A single mobile app can quietly route a user's precise location, contacts, and health interests to dozens of companies the user has never heard of, and doing so triggers a stack of overlapping privacy regimes at once. This guide maps that stack for founders and counsel: the FTC's Section 5 authority and its case-by-case common law of data practices, COPPA's hard rules for children, California's CCPA/CPRA and the state statutes that copied it, the sectoral overlays of GLBA and the health-breach rules, the GDPR for anyone with European users, and the platform policies that Apple and Google enforce as private law. It works through the special danger zones of precise geolocation and biometric data, including Illinois's BIPA, and closes with a repeatable six-step pre-launch program. Every term is defined in plain English and grounded in primary authority, with worked hypotheticals throughout. Treat it as a research map, not a substitute for counsel on your specific product.