vulnerable user law