# 01 — Positioning & Value Proposition

Copy fails at the strategy layer more often than the sentence layer. A
beautifully written page arguing the wrong thing to the wrong reader converts
worse than a plain page arguing the right thing.

## 1. Audience before adjectives

- Name the **primary reader** of each asset: role, situation, and the job
  they're hiring the product for (jobs-to-be-done framing). "Developers" is
  not an audience; "a backend engineer evaluating error-tracking tools after
  an incident" is.
- **Awareness stage dictates the opening** (classic Schwartz ladder, still
  the working model):

  | Reader state | Copy leads with |
  |---|---|
  | Unaware of the problem | The symptom they *do* feel |
  | Problem-aware | The problem, named precisely, then the category |
  | Solution-aware | Why this approach beats the alternatives |
  | Product-aware | Differentiation, proof, and the offer |
  | Ready to buy | The offer, friction removal, reassurance |

- One asset, one primary audience. A page addressing the engineer, the
  buyer, and the compliance officer in the same scroll serves none — split
  pages or split sections explicitly ("For security teams").
- Write in the reader's vocabulary, at the reader's expertise level:
  developer audiences trust precise terminology ("idempotent retries") and
  distrust dumbed-down gloss; buyer audiences need the outcome translated to
  business terms. Mirroring the words users actually say (support tickets,
  reviews, interviews) beats inventing marketing language.

## 2. Value proposition: the sentence everything else serves

- The working template (fill it before writing anything else):

  ```text
  For [audience] who [situation/problem],
  [product] is a [category] that [key outcome].
  Unlike [reference alternative], it [primary differentiator].
  ```

  The template is scaffolding — it rarely ships verbatim, but every published
  headline/subheadline pair must be derivable from it.
- **Category anchoring**: name a category the reader already understands,
  then differentiate — "error tracking that fixes itself" beats a novel
  category no one searches for. Inventing a category is a strategy decision
  with a marketing budget attached, not a copy flourish.
- The **reference alternative is whatever the reader does today** — often a
  spreadsheet, a script, or nothing — not necessarily a competitor.
- One primary value proposition per product per audience. Three "equally
  primary" benefits means positioning hasn't been decided; copy can't fix
  that upstream ambiguity.

## 3. Benefit first, feature as proof

- Every section passes the **"so what?" test** from the reader's chair:
  feature → so what? → benefit → so what? → outcome they care about. Stop at
  the first level the reader values, and lead with it.

  ```text
  Feature-first (weak):  256-bit AES encryption at rest.
  Benefit-first (strong): Your customer data stays yours — encrypted at rest
                          (AES-256), so a stolen disk is a non-event.
  ```

- **Features are the evidence, not the argument** — cut neither. Benefit-only
  copy reads as vapor to technical buyers; feature-only copy outsources the
  thinking to the reader. The pairing is the craft.
- The **flipped-pronoun test**: if a section says "we/our" more than
  "you/your", it's an about-us page in disguise. "We provide advanced
  analytics" → "You see which feature drove the churn".
- Quantify benefits where substantiation exists ("cuts build times ~40%" with
  the benchmark linked — `rules/04` §1); where it doesn't, stay qualitative
  rather than inventing precision.

## 4. Message hierarchy & message match

- Structure the argument: **primary promise → 3±1 supporting benefits →
  proof for each → objection handling → action.** Everything on the page maps
  to a node in that tree; orphan sections ("Our story", mid-funnel) get cut
  or moved.
- **Message match end-to-end**: the ad/post/email that brought the reader,
  the landing headline, and the CTA describe the same promise in the same
  vocabulary. A click on "Ship dashboards in minutes" that lands on
  "Enterprise BI platform" bounces — audit the full path, not the page alone.
- Objection handling is copy's job, placed at the objection's moment:
  pricing fears near the CTA ("free tier, no card"), migration fear near the
  integration section, security questions linked to real documentation
  (`sota-docs-workflow`), not a vague "enterprise-grade security" badge.

## 5. Differentiation without fiction

- **Specific beats superlative**: "answers in under 50 ms at p99" out-converts
  and outlives "blazingly fast". Superlatives ("best", "#1", "fastest") are
  objective claims requiring evidence (`rules/04` §1) — default to cutting
  them.
- "Only/first" claims are the highest-risk sentences on the site: verify
  against the market at publish time and re-verify on a schedule; a false
  "only" is both a legal exposure and a one-tweet credibility loss.
- Legitimate differentiation sources when the feature grid ties: the
  approach/architecture, the pricing model, the support reality, the
  ecosystem, who it's deliberately *not* for. Saying who it's not for is
  under-used and highly credible.
- Never differentiate by naming competitors' weaknesses you can't prove —
  comparative claims carry the same substantiation burden plus higher legal
  risk (`rules/04` §1). Factual comparison tables: `rules/02` §6.

## 6. Evidence: the proof layer

Rank evidence by credibility to a skeptical reader, and prefer the top:

1. **Verifiable numbers with sources** — benchmarks with methodology, public
   case-study metrics, usage stats you can substantiate.
2. **Named customer outcomes** — "Acme cut incident response 60%" with a
   linked case study and the customer's consent.
3. **Named testimonials** — real person, name/role/company, consented
   (`rules/04` §3).
4. **Logos** — with permission; a logo wall implies endorsement.
5. **Aggregate claims** — "10,000+ teams" only if the number is real and the
   unit honest (free signups ≠ "teams trust us").

Unranked non-evidence: anonymous quotes ("— CTO, Fortune 500"), star ratings
without sources, "award-winning" without naming the award.

## Audit checklist

- [ ] Each major asset names (in a brief or comment) its primary audience,
      awareness stage, and single conversion goal
- [ ] The value proposition is written down in template form and every
      headline/subheadline derives from it
- [ ] Category anchor present; differentiator framed against what the reader
      does today
- [ ] "So what?" test passes on every section: benefit stated, feature
      attached as proof — no feature-list-only sections, no proof-free
      benefit sections
- [ ] Flipped-pronoun test: you/your dominates we/our —
      `grep -ciE '\b(we|our)\b' page.md` vs `\b(you|your)\b` as a smoke test
- [ ] Message match verified across ad/email → landing page → CTA for the
      top acquisition paths
- [ ] Objections handled at their moment (pricing, migration, security) with
      links to real docs, not adjective badges
- [ ] Zero unsubstantiated superlatives/only/first claims:
      `grep -riE '\b(best|#1|leading|fastest|only|first|world-class|revolutionary)\b' site/`
      — every hit has evidence on file or gets cut (`rules/04`)
- [ ] Every proof element is top-3-tier where possible; no anonymous quotes,
      sourceless stats, or unnamed awards
- [ ] Aggregate numbers ("10,000+ users") match an internal source of truth
      and an honest unit

# 02 — Headlines, Landing Pages & CTAs

The page is an argument with a layout. Structure carries skimmers; sentences
carry readers; the CTA carries the conversion. All three are copy problems.

## 1. Headlines

- **Draft ≥5 variants, pick against the 4 U's heuristic** (useful, urgent,
  unique, ultra-specific — a scoring lens, not a law): most first-draft
  headlines fail "useful" by describing the product instead of the outcome.

  ```text
  Weak:   The modern platform for data teams.        (no outcome, no specificity)
  Better: Ship trusted dashboards in minutes.        (outcome + speed)
  Strong: Ship dashboards your CFO trusts — without  (outcome + audience + objection
          waiting on data engineering.                pre-handled)
  ```

- **Clarity beats cleverness, every time it's tested**: a pun the reader must
  decode costs the 3 seconds you had. Wordplay is affordable only when the
  meaning survives without it.
- The **subheadline does the explaining**: headline = promise, subheadline =
  mechanism + who it's for ("Automated data tests catch broken pipelines
  before your stakeholders do — built for dbt-based teams").
- Headline vocabulary comes from the value proposition (`rules/01` §2) and
  the reader's own words — reusing the phrase users say in interviews
  measurably outperforms invented phrasing (message-mining).
- Numbers and specifics earn attention honestly: "Cut CI time 40%" (with the
  benchmark — `rules/04`) beats "Dramatically faster CI".

## 2. The above-fold contract

A first-time visitor, without scrolling, can answer:

1. **What is it?** — category anchor in headline/subheadline.
2. **Is it for me?** — audience named or unmistakably implied.
3. **What do I do next?** — one primary CTA visible.
4. *(Trust flash)* — one proof element (logo strip, star rating with source,
   key number) in the first viewport.

- Everything else — features, story, second CTA styles — is below-fold
  material. An above-fold carousel of rotating value propositions is
  indecision rendered in HTML.
- The visual/layout execution (hierarchy, contrast, responsive behavior) is
  `sota-frontend-design`; the *content* of the contract is owned here.

## 3. Page flow & scannability

- Classical flow — attention → interest → desire → action (AIDA as a
  heuristic frame, not a template): hook with the promise, build with
  benefits+proof, resolve objections, ask. Long pages repeat the ask.
- **The skim test is the gate**: read only the headings — they must tell the
  entire argument in order. Section headings are mini-headlines
  ("Catch breaking changes before merge"), never labels ("Features",
  "Benefits", "Why us").
- Paragraphs ≤ 3 sentences on marketing pages; one idea each. Bullets for
  parallel items (3–5, parallel grammatical structure); bold for the one
  load-bearing phrase per screen, not per sentence.
- Front-load every heading and bullet — the first three words are what a
  scanner reads (same law as product copy: `sota-ux-writing` rules/01 §2).
- Reading-ease scores (Flesch etc.) are directional diagnostics for
  general-audience pages, not gates — technical audiences read technical
  sentences fine; what they won't read is *long* sentences stacked deep.

## 4. CTAs

- **Verb + outcome**: "Start free trial", "Get the report", "Book a demo".
  Banned: "Submit", "Click here", solitary "Learn more" (acceptable only as
  a *secondary* link with a named object: "Learn more about pricing").
- **One primary action per page**, visually singular; a secondary
  lower-commitment path (docs, demo video) may exist but never competes.
  Three equal buttons = the team couldn't decide = the visitor won't either.
- **Friction reducers adjacent to the CTA** — the objection dies where it's
  born: "Free 14-day trial · No credit card · Cancel anytime". Every friction
  reducer is a factual claim: verify or delete (`rules/04` §1).
- Match commitment to awareness stage (`rules/01` §1): "Book a demo" atop a
  cold-traffic page skips the relationship; "Read the benchmark" might be
  the right first ask.
- First-person phrasing ("Start my trial") and micro-copy under the button
  are testable variants, not defaults — test against your traffic rather
  than cargo-culting someone's A/B result.
- Long pages: repeat the CTA after each major proof section; same wording
  each time (varying the verb reads as different actions).

## 5. Social proof on the page

Placement and presentation (the legal layer — consent, material connections,
typicality — is `rules/04` §2–3):

- **Specific outcomes beat adjectives**: "Cut our incident response from 45
  to 12 minutes" beats "Great tool, highly recommend!". Solicit and select
  testimonials for specificity.
- Full attribution (name, role, company, photo/logo where consented)
  proportionally to the claim's weight — the bigger the claim, the more
  verifiable the source must look *and be*.
- Place proof at the objection it answers: security testimonial by the
  security section, migration story by the integration section — not a
  quarantined "wall of love".
- Logo walls: recognizable > numerous; with permission; "as seen in" press
  logos only for actual coverage, not paid placements presented as earned.
- Counts ("Trusted by 10,000+ teams") follow the honest-unit rule
  (`rules/01` §6).

## 6. Pricing & comparison surfaces

- **Pricing pages are trust pages**: real prices where the model allows;
  "Contact us" only for genuinely custom tiers. Every "what happens at the
  limit / after the trial / when I cancel" question answered on the page —
  each unanswered one is a support ticket or a lost conversion.
- No hidden-cost surprises deferred to checkout (also a dark pattern —
  `rules/04` §4): required add-ons, per-seat minimums, and billing frequency
  are visible at the decision point.
- **Comparison pages/tables are factual documents**: current competitor
  facts at publish time (dated, re-verified on a schedule), objectively
  phrased rows, no strawman tiers. Comparative claims carry full
  substantiation burden (`rules/04` §1) — a stale "Competitor X lacks SSO"
  is a liability, not an asset.
- Anchor honestly: "Most popular" marks the actually-most-chosen tier, not
  the one you want to sell.

## Audit checklist

- [ ] Headline states an outcome, not a product description; ≥5 variants
      were considered (in the draft PR/brief); subheadline explains mechanism
      + audience
- [ ] Above-fold contract holds on mobile and desktop: what/for-whom/next
      action + one proof element, no carousel of rotating value props
- [ ] Skim test passes: headings alone tell the argument; no "Features"/
      "Why us" label headings
- [ ] Paragraphs ≤ 3 sentences; bullets parallel; bold ≤ 1 phrase per screen
- [ ] Every CTA is verb+outcome; grep the ban list:
      `grep -riE '>(Submit|Click here|Learn more)<' site/` — bare hits fixed
      or given named objects
- [ ] One primary CTA per page; repeated verbatim on long pages; commitment
      level matches traffic temperature
- [ ] Every friction reducer ("no credit card", "cancel anytime",
      "5-minute setup") verified true in the product today
- [ ] Testimonials specific and fully attributed; proof placed at the
      objection it answers; press/"as seen in" logos reflect earned coverage
- [ ] Pricing page answers limit/trial/cancel questions; no costs revealed
      only at checkout; "Most popular" is factually most popular
- [ ] Comparison tables dated, sourced, re-verification scheduled; no
      unprovable competitor claims

# 03 — SEO Content

Search-facing content lives under two masters: the reader and the ranking
systems' spam policies. The 2026 reality: Google's systems reward demonstrated
first-hand value ("people-first" content, E-E-A-T signals) and name-and-punish
the shortcuts — scaled AI-generated filler, borrowed-reputation hosting,
doorway pages. Writing for the reader *is* the ranking strategy; this file
makes that operational.

## 1. Search intent before content

- Classify the target query's intent and match the **format**, not just the
  topic: informational (guide/answer), commercial-investigation (comparison,
  "best X for Y"), transactional (product/landing page), navigational (leave
  it alone — that traffic isn't yours).
- **Read the current SERP as the spec**: what format ranks (listicle? docs
  page? video?) tells you what searchers accept for that query. Publishing a
  2,000-word essay against a SERP of quick-answer pages is a format mismatch,
  not a quality problem.
- One page per intent; don't split one intent across near-duplicate pages
  (they cannibalize), don't fuse two intents into one page (it half-serves
  both).
- Answer the query in the first screen, then earn the scroll with depth —
  burying the answer under 800 words of preamble ("what is X?" recipes-blog
  style) is reader-hostile and increasingly rank-hostile.

## 2. People-first content & E-E-A-T

Google's guidance frames the bar as people-first content with demonstrated
**experience, expertise, authoritativeness, trust** (E-E-A-T). Operationally:

- **Show first-hand experience**: real screenshots of you using the thing,
  measured results, edge cases you hit, opinions with reasons. Content
  assembleable entirely from the top-10 existing results adds nothing and
  ranks accordingly.
- **Real authorship**: named authors with verifiable bios for content where
  expertise matters; fabricated author personas with stock photos are
  E-E-A-T fraud and a trust time-bomb.
- **Cite primary sources** for claims — specs, papers, official docs, your
  own data (methodology included). Citing other blog posts citing other blog
  posts is the content equivalent of a dependency chain with no source.
- **Honest dates**: publish date + a true "updated" date when materially
  revised. Bumping dates without changes to look fresh is a trust dark
  pattern search systems are wise to.
- Trust surfaces: contact page, about page, editorial/AI-usage policy for
  publications — the boring pages are ranking infrastructure.

## 3. Spam policies: the named failure modes

Google's spam policies (developers.google.com/search — spam policies doc)
name these; violating them risks the page *and* the domain:

- **Scaled content abuse** — many pages generated (by AI or humans) primarily
  to rank, adding little value: mass "X vs Y" permutation pages, thin
  location pages, stitched/scraped aggregations. The test is value-added per
  page, not how it was produced.
- **Site reputation abuse** — third-party content hosted mainly to ride the
  host's ranking signals ("parasite SEO": coupon/review sections rented out
  on a news domain). If you're the host, it's your domain at stake.
- **Doorway pages** — near-duplicate pages funneling to the same destination.
- **Keyword stuffing** — and its modern denial: there is **no keyword-density
  target**; that metric is folklore. Use the topic's natural vocabulary
  (searchers' terms, synonyms, the entities involved) because you're actually
  covering the topic.
- **Misleading structured data** — schema.org markup must describe visible
  page content; review stars on markup the page doesn't show is a manual-
  action magnet.
- Expired-domain abuse, link schemes, hidden text: same doc, same answer —
  don't.

## 4. The mechanical layer: titles, metas, headings, links

- **Title element**: the page's promise, front-loaded, unique per page, and
  truthful — search engines rewrite titles that don't match content, and the
  rewrite is worse than your honest version. Length limits are *pixel-based
  display truncation*, not ranking rules; "~50–60 characters" is a display
  heuristic only.
- **Meta description**: doesn't rank; it's your ad copy in the SERP — state
  the benefit + what the reader gets, and accept engines substitute their own
  snippet when they think they know better (~155 characters as display
  heuristic).
- **Heading hierarchy is the document outline**: one H1 stating the topic,
  H2s that answer the sub-questions searchers actually ask (they're your
  skim-test — `rules/02` §3 — and your featured-snippet candidates).
- **Internal links with descriptive anchors** ("zero-downtime migration
  guide", not "read more") from and to related content — orphan pages
  neither rank nor pass value. External links to your primary sources are a
  trust signal, not a leak.
- URL slugs: short, readable, stable — a slug is an API (`sota-api-design`
  versioning instincts apply: redirects on change, never break inbound
  links).

## 5. AI-assisted content discipline

- AI assistance is legitimate; **unreviewed AI output published at scale is
  scaled content abuse** (§3) plus an accuracy liability. The gate: a human
  with domain knowledge verifies every factual claim, adds first-hand value
  (experience, data, opinion), and owns the byline.
- LLMs fabricate specifics — statistics, citations, quotes, product
  capabilities. **Every number and citation in AI-drafted content gets
  primary-source verification** before publish (`rules/04` §1 machinery).
- Don't fabricate the experience signals: fake "we tested this for 3 weeks"
  framing around untested content is deception, indistinguishable from the
  fake-review problem (`rules/04` §3).
- Disclose AI usage where your editorial policy, platform, or jurisdiction
  requires it; a published AI-usage policy is becoming a standard trust
  surface for content sites.

## 6. Generative AI search surfaces (AI Overviews / AI Mode)

Google's own guidance ("Guide to Optimizing for Generative AI Features",
developers.google.com/search) is blunt: AI Overviews and AI Mode are rooted in
the core Search ranking and quality systems, so **"GEO"/"AEO" is still SEO** —
§1–§5 of this file *are* the optimization strategy.

- **Debunk the folklore before someone bills you for it**: Google does not
  read `llms.txt` or other AI text files ("neither harm nor help"); there is
  no need to chunk content into AI-sized pieces, rewrite "for AI", or add
  special schema.org markup for AI visibility. Vendors selling these as
  Google-AI tactics are selling keyword density with a new name (§3).
- **The controls are the existing ones**: `nosnippet`, `data-nosnippet`,
  `max-snippet`, and `noindex` govern what AI features may show;
  Google-Extended governs training/grounding in Google's other systems. A
  dedicated Search Console opt-out toggle + generative-AI performance report
  began rolling out in June 2026 (UK first, global to follow) — check it
  before inventing a blocking scheme.
- Appearing in an AI answer is a snippet-economics question, not a new
  discipline: the first-screen-answer rule (§1) and primary-source E-E-A-T
  signals (§2) are what get cited.

## 7. Content lifecycle

- **Content is inventory with a freshness cost**: schedule re-verification
  for anything with versioned facts (pricing, benchmarks, "as of 2026"
  claims) — the library's own rule (fast-moving claims re-verified) applies
  to published content doubly.
- Update, consolidate, or prune: decayed posts that still get traffic →
  update (honest updated-date); overlapping posts splitting one intent →
  merge + redirect; zero-value pages → prune (they drag domain-level quality
  assessments).
- Canonicalize deliberately when near-duplicates must exist (print views,
  UTM variants); one canonical per intent.
- Redirects preserve equity and readers: renamed/merged content 301s to its
  successor; a content migration without a redirect map is data loss.

## Audit checklist

- [ ] Each search-targeted page names its query + intent (in brief/frontmatter)
      and matches the format the current SERP validates
- [ ] The query's answer appears in the first screen; no 800-word preambles
- [ ] First-hand value present: original data/screenshots/experience per
      page; nothing assembleable purely from existing top-10 results
- [ ] Real named authors with bios on expertise-sensitive content; no
      fabricated personas; publish/updated dates truthful
- [ ] Claims cite primary sources; no citation chains into blogspam
- [ ] Spam-policy sweep: no page sets matching scaled/doorway patterns
      (mass permutation pages, thin location pages); no rented third-party
      sections riding the domain; structured data matches visible content
- [ ] No keyword-density thinking anywhere in the process; natural topic
      vocabulary only
- [ ] Titles unique, front-loaded, truthful; meta descriptions written as
      SERP ad copy; one H1; H2s carry the argument (skim test)
- [ ] Internal links use descriptive anchors; no orphan pages; external
      links to primary sources present
- [ ] AI-assisted content: human domain review recorded, all numbers/
      citations verified, no fabricated experience framing; AI-usage policy
      published if applicable
- [ ] No GEO/AEO folklore in the strategy: no llms.txt-for-Google, chunking,
      AI-rewriting, or special-schema tactics sold as AI-visibility work;
      AI-surface appearance managed via the standard preview controls /
      Search Console setting
- [ ] Re-verification schedule exists for time-sensitive facts; overlap
      merged; prune list maintained; every moved URL has a 301

# 04 — Claims, Legal & Trust

Marketing copy is regulated speech. The FTC (US), consumer-protection and
unfair-commercial-practices law (EU), and platform policies all bite the same
spot: **saying things that aren't true, or hiding things that are.** This file
is the accuracy gate — run it before anything ships, because retractions cost
more than rewrites. (US/EU are covered as the common cases; verify locally for
other jurisdictions.)

## 1. The substantiation gate

- **Every objective claim has evidence on file before publication** — the
  FTC's substantiation doctrine expects a reasonable basis *at the time the
  claim is made*, not assembled after a challenge. Build the habit
  regardless of jurisdiction: a claims register (claim → evidence → owner →
  re-verify date) next to the site content.
- Objective claims include: numbers ("40% faster", "10,000 customers"),
  rankings ("#1", "most popular"), absolutes ("only", "first", "never goes
  down"), comparisons ("cheaper than X"), and **friction reducers**
  ("cancel anytime", "no credit card").
- **Puffery vs claim**: "we think it's delightful" is opinion; anything a
  reasonable reader takes as measurable fact is a claim. When in doubt, it's
  a claim.
- Comparative claims carry the burden twice: substantiate your number *and*
  the competitor's, dated (their product changes too — `rules/02` §6).
- Health, financial, security, and earnings claims are heightened-scrutiny
  categories — legal review, not just this checklist.
- **Security claims are technical claims**: "bank-level encryption" is
  unfalsifiable filler — either state the real control ("TLS 1.3 in transit,
  AES-256 at rest" — verified against the actual config, `sota-code-security`
  rules/04) or say nothing. Fictional security copy is discoverable in
  breach litigation.
- Uptime/SLA marketing numbers come from measured data (`sota-observability`
  SLOs), match the contractual SLA, and carry the measurement window.

## 2. Endorsements & material connections (FTC Endorsement Guides)

16 CFR Part 255, revised effective July 2023 — the operational rules:

- **Any material connection between endorser and brand is disclosed**: paid,
  free product, affiliate commission, employment, family. The 2023 revision
  is explicit that tags, likes, and reposts by connected parties can be
  endorsements.
- **Disclosures are clear, conspicuous, and proximate** — in the post/page
  itself, before the fold of the endorsement, not behind "more", not only in
  a bio, not hashtag soup (#sp doesn't cut it; "Paid partnership with X"
  does). Platform disclosure tools alone may not suffice.
- **Employee advocacy counts**: employees praising the product on social
  media disclose the employment relationship — put it in the social-media
  policy.
- Endorsements reflect **honest, current opinions of actual users**; a
  script an endorser wouldn't say in their own words is the brand speaking
  in costume.

## 3. Reviews & testimonials (Consumer Reviews Rule)

16 CFR Part 465 (effective October 2024) turned review deception into a
civil-penalty rule; treat every item as a Critical finding:

- **No fake reviews or testimonials** — including AI-generated ones, reviews
  by non-users, or reviews misrepresenting experience.
- **No buying positive (or negative-competitor) reviews**; incentivized
  reviews cannot be conditioned on sentiment, and material incentives are
  disclosed.
- **Insider reviews** (officers, employees, their relatives) require clear
  disclosure of the relationship.
- **No review suppression**: publishing only positive reviews while a
  "reviews" surface implies completeness, or using legal threats to remove
  honest negatives, violates the rule. Moderation criteria must be
  sentiment-neutral.
- **No fake social-media indicators** — purchased followers/likes/views used
  to misrepresent influence.
- Testimonial hygiene on top of the rule: written consent on file (scope +
  revocation path), identity real and verifiable, and **typicality** — a
  best-case result presented as typical is deceptive; either show the
  generally expected result or clearly qualify the outlier.

## 4. Dark patterns

Regulators on both sides of the Atlantic now name these directly (FTC dark-
patterns enforcement; EU DSA Article 25 for platforms; GDPR consent validity):

- **Confirmshaming** — decline options that mock the user ("No thanks, I
  like losing data") — banned; the neutral decline is "Not now"
  (`sota-ux-writing` rules/03 §7 owns the in-product wording).
- **False urgency/scarcity** — countdown timers that reset, "only 2 left"
  without inventory truth, "17 people are viewing this" from a random-number
  generator: fabricated urgency is deception, full stop. Real deadlines and
  real scarcity, stated plainly, are fine.
- **Hidden costs / drip pricing** — mandatory fees revealed at the last
  checkout step (`rules/02` §6).
- **Pre-ticked consent** — invalid under GDPR (consent must be an affirmative
  act) and a dark pattern everywhere; marketing-consent checkboxes default
  unchecked (consent engineering: `sota-privacy-compliance` rules/03).
- **Roach-motel subscriptions** — signup in one click, cancellation behind a
  phone call. Negative-option/auto-renewal rulemaking is jurisdiction-
  specific and in flux (verify current US federal/state and EU status at use
  time); the durable principle: **cancellation effort ≈ signup effort**, and
  renewal terms disclosed before the charge.
- Visual-hierarchy manipulation (giant accept, ghost decline) is the same
  pattern in CSS — audit copy and presentation together.

## 5. Email & lifecycle messaging law

Two regimes cover most senders; apply the stricter when audiences mix:

- **CAN-SPAM (US, commercial email)**: truthful header/sender, non-deceptive
  subject line, physical postal address in the message, clear unsubscribe
  that works, is honored **within 10 business days**, and costs nothing more
  than a reply/click. Applies per-message to commercial content.
- **GDPR + ePrivacy (EU)**: direct marketing needs **opt-in consent** (an
  affirmative act, granular, withdrawable as easily as given) or the
  narrow **soft opt-in** (existing customers, similar products/services,
  opt-out offered at collection and in every message). Consent records are
  kept; "we emailed everyone who ever signed up" is not a lawful basis.
- **Transactional vs marketing is a content test, not a template flag**:
  receipts and security notices aren't marketing — until promotional content
  dominates; hybrid messages get the stricter treatment. Never smuggle
  promotions into "Your invoice" subject lines (deceptive subject +
  reclassifies the mail).
- Subject lines are claims: "Re:"/"Fwd:" fakery, false urgency, and
  bait-and-switch subjects violate the deception rules *and* train users to
  ignore you.
- **Mailbox-provider bulk-sender rules gate delivery before any law does**:
  Gmail and Yahoo require senders of 5,000+ messages/day to authenticate with
  aligned SPF + DKIM + DMARC, support RFC 8058 one-click unsubscribe
  (`List-Unsubscribe`/`List-Unsubscribe-Post` headers; Yahoo: honored within
  2 days), and keep reported spam rates below 0.3%; Microsoft Outlook
  (consumer) enforces the same authentication bar since May 2025. Stricter in
  practice than CAN-SPAM's 10-business-day window — non-compliant bulk mail
  gets junked or rejected regardless of legal compliance.
- Sunset/engagement policies (stop mailing the long-unengaged) are
  deliverability hygiene and consent hygiene at once.

## 6. Trust surfaces & ongoing hygiene

- The claims register (§1) gets **scheduled re-verification** — pricing
  claims, competitor comparisons, stats, and "only" claims rot fastest;
  every published claim has an owner and a review date.
- Legal pages (terms, privacy, refund policy) match what the copy promises —
  "cancel anytime" in the hero with a 30-day-notice clause in the ToS is a
  deception finding, not an inconsistency.
- Badges and certifications: display only what's current and verifiable
  (SOC 2 report exists, the ISO cert is in-date); expired/aspirational
  compliance badges are misrepresentation (`sota-privacy-compliance` owns
  the underlying programs).
- Press/award mentions link the source; "as featured in" requires actual
  coverage (`rules/02` §5).
- When a claim fails re-verification: correct the page, and assess whether
  the delta warrants proactive correction to affected customers — silent
  edits of material claims compound the exposure.

## Audit checklist

- [ ] Claims register exists: every objective claim on high-traffic surfaces
      mapped to evidence, owner, and re-verify date
- [ ] Superlative/absolute sweep clean or substantiated:
      `grep -riE '\b(#1|best|only|first|fastest|guaranteed|never|100%)\b' site/ emails/`
- [ ] Security/uptime claims state real, currently-true controls and
      measured numbers — no "bank-level/military-grade" filler
- [ ] Every endorsement with a material connection carries a clear,
      proximate disclosure (not bio-only, not hashtag-only); employee
      social-media policy covers advocacy disclosure
- [ ] Reviews surface: no fake/AI/insider-undisclosed reviews, no
      sentiment-conditioned incentives, sentiment-neutral moderation
      documented, no purchased social-proof metrics (16 CFR 465 exposure)
- [ ] Testimonials: consent on file, real identities, typicality honest or
      clearly qualified
- [ ] Dark-pattern sweep: no confirmshaming
      (`grep -riE '"No thanks, I' site/`), no resetting timers or fabricated
      scarcity/viewer counts, no drip pricing, no pre-ticked consent,
      cancellation effort ≈ signup effort
- [ ] Email: unsubscribe present/working/honored ≤ 10 business days;
      physical address present; EU sends have consent or soft-opt-in records;
      subjects truthful; no promotions disguised as transactional mail
- [ ] Bulk sends (5,000+/day): SPF + DKIM + DMARC aligned, RFC 8058
      one-click-unsubscribe headers present, reported spam rate < 0.3%
- [ ] Legal pages consistent with marketing promises; badges current and
      verifiable
- [ ] Re-verification schedule ran on time for comparisons/stats/pricing;
      failed claims corrected on-page (and to customers when material)