The pre-launch compliance checklist for a SaaS campaign or feature announcement

In the US, the Federal Trade Commission (FTC) enforces against deceptive or unfair marketing practices under the FTC Act, and has specifically targeted "dark patterns" (interface designs that trick users, like hard-to-find cancel buttons) in SaaS subscription flows. The FTC's 2024 "click-to-cancel" rule push targeted exactly this. See the FTC's business guidance on negative option marketing for the current requirements.

In the EU, the Digital Services Act (DSA) and the Unfair Commercial Practices Directive cover similar ground, banning dark patterns and requiring clear disclosure of automatic renewals. The EU also enforces the General Data Protection Regulation (GDPR), which governs how you describe data use in marketing copy, not just in your privacy policy.

The three checks that matter most

1. Pricing and claims review (legal)

Every pricing page, comparison chart, and "starting at $X" banner needs a legal read before publish. Specific triggers:

• Free trial to paid conversion language. If the trial auto-converts to a paid plan, this must be stated clearly near the CTACTAA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more.View full definition → (call to actioncall to actionA button, link, or message that prompts users to take a specific action such as sign up, buy, download, or learn more.View full definition →), not buried in terms of service. The FTC treats omission here as a deceptive practice.
• Comparison claims against competitors. "3x faster than Competitor X" needs a documented, defensible benchmark on file. Unsubstantiated comparative claims are a classic FTC Act Section 5 exposure.
• Discount and promotion framing. "50% off" must specify the base price and duration. If the discount is introductory only, that has to be as prominent as the discount itself.
• Cancellation and refund terms. Must be as easy to find as the sign-up flow. The FTC's guidance is blunt: cancellation should not require more steps than signing up.

Practical rule: any page with a price, a percentage, or a comparison claim on it gets a legal sign-off ticket before it ships.

2. Accessibility check (design and engineering, with legal oversight)

Web accessibility means digital content is usable by people with disabilities, including screen reader compatibility, keyboard navigation, and sufficient color contrast. The controlling standard is the Web Content Accessibility Guidelines (WCAG), currently at version 2.2, maintained by the W3C.

In the US, the Americans with Disabilities Act (ADA) has been interpreted by courts to apply to websites, and SaaS landing pages are a common lawsuit target because they're public-facing and easy to audit automatically. Plaintiffs' firms run automated scans across thousands of SaaS marketing sites looking for WCAG failures.

In the EU, the European Accessibility Act (enforceable from June 2025 across member states) extends accessibility obligations to e-commerce and many digital services, including SaaS.

Minimum pre-launch check for any new landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → or campaign microsite:

• Automated scan (tools like WAVE or axe, both free)
• Manual keyboard-only navigation test
• Color contrast ratio check (WCAG AA minimum is 4.5:1 for normal text)
• Alt text on all campaign imagery and video

3. Data-privacy language for new features (legal plus product marketing)

Any feature announcement that touches customer data (a new AI assistant reading support tickets, a new integration pulling calendar data, a new analytics dashboard aggregating usage) needs privacy language reviewed before the announcement, not after.

Under GDPR, if the new feature changes *how* data is processed (a new purpose, a new third party, a new data category), you likely need a Data Protection Impact Assessment (DPIA), a required risk assessment for processing that's likely to result in high risk to individuals, before the feature ships, not just before it's marketed.

This matters a lot in 2026 because most "new AI feature" launches involve sending customer data to a model, sometimes a third-party one. Marketing copy claiming "your data is never used to train models" is a factual, auditable claim. If it's wrong, it's not a copywriting error, it's a regulatory exposure under both FTC and GDPR frameworks (California's California Consumer Privacy Act (CCPA) adds a state-level layer with similar disclosure duties).

Checklist for any AI or data-related feature announcement:

• Does the announcement copy match what the DPIA or privacy review actually concluded?
• Is there a plain-language explanation of what data is used and why, separate from the legal privacy policy?
• Has the security/privacy team confirmed any "encrypted," "anonymized," or "we never sell your data" claim is technically accurate?

Building the sign-off workflow

A workable pre-launch checklist has four gates, run in sequence, not in parallel, because each gate can send the campaign back to an earlier stage:

1. Claims and pricing gate (legal): every quantified or comparative claim has a source document attached.

2. Privacy gate (legal plus security/data team): every data claim matches the DPIA or privacy review.

3. Accessibility gate (design/engineering): automated and manual checks pass WCAG 2.2 AA.

4. Final marketing sign-off (marketing lead): confirms all three gates cleared, with named approvers logged.

Keep this as a shared ticket, not an email thread. A simple structure:

This is not bureaucracy for its own sake. A named approver on each line means when something goes wrong, you know exactly where the process broke, and you fix the process, not just the page.

What "good" looks like in practice

Companies with mature compliance processes build these gates into their project management tooling so a campaign literally cannot move to "scheduled" status without all four sign-offs logged. This is standard practice at large, publicly traded SaaS vendors precisely because they've been through FTC consent decrees or GDPR enforcement actions and rebuilt process afterward.

The cost of the checklist is small: a few hours per campaign. The cost of skipping it shows up as legal fees, regulator inquiries, and, less visibly, in customer trust. Trial-to-paid conversion language that feels sneaky gets screenshotted and shared long before any regulator gets involved.

Key Takeaways

• Every SaaS marketing claim involving price, percentage, or comparison needs a legal sign-off with a documented source before it ships, not after a complaint arrives.
• Accessibility (WCAG 2.2 AA compliance) is a pre-launch check, not a post-launch fix; automated scans plus one manual keyboard test catch most failures cheaply.
• Any feature announcement touching customer data should be checked against the actual DPIA or privacy review; marketing copy can't promise more than the privacy team can confirm technically.
• Build a four-gate sign-off ticket (claims, privacy, accessibility, final approval) with named approvers, so accountability is traceable when something slips through.
• Regulatory bodies to know by name: the FTC and state AGs in the US, and GDPR enforcement plus the European Accessibility Act in the EU, all of which treat marketing pages as regulated surfaces, not just creative assets.