Legal Red Flags in a PRD

Every PRD is a legal document in disguise. Feature descriptions, data requirements, and marketing claims all carry legal implications. Learning to spot red flags early saves months of rework.

The 10 Most Common PRD Red Flags

#### 1. Undefined Data Collection

❌ "Collect user data for personalisation"

✅ "Collect email and browsing history (retained 90 days) with explicit opt-in consent for recommendation personalisation"

#### 2. Absolute Accuracy Claims

❌ "AI guarantees 99% accuracy in fraud detection"

✅ "AI assists fraud analysts with flagging, achieving ~95% precision in testing (human review required)"

#### 3. Missing Consent Mechanisms

❌ "Users agree to data processing by using the app"

✅ "Granular consent dialog at first launch — separate toggles for analytics, personalisation, and marketing"

#### 4. Unverified Third-Party Data

❌ "Use publicly available data to train the model"

✅ "Use CC-BY licensed dataset from [source], verified for commercial use. Data provenance documented."

#### 5. No Data Retention Policy

❌ "Store all user interactions for future analysis"

✅ "Retain interaction logs for 180 days, then anonymise. User can request deletion via settings."

#### 6. Vague AI Decision-Making

❌ "AI automatically approves or rejects applications"

✅ "AI scores applications (0-100). Scores below 40 auto-rejected with explanation. Scores 40-70 routed to human reviewer."

#### 7. Missing Vendor Terms Review

❌ "Integrate with [API] for image generation"

✅ "Integrate [API] — ToS reviewed, confirmed: no training on our data, outputs owned by us, DPA signed."

#### 8. Dark Pattern UX

❌ "Pre-select premium plan at checkout"

✅ "Show all plans equally. No pre-selection. Clear comparison table with pricing."

#### 9. Cross-Border Data Without Compliance

❌ "Deploy globally"

✅ "Deploy in India and UAE. EU launch blocked pending GDPR DPA with cloud provider."

#### 10. No Grievance Mechanism

❌ (Feature ships without support flow)

✅ "In-app grievance form with 48-hour SLA. Grievance officer details on /contact page per CPA 2019."

Building Legal Sense in Sprint Planning

Add a Legal Risk Column to your sprint board:

Key Takeaway

Red flags are not reasons to kill features — they are reasons to design them properly. A legally-aware PM ships faster because they design it right the first time.