
Early. Ideally, before anyone cares about your name.
You may change the logo. You may even change the name. File anyway. If you pivot, file again.
Somebody without a company filed the Cal AI name before we did. There are people who spend their days in the App Store and on Sensor Tower watching which apps are climbing on revenue, so they can vibe-code a copycat or grab the name and wait for you to come buy it back. We filed early enough that it never got that far.
Jurisdiction matters too. In the US the fight is over first commercial use, while in the UK and elsewhere, first to file can win it outright. International filings cost real money and aren’t something to do yourself with AI’s help, so where to file is a business decision about where your product matters most.
What if your app name is too generic to trademark?
The strongest thing you can own is a wordmark: the words themselves, used any which way, and nobody can take them. That’s easy when your name is unusual and hard when it’s mundane. The Container Store failed its trademark for exactly that reason — it’s a store, it sells containers, there’s nothing unique in it. What rescues a descriptive name is commercial use over time: you show the name acquired its own identity in the market, and then you can claim rights.
People ask how we got away with an apple in the logo, and the answer is that we didn’t, exactly. We did not own the apple standing alone, and we did not obtain a registration for the CAL AI word mark by itself. What we were able to register was the combination of the design and the words, supported by the commercial use and recognition the brand had developed.
So if you are already late—or your name is not particularly distinctive—start keeping receipts: press coverage, launch dates, screenshots, sales, marketing materials, and evidence of first use. If one form of protection fails, go for another.
How do I get a copycat app removed from the App Store?
To get a copycat pulled from the App Store or Google Play, you need the trademark registration number itself — a pending application won’t do it. With the number, the listing gets flagged and comes down. Without it you’re in an automated queue, trading AI-generated replies with the other side. Registration takes a long time, which is one more reason to file before you need it.
Cease-and-desist letters work less than half the time. Some copycats fold once they realize you aren’t kidding around, and some make you fight. Either way, someone needs to keep watching the stores, because it doesn’t end.
And for the record: Apple did take Cal AI down once—but not over the logo, and not on my watch. That was a payment-flow fight that came after the sale.
Scenario #3: Your app gets sued over accessibility
Cal AI was sued by a blind user who argued the app was discriminatory because she could not use it to scan her food.
There is a reason the ADA exists and a reason we have wheelchair ramps. But this was not that. There are lawyers who make a business out of finding technical accessibility claims against successful companies, knowing that it will often cost the company far more to win than to settle.
That was the math here. We knew we would win. But getting there would have cost at least $100,000 to $150,000. We settled for under $15,000.
And in that sense, they won. Being right and making the right economic decision are not always the same thing.
Protect your app from an accessibility claim
You don’t have to build a product that serves every possible user, but you do have to show you made a concerted effort:
- Run an AI search on ADA color-contrast standards for apps and check your interface against them
- State in your Terms of Service that the app cannot serve everybody, and describe what you have done to accommodate as many people as you can
- Publish a phone number people with disabilities can call for help using the app
None of this guarantees you won’t get sued. The point is to make yourself a harder target and give yourself a much better defense if you do. Once you have momentum, more people are looking at you, and not all of them wish you well.
Scenario #4: Someone finds a way into your users’ data
One client was tracking the sexual behavior of its users, and that data was sitting open to the public. There was no leak — there was just a backdoor nobody had closed.
What do you do when a researcher reports a vulnerability?
Some of the people who find that door are trying to help. White-hat hackers look for vulnerabilities and report them, often expecting a bounty, and plenty of companies pay. My client fixed the vulnerability and never paid, and the researcher published the whole thing later, leaving the company to take the reputational hit. If a white hat comes to you, thank them, negotiate, give them something — and 100% act on what they have told you.
Turn your backend logs on
A different client had backend logging switched off, so when something looked wrong, we could not establish who had been in the system or what they had reached. That matter involved the personal data of children, and with no logs, we could not prove the information had not been accessed. Statutory penalties like these are counted per record rather than scaled to your size, and we were looking at something on the order of $53,000 per minor’s information. Under European rules you have 72 hours to disclose or act.
Pressure-test the product, keep the logs running, and know exactly what data you hold. Class-action lawyers move fast when this kind of data is involved.
Scenario #5: You don’t own everything you built
Contractors, engineers, advisors—every person who touches your product creates a potential ownership issue.
Before they touch it, get a CIIAA in place: a confidential information and inventions assignment agreement. You will need it at exit, but the more immediate risk is someone walking away believing they own a piece of what they made, free to build on it, sell it, or rip you off with it.
This is where legal money goes a long way. You don’t need a new agreement every time someone joins. Get one rock-solid document drafted properly, then make everyone sign it before they touch the product.
Who owns AI-generated code in your product?
Does Claude own the code it wrote for you? Does Codex? I have to think not, but nobody has litigated it, and until somebody does, it’s the wild, wild west.
So for now, contract around the uncertainty. Your agreements should require that anything someone puts into your product is something they have the right to give you—and that those rights are assigned to the company.
Most engineers will barely notice the clause. Your buyer’s lawyers will.
Scenario #6: Your contractor is legally an employee
Every startup starts with contractors: you need people for the few hours they can give you, and nobody’s first call is to a payroll provider. The question is when it stops being defensible.
When does a contractor legally become an employee?
The real test is control over how the work gets done, not over what gets delivered. You can hire a head of product or a head of engineering on a contractor basis — here’s the goal, figure it out. That’s a contractor. Tell them to be in the office from eight to six, sign into Slack, file weekly reports and report to a named manager, and you’ve described an employee. If you’re their only client, that points the same way.
What does misclassification cost?
Every state has its own test. Federal definitions have loosened somewhat in the past couple of years, and California remains the strictest state by a distance. Misclassification in Florida runs $5,000 per employee, and in California it’s $15,000 per violation — and what counts as a violation gets decided on the facts of your case.
Converting people to W-2 isn’t free either: more expense for you, fewer deductions and less take-home for them. That’s a genuine trade-off, and it’s worth an hour of counsel’s time rather than hearing the answer from a state agency.
Scenario #7: An influencer campaign turns into a legal dispute
The FTC has rules about disclosing paid promotion, and they are pretty clear: disclose clearly and conspicuously, full stop. Search “FTC social media rules” and you’ll have them in a minute.
Disclosure can tank views and hurt the algorithm. I get it, 100%. Many companies I work with make a business decision about how much risk they are willing to take—but the FTC is paying attention. A first violation is more likely to result in a warning, investigation, or requirement to correct the practice than an automatic massive fine. But once a company is on notice or subject to an FTC order, continued violations can carry civil penalties of $50,000+ per violation. Multiply that across repeated posts, and the numbers can get ugly fast.
In practice, companies often push some of that risk down the chain. The influencer agreement says the influencer knows the rules, agrees to follow them, and indemnifies the company if they don’t. It is usually about appeasing the brand to maximize views.
Then there’s the version I didn’t see coming. One UGC client’s influencers weren’t disclosing the ads, and instead of quietly taking the extra traction, the client demanded its money back and called it a morality claim: you didn’t follow the rules, and this doesn’t make my product look good. My honest read is they didn’t want to pay the bill. Usually we are the ones telling UGC companies to get their influencers compliant, and here it ran the other way.
The more common fight is money: who owed what to whom, and what the influencer was supposed to receive. I had a matter where one influencer told another to stand down after he used her reel in his own content—what is commonly called a “reaction video.” Is he commenting on her content, or using someone else’s work to make money? That line is getting blurrier by the day. Eventually, the courts will decide.
What should an influencer contract spell out?
Write it for a judge who has never opened Instagram. Imagine a 65-year-old judge who knows nothing about social media trying to work out who’s right — that’s the standard your contract has to meet. Spell out what the influencer is being paid and what the company or the agency is paying for, so that when a dispute comes, both sides can read the document and settle it.
Scenario #8: A buyer wants to acquire your company
We had a breakneck closing at Cal AI, on a schedule the deal lawyers thought was impossible. We made the date, and the only reason we made it is that our documents were in order.
What does a buyer look at during due diligence?
You get an offer, you sign a term sheet, and then the buyer looks under the hood: every influencer agreement you have ever signed, from day one. Your trademarks and filings. Your confidentiality and invention assignment agreements. The list of every person who has ever touched the code or the product, and proof that each of them assigned their contribution to the company.
Revenue gets you the offer, and documentation gets you to closing. The buyer’s legal team is billing by the hour and looking for reasons to dig, so if they open your folders and find things scattered across people’s local laptops, they will go deeper. If everything is neat and tidy, the process moves.
Organize now, before there’s an offer — agreements, filings, product documentation, all of it somewhere other than individual laptops. Growth created the opportunity for Cal AI. Readiness is what let us keep it.
Before your next growth stage
Six questions worth asking before you get bigger:
- Do you actually own everything you are building?
- Are your founders, employees, contractors, and advisors properly documented?
- If a founder walked away tomorrow, do your documents say exactly what happens?
- Does your product actually do what your Terms of Service and Privacy Policy say it does?
- Can you stop someone from copying your name—and can you prove when you first used it?
- If buyer or investor diligence started tomorrow, would you be ready?
If any answer is “I think so,” fix it now. It will be a lot cheaper.
