Reviewed: build plan v2 against review framework v2 · Date: 2026-08-12 Mandate: minimum litigation risk (changed from "viability," which is why the bar moved 75 → 80) Scored by: an independent reviewer, across three adversarial passes
| v1 | v2 | |
|---|---|---|
| Score | 71/100 (bar 75) | 84/100 (bar 80) |
| Litigation-risk subtotal | not measured | 73/87 |
| Gates | 8, three failed | 14, all pass |
| Verdict | NO-GO | GO |
It took three passes. Pass one scored v2 at 75 with one gate failing and found four internal contradictions. Pass two verified eleven fixes and failed a new gate. Pass three cleared it. The score moved because mechanisms replaced intentions, not because the framework softened — the framework got stricter between v1 and v2 (six more gates, two new dimensions, a higher bar).
Four things were removed, not deferred. Each closes a litigation theory rather than mitigating one.
1. Unaccredited claim consultants — gone. Only VA-accredited attorneys, claims agents and VSO representatives are listed. This removes the state-AG exposure that produced a $6.8M judgment against VA Claims Insider in Texas in January and a ~$2M Arizona settlement with VetLink in May. The OGC roster is close to the entire market anyway, so the inventory cost is small. It does not remove UDAP exposure for our own conduct — no listing policy can.
2. Pay-per-lead — gone. Texas barratry is a felony reaching the paying lawyer, so firms' own counsel would have refused the contract.
3. The lead inbox and all intake routing — gone. This was the decisive finding. Under Jackson v. LegalMatch, "the act of referring is complete when [the site] routes a potential client to attorneys who match the geographic location and area of practice" — no screening or judgment required. A lead inbox is therefore an unregistered lawyer referral service in California. And since SB 37 (Ch. 645, Stats. 2025) added B&P §6156.5, that is a private cause of action for $5,000 to $100,000 per violation plus attorney's fees, available to any person. v1 shipped a lead inbox into California on the flat tier while carefully excluding California from per-lead pricing. That contradiction is gone.
4. Sponsored ads on a non-paying professional's profile page — gone. Illinois IRPA carries a $1,000 statutory minimum per violation plus fees; multiplied by a class of listed attorneys it is existential. Vrdolyak v. Avvo actually blessed this practice — but Avvo and Whitepages both paid to settle adjacent claims, and the plan is stricter than the case law on purpose.
Four things were added:
consumer health data under Washington's MHMD via the inferred-data prong, with no small business exemption and a private right of action (treble to $25,000 plus fees). The plan builds the standalone notice, two-step opt-in consent with logging, cascading deletion, and an appeal path — and adopts three prohibitions that delete the entire GoodRx / BetterHelp / Cerebral fact pattern: no sale or sharing of health data, no third-party requests from the browser at all, and no condition or diagnosis field anywhere.
resolution from a per-person roster — the largest hidden work item in the plan. v2 models one row per roster row. The problem disappears.
ownership is verified. Unclaimed profiles carry no CTA, no upsell, no ad slot, and noindex; any listed professional can request free suppression.
and Florida before Phase 2, Washington before Phase 3, California before Phase 5. Exposure attaches when the page goes public, so the opinion has to precede it.
| Dimension | Weight | Score |
|---|---|---|
| D1 Legal & regulatory defensibility | 16 | 14 |
| D2 Veteran outcome & trust | 14 | 12 |
| D3 Monetization integrity | 12 | 11 |
| D4 Data & identity architecture | 10 | 9 |
| D5 Review integrity | 10 | 8 |
| D6 Delivery feasibility | 8 | 6 |
| D7 Directive & ops compliance | 5 | 4 |
| D8 Commercial viability | 8 | 4 |
| D9 Privacy & health data | 10 | 9 |
| D10 Third-party accuracy & defamation | 7 | 6 |
| Total | 100 | 84 |
D8 at 4/8 is the honest weak spot — there is still no price, no willingness-to-pay evidence, and no churn model. The plan clears the bar on legal grounds, not commercial ones. That is the correct shape for this mandate, but it means the business question is unanswered: nobody has established that accredited attorneys will pay for this.
You asked for no lawsuit risk. That is not purchasable, and I would be misleading you to imply otherwise. A site that publishes star ratings of named professionals will receive demand letters, and some will come from attorneys, who write them cheaply. What this design buys is that every theory is expensive to plead and cheap to defeat.
Two defenses are weaker than they look, and the plan now says so instead of leaning on them:
statutes inapplicable in federal court** — and a class action under IRPA or §6156.5 lands exactly there. Assume no fee-shifting in the cases that matter most.
unfair-competition claims** — which is to say it likely does not cover IRPA damages, an MHMD claim, or a §6156.5 action. Buy it; record the exclusions; do not treat it as the answer to the three largest exposures.
Residual risks that no design change removes, ranked by the independent reviewer:
"routing to a subset" under §6155. Unconstrued, $5,000 floor, per violation, class-scale. Only removing paid placement removes this risk — which would remove the revenue model. This is the one genuine trade you are making.
Suppression mitigates; the $1,000-minimum class arithmetic does not vanish.
doctrine win — but defense cost is real and partly uninsured.
The reviewer's own list, verbatim in substance:
"being sought" is not evidence, and §9 now requires the reference in the phase status.
target and must never reach public text or a support macro — a published deadline converts moderation into contract exposure under Barnes v. Yahoo!.
state_rule fail-closed enforcement is verified at the API layer, including Striperefusal, per the Phase 1 and Phase 5 tests. A state with no rule row is treated as not-listable until reviewed, so a new state law fails closed rather than open.
Start Phase 0 this week regardless of the rest. ai.fedm8.com today handles veteran PII with no terms of service, no privacy policy and no security headers. That is a live problem for the existing GovCon product, not a new one — and it blocks VA API access, insurance, and every phase below it.
Then Phases 1 and 2 (schema, roster import, browse) can run in parallel with obtaining the Illinois and Florida opinions. Phases 0–5 are roughly 8–11 focused sessions — up from v1's 4–6, which was optimistic because it omitted entity resolution and a compliance package.
Before Phase 5, get a straight answer on price. The legal work is done; the commercial question is not. If accredited attorneys will not pay for flat sponsorship, the whole revenue model rests on the one residual risk you cannot engineer away, and that is worth knowing before you build the Stripe integration rather than after.