<- all tokdocs
2026.10.09@ducktate.com

The video warns you will get sued and names no case: its $2,500 is a CCPA penalty only California's Attorney General can collect, its $5,000 is CIPA statutory damages, and Newsom signed a bill narrowing that CIPA path nine days before the video posted

Business
Watch on TikTok

View on TikTok ->

The artifact is a 109.411995 second MP4 (QuickTime/MOV container, format_name=mov,mp4,m4a,3gp,3g2,mj2) at 720x1280, 30/1 fps, HEVC Main profile with the hvc1 tag at 335,392 bps video, AAC HE-AACv2 audio at 44,100 Hz stereo and 48,081 bps, 390,141 bps overall, 5,335,767 bytes on disk, pulled as format id bytevc1_720p_390137-1; ffprobe confirms every one of those numbers against metadata.json with no disagreement. It posted at epoch 1791562283, which is 2026-10-09T16:11:23Z, from uploader ducktate.com (uploader_id 7665287672349737997) under the channel nickname "Chris Ducktate", credited to track: "original sound" by artist: "Chris Ducktate" rather than a licensed track. The description is 38 characters and is a byte-for-byte copy of the title, "Getting sued for your vibe coded app??". At capture time, the metadata.json mtime of 2026-10-19 00:36:08 local, the counts read 141,800 views, 7,316 likes, 87 comments, 1,255 reposts and 7,959 saves. I read 25 of the 55 extracted frames (001, 005, 009, 011, 013, 015, 017, 019, 020, 021, 022, 024, 025, 026, 029, 031, 032, 033, 037, 040, 043, 048, 052, 053, 055) against 357 transcript words in 21 segments. Frame 001 at 0 s is not the speaker at all: it is a screenshot of an X search results page, tabs reading "Top / Latest / People / Videos / Photos", showing a verified account "Mr. Claude" at "@claudeskills101 · 1d" with the post text "WARNING: your vibe coded app can get sued for $100K.", with the burned-in caption "YOU CAN GET SUED FROM VIBE CODING??" over a man in a white cap and clear-framed glasses at a desk with a split mechanical keyboard, a Logitech mouse and a "REACT SUMMIT" mug. Frame 011 at 20 s and frame 013 at 24 s carry the series card "SOFTWARE ENGINEERING FOR VIBE CODERS" in orange and yellow arc text. Frame 019 at 36 s cuts to the Ducktate website Terms of Service, an 18-item contents list running from "1. Acceptance" through "6. Recording other people", "16. Dispute resolution and arbitration" and "18. Changes and contact", with section 1 beginning "These Terms of Service ("Terms") form a binding agreement between you and Gravitas AI LLC". Frames 024 and 025 at 46 s and 48 s show the GitHub mobile app on a repo whose search field reads "legal templates", listing "Pull Requests 4", branch "main" and "Commits 63", with the README headed "Legal Templates" and the body "Attorney-drafted legal templates for startups and technology companies. Created by the attorneys at General Legal and released under CC0 1.0. Free for anyone to use, modify, and distribute for any purpose, without attribution." Frame 026 at 50 s adds the card "2. GET TRACKING CONSENT". Frames 031 and 032 at 60 s and 62 s show posthog.com with a "Get started – free" button, an "Ask PostHog anything" demo whose composer reads "Why are signups growing, but paid conversions fall" above a model selector reading "Default · Claude Sonnet 5 High" and chips including "Session replay" and "Product analytics", with a bottom banner headed "Legally-required cookie" reading "PostHog.com doesn't use third-party cookies, only a single in-house cookie. No data is sent to a third party. (Ursula von der Leyen would be so proud.)". Frame 037 at 72 s adds "3.PROTECT THE DATABASE". Frames 052 and 053 at 102 s and 104 s show ducktate.com with a duck logo, a "Reserve my seat" button, the headline "What if Cursor already knew everything you said, heard, and typed?", the line "Ducktate is one workspace for your dictation, meeting notes, and action items. It formats that context so any AI agent knows exactly what is going on.", a menu reading "Why this exists / What is possible / Pricing / Learn / Prompts", and the caption "DUCKTATE.COM". Spoken, the argument is that an app shipped with an AI coding tool can draw legal exposure before it earns revenue, and that three things fix most of it: terms of service plus privacy policy plus cookie notice, tracking consent before analytics and session replay, and database access control. No terminal, no code editor, no SQL, no Supabase or database console, no consent banner implementation and no court document appears in any of the 25 frames I read; the only screen evidence is the X screenshot, the Ducktate Terms page, the GitHub README, the PostHog marketing page and the Ducktate homepage. The transcript ends cleanly: the last segment runs 108.46 s to 109.24 s, inside the 109.479184 s of audio.mp3 and the 109.40 s video stream, so there is no Whisper hallucination past the end of audio in this file.

The video never names a lawsuit, and the only legal citation on screen is an X post I could not retrieve

At 0.00 s the video opens with "I've been hearing a lot about how Claude can Vibecode your app in a weekend, but you can actually get sued before you make your first dollar." At 6.96 s it continues: "Honestly, they're right." The "they" is visible in frame 001, a screenshot of an X search results page showing a verified account displaying as "Mr. Claude" at the handle "@claudeskills101", posted "1d" before the capture, reading "WARNING: your vibe coded app can get sued for $100K."

Across the full 109 seconds and all 21 transcript segments, no case name, no docket number, no court and no filing date is spoken or shown. The $100K figure never reappears in the audio and is never defended. It exists only as the screenshot in frame 001.

I tried to retrieve the underlying post. https://x.com/claudeskills101 returned HTTP 402 Payment Required, so I could not confirm the account exists, confirm the post text, confirm the date, or find any case the post might be describing. A web search for the handle and the $100K claim returned nothing matching. The X page is a source I could not reach, so I am not citing it and the $100K number stays Unverified.

What the video does cite are two statutory ceilings, $2,500 and $5,000. Both are real California numbers. Neither one is a lawsuit, and only one of them is something a private person can sue you for. The sections below trace each to its statute.

The $2,500 figure is California Civil Code 1798.155, a civil penalty only the Attorney General can collect, and it does not attach to "not having a terms of service"

At 32.70 s the video says "I got all of these documents done before I even wrote one line of code for duct tape", and at 38.48 s: "Because having some of these documents not prepared can cost up to $2,500 per violation."

The $2,500 traces to California Civil Code section 1798.155, the CCPA civil penalty provision. The statutory text makes a business that fails to cure within 30 days "liable for a civil penalty of not more than two thousand five hundred dollars ($2,500)" per violation, rising to "$7,500 for each intentional violation". Two details in that same section break the video's framing.

First, the enforcement mechanism. Section 1798.155 provides for a "civil action brought in the name of the people of the State of California by the Attorney General", with penalties deposited in the Consumer Privacy Fund. That is a regulator action, not a user suing you. The video's hook is "you can actually get sued", and the number it reaches for is a government penalty, not private damages. California's private right of action under the CCPA sits in a different section, 1798.150, is limited to unauthorized access following a failure to maintain reasonable security, and carries statutory damages of $100 to $750 per consumer per incident rather than $2,500.

Second, the trigger. Section 1798.155 penalizes CCPA violations such as failing to give notice at collection or failing to honor an opt-out request. There is no provision in it that fines a business for lacking a document titled "terms of service". The privacy policy and the notice obligations are where the CCPA bites; the cookie notice matters because of how trackers get disclosed and opted out of, not because the file exists.

The amount is also stale as stated. Multiple compliance and law-firm sources report that under Civil Code section 1798.199.95(d) the California Privacy Protection Agency adjusts these amounts for inflation in odd-numbered years, and that the operative figures since 1 January 2025 are $2,663 and $7,988, with the next adjustment due January 2027. I could not fetch a primary CPPA publication of those adjusted amounts, because leginfo.legislature.ca.gov and law.justia.com both returned HTTP 403, so only the statutory $2,500 and $7,500 are sourced here.

For scale on what California enforcement actually costs, the agency's 3 March 2026 decision against PlayOn Sports carried a $1.10 million fine for using tracking technologies and requiring Californians to "click 'agree' to these tracking technologies before they could use their tickets or view PlayOn Sports' websites, without providing a sufficient way to opt-out", plus failing to honor opt-out preference signals. That is the real shape of the risk: a per-violation ceiling multiplied across a user base by a regulator, not a single $2,500 invoice.

The $5,000 figure is CIPA statutory damages under Penal Code 637.2, and California narrowed that path on 30 September 2026, nine days before this video posted

At 55.76 s the video says "If you are using an app like PostHoc to get analytics and do session replay, you need to make sure that that session replay is turned off", and at 67.24 s, "Violations for this can be up to $5,000 per violation."

"PostHoc" is a Whisper mis-transcription of PostHog, confirmed by frames 031 and 032 which show the posthog.com homepage with the PostHog wordmark.

The $5,000 is California Penal Code section 637.2, the civil remedy attached to the California Invasion of Privacy Act. Subdivision (a) sets damages at "Five thousand dollars ($5,000) per violation" or "Three times the amount of actual damages, if any, sustained by the plaintiff". Subdivision (c) is why it drives litigation: "It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages." A plaintiff does not have to show a dollar of harm to reach the $5,000 floor, which is exactly why session replay, chat widgets and ad pixels have drawn class actions under a 1967 wiretapping statute.

The number is real and it genuinely is a private suit, so the video's framing is correct here. What it misses is that the law changed nine days before it posted. Governor Newsom signed Senate Bill 690 on 30 September 2026. SB 690 amends section 637.2 itself to provide that only the California Attorney General, not private plaintiffs, may bring an action for violations of Penal Code section 638.51, California's pen register and trap and trace provision, which had become the favored theory in website tracking suits. The operative date is 1 January 2027, and the bill applies retroactively to pending claims in actions commenced within two years before that date.

The narrowing is partial, and the video's warning survives it. Claims under sections 631 and 632, the wiretapping and eavesdropping provisions, are unaffected and remain available to private plaintiffs, carrying the same $5,000 per violation remedy through 637.2. So the figure still holds in October 2026, against a legal landscape that had materially shifted the week before and that the video does not mention. Worth adding: SB 690 as introduced carried a broad "commercial business purpose" exemption that would have insulated most ordinary analytics from CIPA entirely, and that exemption was stripped by amendment on 2 July 2026 in favor of the narrow pen-register carve-out that became law.

PostHog session replay is off until you switch it on, which inverts the video's instruction, and his own privacy policy says so

At 55.76 s the video tells viewers to "make sure that that session replay is turned off", then hedges at 63.42 s: "If you are not getting consent, I'm pretty sure it's even turned off by default."

The hedge is right and the instruction is backwards. PostHog's own JavaScript library documentation states: "To set up session replay in your project, all you need to do is install the JavaScript web library and enable 'Record user sessions' in your project settings." Session replay is not something you arrive at switched on and have to remember to disable. It is a project-level toggle you must deliberately flip, and PostHog's docs on controlling which sessions you record add that "Calling these methods will have no effect if session recordings are disabled in your PostHog Project Settings." The disable_session_recording config option exists for SDK-side control, but the project setting gates everything above it.

The wording matters. "Turn it off" implies a dangerous default that does not exist, while "do not turn it on until you have consent" is the actual operating instruction and the one that maps to the CIPA exposure above.

PostHog's privacy controls page is narrower than the video implies in a second way. It covers masking, stating that input elements are masked by default because any input "is highly likely to contain sensitive text such as email or password", while "General text is not masked by default". That page never mentions GDPR, CCPA or consent. It is technical masking documentation, so a vibe coder who reads it and stops there has not addressed the legal question.

The speaker's own product gets this right, which makes the on-camera instruction odder. The Ducktate privacy policy states that PostHog session recording is off, that the Mac app has no session recording, and that for EEA visitors "PostHog and Google Analytics do not load until you select Accept". That last line is the consent gate the video is arguing for, and it is scoped to the EEA, which points at the GDPR rather than at either California statute he cites. Under GDPR Article 83(5), the ceiling for serious infringements is "up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher". Neither of the two numbers the video quotes is the European one, and Europe is where the consent-before-loading rule he implemented actually comes from.

"Role-level security" is row-level security, and the vibe-coding database risk has a real CVE behind it

At 79.80 s the video says "We are talking about role-level security, the understanding between authorization and authentication", with frame 043 at 84 s showing the caption "AUTHENTICATION".

The term is row-level security. PostgreSQL's documentation defines it: "In addition to the SQL-standard privilege system available through GRANT, tables can have row security policies that restrict, on a per-user basis, which rows can be returned by normal queries or inserted, updated, or deleted by data modification commands. This feature is also known as Row-Level Security." It is enabled with ALTER TABLE ... ENABLE ROW LEVEL SECURITY, and once enabled a default-deny policy applies, so no rows are visible until a policy permits them. Roles are a separate Postgres concept. A viewer who searches the phrase the video actually used will land in the wrong part of the manual.

The underlying warning is well founded and has a primary citation the video does not give. CVE-2025-48757, published 2025-05-30 with a CVSS 3.1 base score of 9.3 (Critical), reads: "An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application." That is the exact failure mode the video describes at 95.20 s, "if you have a data leak, you can pretty much shut down your whole business", attached to a specific product, a specific severity score and a specific supplier dispute.

The authorization versus authentication distinction the video raises in the same breath is correct and worth keeping: authentication establishes who the caller is, row-level security decides which rows that caller may touch, and an app that does the first and skips the second is the CVE-2025-48757 shape.

The open source repo is General-Legal/legal-templates, and Ducktate's own policy documents are dated the day this video posted

At 44.92 s the video says "Even an open source repo that has all of the legal templates, I will put it in the checklist at the end", with frames 024 and 025 showing the README.

The repo is General-Legal/legal-templates, described as a "Public collection of high-quality templates created by General Legal attorneys with CC0 license". The GitHub API confirms what frame 024 shows: license CC0-1.0, branch main, 63 commits matching the frame's "Commits 63", created 2026-04-25, last pushed 2026-09-22, 3,282 stars and 6 open issues. The README ships twelve templates, including Cookie Notice, Privacy Policy (U.S. Only), Privacy Policy (GDPR Enhanced) and Terms of Use. Two of the three documents the video names at 25.12 s, "your terms of service, your privacy policy, your cookie notice", appear there under those names, with Terms of Use standing in for Terms of Service. Anyone following the video to the repo will find what they were promised.

The claim at 32.70 s is harder to check. The video says the documents were done "before I even wrote one line of code for duct tape", which is Whisper's rendering of Ducktate, confirmed by frames 052 and 053 showing ducktate.com and the caption "DUCKTATE.COM". The live Ducktate Terms of Service and privacy policy both display "Effective 2026-10-09 · Last updated 2026-10-09", the same calendar day the video posted at 2026-10-09T16:11:23Z, and both name Gravitas AI LLC of West Palm Beach, Florida, matching frame 019. A same-day effective date is consistent with a revision published alongside the video and does not prove when drafting happened, so I am not calling the claim false. What is verifiable is that the public documents carry the video's own publication date, and that Ducktate was still pre-launch at that moment, since frames 052 and 053 show "Reserve my seat" as the primary call to action.

The end-card promise at 102.82 s, "I put it in duct tape.com under learn with all the prompts", resolves. Ducktate Learn hosts seven free courses, one of which is "Launch Readiness", an eleven-stage pre-launch checklist covering data protection, third-party dependencies, privacy policies, tracking consent, sensitive data, accessibility, AI disclosure, user content, subscriptions, email compliance and agent audit practices, carrying the disclaimer that it is "not legal advice". The page I fetched states neither the $2,500 nor the $5,000 figure, cites no statute numbers, and does not link the General Legal repo, so the video's two numbers are not backed up at the destination it sends viewers to.

One screen detail is worth recording rather than guessing at. Frame 031 shows PostHog's AI composer with a model selector reading "Default · Claude Sonnet 5 High". Anthropic's current models overview lists Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5 and Claude Haiku 5.5 as the current lineup, with Claude Sonnet 5 among the legacy models still available, so the screenshot names a model that exists and is still served rather than the newest one. That is a detail of PostHog's product, not a claim the video makes.

Key Takeaways

  • Verified: California Penal Code 637.2(a) sets CIPA damages at "Five thousand dollars ($5,000) per violation" or treble actual damages, and 637.2(c) states actual damages are not a prerequisite, so the video's $5,000 session-replay figure is correct and is genuinely a private lawsuit.
  • Verified: California Civil Code 1798.155 sets a civil penalty of "not more than two thousand five hundred dollars ($2,500)" per violation and $7,500 per intentional violation, so the video's $2,500 figure traces to a real statute.
  • Correction: The video says missing documents "can cost up to $2,500 per violation" in a segment framed as getting sued. Section 1798.155 provides for a "civil action brought in the name of the people of the State of California by the Attorney General", so that money is a regulator penalty. The CCPA private right of action is section 1798.150, limited to breaches following a failure to maintain reasonable security, at $100 to $750 per consumer per incident.
  • Correction: At 55.76 s the video says to "make sure that that session replay is turned off". PostHog's JavaScript docs say the opposite default: "all you need to do is install the JavaScript web library and enable 'Record user sessions' in your project settings". Replay is off until you enable it, so the instruction is "do not enable it without consent", not "turn it off".
  • Correction: At 79.80 s the video says "role-level security". PostgreSQL calls the feature Row-Level Security, enabled with ALTER TABLE ... ENABLE ROW LEVEL SECURITY, with a default-deny policy once enabled.
  • Context: Governor Newsom signed SB 690 on 30 September 2026, nine days before this video posted. It amends Penal Code 637.2 so that only the Attorney General may sue for Penal Code 638.51 pen register violations, operative 1 January 2027 and retroactive to pending claims filed within two years prior. Claims under sections 631 and 632 are unaffected, so the $5,000 exposure the video describes survives, in a narrower form the video does not mention.
  • Context: The broad "commercial business purpose" exemption in SB 690 as introduced, which would have gutted CIPA website-tracking claims, was removed by the 2 July 2026 amendment and is not law.
  • Clarification: CVE-2025-48757, published 2025-05-30 at CVSS 9.3 Critical, describes "An insufficient database Row-Level Security policy in Lovable through 2025-04-15" allowing unauthenticated reads and writes to arbitrary tables of generated sites, and is disputed by the supplier. That is the concrete citation behind the video's unsourced database warning.
  • Clarification: The repo shown in frames 024 and 025 is General-Legal/legal-templates, CC0-1.0, 63 commits, 3,282 stars, created 2026-04-25 and last pushed 2026-09-22, shipping twelve templates including Cookie Notice, Privacy Policy and Terms of Use.
  • Clarification: The consent gate the video argues for is European in origin. The Ducktate privacy policy states that for EEA visitors "PostHog and Google Analytics do not load until you select Accept", and GDPR Article 83(5) caps serious infringements at "up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover", a ceiling the video never mentions.
  • Partial correction: The statutory $2,500 and $7,500 are adjusted for inflation in odd-numbered years under Civil Code 1798.199.95(d), and multiple compliance sources report the operative amounts since 1 January 2025 are $2,663 and $7,988. I could not reach a primary CPPA publication of those figures, so only the statutory amounts are sourced here.
  • Unverified: The "$100K" in frame 001 comes from an X post attributed to "Mr. Claude" at @claudeskills101. Fetching x.com/claudeskills101 returned HTTP 402 Payment Required and a search for the handle and claim found nothing matching, so the account, the post and the figure are all unconfirmed.
  • Unverified: The claim at 32.70 s that the legal documents were finished "before I even wrote one line of code" for Ducktate. The live Terms of Service and privacy policy both read "Effective 2026-10-09 · Last updated 2026-10-09", the same day the video posted, which is consistent with a revision published alongside the video and does not establish the original drafting date either way.
  • Context: No case name, docket number, court or filing date appears anywhere in the 109 seconds or in any of the 25 frames I read. No terminal, code editor, SQL, database console or consent-banner implementation appears either, so nothing in the video demonstrates the engineering work it recommends.

Resources

Published October 9, 2026. Writeup generated from a favorited TikTok.