AI Doesn't Make Me a Lawyer. Can It Make You a Web Designer?

I got sued.

I was at my house watching Big Daddy with my wife. There's a knock on the door.

Some guy I don't know asks if I am Peter Roesler. I say yes. He hands me papers.

You've been served.

My heart dropped. Stomach went into my feet.

It was a noncompete. One page I'd signed years before, working for a guy. It said I wouldn't go after his customers for a year. That was it.

Nothing about not doing web work. Nothing about running my own business.

He was petty. I'm still not sure what I did to piss him off.

I'd been on my own about five months.

Here's the crazy part. He took that one page contract, stapled a second page to it, and tried to say it was always a two page document.

Different fonts. The staple wasn't even on the first page. My signature was only on one page.

I got a lawyer through a friend. We bartered it out.

It hung over my head for almost two and a half years. Then it got dismissed with extreme prejudice.

There was no AI back then. Nowhere to type any of it.

So picture it today. Me at my kitchen table, running that case off a chat window.

Asking a machine what to file. What to say. What that stapled page even was.

It would give me an answer. It would sound sure.

I don't know shit about law and I am not a lawyer.

Lawyers go to school for years. They're licensed. They carry the liability personally. They know shit I will never know.

That's the whole post. The answer can be right. I'm still not the guy.

TL;DR (the short answer)

No. And there are three things a site built by AI does that most owners never hear about. A logo made entirely by AI isn't protected by copyright. So you may not be able to stop anybody from copying it. A contact form that asks for a name and a phone number means you owe visitors a privacy policy. And when data leaks, every state has a law that puts the phone calls on you. Not on your website tool.

3 Things to Remember

I Didn't Try to Handle It Myself. Not for a Second.

Reading and being responsible are different jobs. I've made that argument twice in this run, so once more and I'll move.

The tool makes the work. A person carries what happens next. Only one of those is for sale. I laid it out in full in the first post, about the night sewage came through my ceiling.

Here's what the lawyer actually did for me.

It wasn't knowing the law. I could look that up. The machine could probably explain a noncompete better than most people.

For two and a half years it was somebody else's job to move that thing. A licensed somebody. With a name on the filings.

I didn't file anything. I didn't argue anything. I kept working and kept growing the business.

Now picture the machine doing that.

It writes you a confident answer and then it's done. It doesn't file. It doesn't show up. It doesn't carry anything for two and a half years.

Hold onto that. Everything below is a version of it.

Your Logo Came Out of a Machine. It Might Not Be Yours.

This is the part most people have never heard. It's the one that makes owners sit up.

That report came out in January 2025, after the Office read more than 10,000 public comments.

It's not a hot take. It's the agency that issues copyrights. And it builds on a policy statement they put out in March 2023 saying the same thing (US Copyright Office, 2023).

So run it forward.

You typed a good prompt. You got a logo you like. You put it on the truck.

The shop two towns over likes it too. They use it.

What do you swing at them with?

Not copyright, if the thing came out of the machine untouched. There's nothing there to enforce.

Two things make that less grim than it sounds. I want both on the page, because a scary story that is only half true is worth nothing.

One. Copyright does protect the human part. If you or a designer picked, arranged or changed the AI output, that part may be protectable on its own. Where the line falls is untested for almost everything a small business will hit, so nobody can tell you in advance whether your edits were enough. But doing the work matters.

Two. Trademark is a separate door. If your logo works as a trademark in your market, you may still be able to stop somebody using a confusingly similar one. None of the copyright question touches that. People mash those two together constantly.

Here's Where Everybody, Me Included, Is Guessing.

Your gut right now says you're being scared into buying something. That's a good instinct.

So here's where my own argument is weakest, before you have to ask.

The big AI copyright cases have gone in opposite directions.

• Thomson Reuters v. Ross, February 2025. A federal court rejected the fair use defense in an AI training case. First one ever. It's on appeal to the Third Circuit, so even that isn't finished.
• Kadrey v. Meta, 2025. A different federal court found Meta's training use was fair use, on the record in front of it. Same rule, opposite answer.
• Bartz v. Anthropic, August 2025. Settled for $1.5 billion over pirated training books, reported as the largest copyright settlement in US history. That settled the piracy question. Not the fair use question.
• Getty v. Stability in the US, the New York Times v. OpenAI, Andersen v. Stability. All still pending. No answers.

Two federal courts read the same rule and came out opposite. Anybody who tells you they know how this ends is selling something.

I don't know how it ends either.

What I know is that none of those cases are about you. They're about the companies that built the models.

Your exposure isn't the training data. It's the simpler question of what you can enforce on your own mark. And that part is already settled.

The Watermark Showed Up in the Picture. That's Not a Glitch.

The risk doesn't only run one way.

It isn't only that you might not own the picture. It's that the picture might have somebody else's mark in it.

In November 2025 the UK High Court ruled on Getty's case against Stability AI.

The court found trademark infringement where Stable Diffusion outputs reproduced Getty's watermarks. It called those findings extremely limited and historic, and made none of them against the newer models. Getty dropped its main copyright claims partway through the trial, having conceded it had no evidence the training happened in the UK, and the court rejected the secondary claim that was left. Getty was granted leave to appeal in December 2025 (Getty Images (US) Inc v Stability AI Ltd [2025] EWHC 2863 (Ch), 4 November 2025).

That's a British court and British law.

Here's why it matters to you. The machine doing it doesn't know what country it's in.

Marks from the training data showing up in the output is a property of the tool. Not of the country.

Some AI vendors say they'll cover you on copyright. That sounds like the answer until you read the exceptions.

• Adobe Firefly's cover does include trademark and publicity rights. Two catches. It only applies if you are a Creative Cloud teams or enterprise customer on a plan sold with it. And Adobe's total liability is capped at $10,000 per output or per claim (Adobe, Generative AI Product Specific Terms, effective April 23 2026, sections 8 and 8.4).
• OpenAI's Copyright Shield covers Enterprise and API tiers. Not the consumer tiers (OpenAI, Copyright Shield terms, as published today).

Read those two together and they stop in the same place. Both are written for companies on enterprise plans. Adobe's cover tops out at $10,000 even when it applies, and you are not on a plan where it applies.

Neither is anybody else reading this.

That Contact Form Made You a Promise You Didn't Know You Made.

This one touches every reader. Every one of you has a form.

Name, email, phone number. That's personal information.

It doesn't matter that you're in Florida. The law follows the resident, not the business. And you have no idea where the person filling in your form is sitting.

There are dollar figures for the fine floating around online. I chased them down. They all trace back to companies selling privacy policy generators. Not to any law I could check.

So I'm giving you the rule and no number. The rule is the real part.

Now here's what does not apply to you. I want to say it as loud as the part that does.

California's big privacy law is CCPA. It's the one everybody panics about.

It kicks in at about $26.6 million a year. Or the data of 100,000 California consumers. Or making half your money selling data (California Privacy Protection Agency, 2026).

You're not close to any of those three. Not the same ballpark.

Almost every scary privacy headline you've read in two years was about a law that has nothing to do with your business.

I'd rather tell you that than let you think otherwise. The one that does apply takes about an hour.

The mistake: thinking privacy law is only a problem for big companies, so none of it lands on you.

The fix: post a privacy policy that says what your form actually collects.

The payoff: the one privacy rule with no small business exception is handled. In an afternoon. Once.

Every State Has a Law About the Day It Leaks. All Fifty.

When customer data gets out, somebody has to tell the customers. That somebody is you.

The shape is the same everywhere even though the details aren't.

Some states put a clock on it. Others say without unreasonable delay, which means whatever a judge decides later. Most make you tell the state Attorney General once enough residents are hit.

I'm not publishing a state by state table. I'd have to check fifty laws to do that honestly and I haven't.

The shape is the uncontested part, and the shape is enough. It's your list. Your phone calls. Your Saturday.

And the platform's terms don't take that off you. There's no deal on a standard plan anywhere in this market where a builder or an AI tool takes on your breach. I went through the actual contract language in post 1, so I won't repeat it.

Two things I'm not going to tell you, and you'll see both elsewhere.

I'm not quoting the average small business breach cost. The figure everybody uses is IBM's, from 2023, and IBM stopped publishing the breakout for companies under 500 employees after that. Every article dating it 2024 or later is recycling a number that is three years old. I'd rather have no number.

And I can't point you at one confirmed small business breach caused by code written by AI. I looked. It isn't documented anywhere I'd stand behind. What is documented is code quality. Veracode's 2025 analysis had more than 100 AI models run 80 tasks writing code, and 45% of the results introduced a known security flaw (Veracode, 2025 GenAI Code Security Report). That's a real finding about how the code comes out. It is not a breach number and I'm not going to use it as one.

Check Three Things. It Takes Ten Minutes.

Ten minutes, no vocabulary. Each one answers a different question from above.

• Find your privacy policy and read it. Not just that a link exists. Open it. Does it describe what your form actually asks for? A generated policy that mentions cookies you don't set is a policy about somebody else's website. This is the one rule in this post with no small business exemption.
• Ask who touched the logo. Did a person change what the machine made, or did it come out and go straight on the truck? That one answer decides whether you own anything at all. If nobody knows, it came out untouched.
• Follow one form submission all the way through. Fill in your own contact form. Where does it land? An inbox, a plugin's database, some service, a spreadsheet somebody set up in 2021? Who else can see it? That's the list you'd be calling from on the bad day.

That's it. If all three come back clean, go run your business.

You are a plain talking helper for a small business owner. I am not asking for legal advice, I am asking you to compare two things.

Here are the fields on my website contact form: [LIST YOUR FORM FIELDS, for example name, email, phone, address, photo upload, describe your problem, preferred appointment date].

Here is the privacy policy currently on my site: [PASTE YOUR PRIVACY POLICY, or write NONE if you do not have one].

Do this and keep it short.
1) For each form field, say in one plain sentence what kind of information it is and who typically ends up able to see it.
2) Tell me which of those fields my policy already describes, and which ones it does not mention at all.
3) Tell me if my policy describes things I clearly do not do, like selling data or setting advertising cookies, so I can cut them.
4) Give me a short list of the plain English sentences my policy is missing based on what I actually collect.
5) Tell me the questions to ask whoever manages my site about where these submissions are stored and who has access.

Rules: short sentences, no legal jargon, no scare tactics, no scores. If something depends on my state or my setup, say so instead of guessing.

Where AI Genuinely Made Design Better.

I mean this one more than the other two.

AI dropped the cost of a website that looks decent to almost nothing.

A business that could never have afforded a designer now has something that doesn't look like 2009. That is not a small thing.

I've watched a lot of small businesses get judged on a website that made them look broke when they weren't. That particular injustice is mostly over.

The blank page is dead. Anybody can get to a first draft. I use AI image tools constantly and I'd be lost without them now.

Now the turn.

Cheap and good looking solved the part that was never the risk. Nobody ever lost their business because the header was ugly.

None of that improvement touched who owns the picture. Or who owes the visitor a policy. Or who makes the phone calls the week the data gets out.

The tool got a lot better at the visible part and didn't touch the invisible part at all. That gap is wider now than it was three years ago.

That's the whole reason this post exists.

Nobody Should Have to Learn Any of This. That's the Point.

You didn't get into your business to learn copyright law. Or privacy law. Or what your state does the week data leaks.

I didn't learn to run a lawsuit either. I found somebody who already knew how.

Your outcome here isn't legal literacy. It's four things being somebody else's job. The logo, the policy, the form, and the bad day.

Off your desk entirely.

And all four live in the site. That's the thing to see. Not in a policy you forgot to write. Not in a prompt you should have worded better. In the site. Which is why the fix isn't a checklist. It's a site built so those problems aren't in it. Fewer moving parts. Nothing bolted on that nobody's watching. One person responsible for all of it.

When something needs handling, it's mine to handle.

I wrote about exactly what a form plugin is plugged into if you want the version with the wiring exposed.

Let me show you what that looks like built on your own market.

Take a Test Drive →

You get a real look at your own market. No obligation, and nothing to cancel.

Want the whole playbook first? Plan your attack. Balls Out Marketing.

FAQ

This is post 3 of three about what AI hands you and what it doesn't. Post 1 was about the build, and who is on the hook for it. Post 2 was about what your site says, and how easy that got to fake. This one was about what your site owns and what it collects. Read them in that order and the argument builds.