Australia, United States, European Union

Launching an app or SaaS: privacy, consumer and accessibility rules in Australia, the US and EU

Before launching an app or SaaS that collects personal data, you need a privacy policy and data practices that meet each market’s privacy law (GDPR in the EU, the FTC Act and state laws in the US, the Privacy Act in Australia), cookie consent for EU users, compliant subscription and cancellation terms, and accessible design to WCAG 2.2 AA.

Last reviewed 27 October 2026 · A planning guide, not legal or certification advice.

Check your exact product

Roadblock lists every step that applies to what you’re launching, for each market, in order.

Try: “A subscription fitness app with accounts and AI coaching, sold in Australia, the US and EU”

Privacy

In the EU, the GDPR applies to anyone targeting EU users: a lawful basis for each use of data, clear notices, records of processing, processor agreements, DPIAs for high-risk processing, requests answered within a month and breaches reported within 72 hours. Businesses outside the EU also need an EU representative. In the US, the FTC requires your privacy policy to match what you do and security to be reasonable; about twenty state laws add opt-outs and notices once you pass their thresholds. In Australia, the Privacy Act applies above A$3 million turnover and to smaller businesses that trade in personal information or handle health information, but customers and app stores expect a clear policy regardless.

Cookies and tracking

For EU users, analytics, pixels, SDKs and other non-essential tracking need prior opt-in consent with an equally easy reject option, and you need records of consent.

Subscriptions and consumer law

In Australia, standard form contracts can’t contain unfair terms and renewals and cancellation must be clear. In the US, disclose terms and get express consent before charging, send renewal reminders where state laws require, and make online cancellation as easy as sign-up. EU consumers get pre-contract information, a 14-day withdrawal right (or a valid waiver for digital content) and, from 19 June 2026, a “withdraw from contract” button.

Accessibility and AI

Aim for WCAG 2.2 AA. Since 28 June 2025 the European Accessibility Act applies to e-commerce and other consumer services, except microenterprises. If your product uses generative AI, the EU AI Act requires telling people they’re talking to an AI and marking AI-generated content.

Steps, time and cost

Planning ranges from Roadblock’s register (A$, excluding your own staff time). Which steps apply depends on the product; run an analysis for yours.

Step	Market	Typical time	Typical cost
GDPR compliance	EU	4–10 wk	A$3,000–20,000
FTC Act privacy and security	US	2–4 wk	A$1,500–10,000
Privacy Act and the Australian Privacy Principles	AU	2–6 wk	A$1,500–10,000
State privacy laws	US	3–8 wk	A$3,000–20,000
Cookie and tracking consent	EU	1–3 wk	A$0–3,000
Australian Consumer Law for services and digital products	AU	1–3 wk	A$1,500–8,000
Online subscription and auto-renewal laws	US	1–3 wk	A$1,500–8,000
EU consumer rights for online contracts	EU	2–4 wk	A$1,500–8,000
Digital accessibility (Disability Discrimination Act)	AU	2–4 wk	A$2,000–15,000
European Accessibility Act (services)	EU	3–8 wk	A$2,000–15,000
AI Act transparency and literacy	EU	3–8 wk	A$2,000–15,000
PCI DSS for card payments	All markets	1–3 wk	A$0–5,000

Questions

Does the GDPR apply to my Australian app?

Yes if you offer it to people in the EU or monitor their behaviour, wherever your business is. You’ll likely also need an EU representative.

Does the Australian Privacy Act apply to small businesses?

Generally only above A$3 million annual turnover, but it applies to smaller businesses that trade in personal information, provide health services or contract with government.

Do I need a cookie banner?

For EU users, yes if you use non-essential cookies, analytics, pixels or tracking SDKs. Strictly necessary cookies don’t need consent.