Cookie Policy
Draft a cookie consent policy and banner implementation guide for "$ARGUMENTS". Generate a comprehensive cookie policy with practical implementation guidance for consent management.
Note: AI-generated legal content does not constitute legal advice. Consult a qualified attorney.
Prerequisites
Check that .metapowers/legal/$ARGUMENTS/00-assess.md exists. If it does not exist, stop and tell the user:
"Run an Assess skill first (e.g. /legal:risk-assessment $ARGUMENTS) to generate the prerequisite assessment artifact."
If the user passes --skip-checks, bypass this check and log the skip to .metapowers/legal/$ARGUMENTS/skip-log.md with a timestamp and the reason "Prerequisite check skipped for cookie-policy".
Process
Read inputs:
- Read
.metapowers/legal/$ARGUMENTS/00-assess.md for jurisdiction requirements and data practice context
Draft cookie policy — explanatory sections:
- What Cookies Are — plain-language explanation of cookies and similar tracking technologies (pixels, web beacons, local storage, fingerprinting), accessible to non-technical readers
- Cookie Categories:
- Strictly Necessary — essential for site function (authentication, security, load balancing, shopping cart), cannot be disabled, no consent required
- Functional / Preferences — remember user choices (language, region, display settings), enhance user experience but not essential
- Analytics / Performance — measure site usage, traffic patterns, page performance (Google Analytics, Hotjar, etc.), used to improve the service
- Advertising / Marketing — track users across sites, build interest profiles, deliver targeted ads, measure ad campaign effectiveness
Draft cookie inventory table:
- For each cookie: name, provider (first-party or third-party with name), purpose, category, duration (session or persistent with expiry), data collected
- Organize by category
- Note: instruct the user to audit their actual cookies and update this table with real values
Draft cookie management instructions:
- How to manage cookies through the consent banner (re-access preferences)
- How to manage cookies per browser (Chrome, Firefox, Safari, Edge — link to browser documentation)
- How to opt out of specific third-party cookies (Google, Meta, etc. — link to opt-out pages)
- Impact of disabling cookies on site functionality per category
Draft third-party cookie disclosures:
- List of third-party services that set cookies
- Link to each third party's privacy/cookie policy
- Purpose of each third-party integration
- Data shared with third parties through cookies
Draft consent mechanism description:
- How consent is collected (banner, preference center)
- What constitutes valid consent (affirmative action, not pre-checked boxes)
- How consent is recorded and stored
- How users can withdraw consent
- Consent expiry and re-consent frequency
Draft policy update procedure:
- How changes to the cookie policy are communicated
- Re-consent requirements when new cookie categories are added
- Version history or changelog
Draft banner implementation guide:
Consent requirements by jurisdiction:
- EU/EEA (ePrivacy Directive + GDPR): opt-in required for non-essential cookies, prior consent before setting cookies, granular category-level consent, no cookie walls (consent cannot be condition of access)
- UK (UK GDPR + PECR): similar to EU, opt-in for non-essential
- California (CCPA/CPRA): opt-out model for sale/sharing of personal information, "Do Not Sell or Share" link
- Brazil (LGPD): consent-based, similar to GDPR approach
- Other jurisdictions: default to opt-in as safest baseline
Banner design recommendations:
- First layer: concise purpose statement, accept/reject buttons of equal prominence, link to cookie settings and full policy
- Second layer (preference center): category-level toggles with descriptions, individual cookie details, save preferences button
- Accessibility requirements: keyboard navigation, screen reader compatible, sufficient contrast
- No dark patterns: no pre-checked boxes, no confusing button hierarchy, no hidden reject option
Consent storage approach:
- Store consent state in a first-party cookie
- Record consent timestamp, version, and granular choices
- Sync consent with server-side records for audit trail
- Recommended consent management platforms (CMP) for implementation
Re-consent triggers:
- New cookie categories added
- Significant changes to data processing purposes
- Consent record older than 12 months (recommended refresh)
- Change in applicable regulations
Write the artifact to .metapowers/legal/$ARGUMENTS/01-draft.md with frontmatter:
---
description: Cookie policy and implementation guide draft for $ARGUMENTS
---
Output
The cookie policy and implementation guide draft written to .metapowers/legal/$ARGUMENTS/01-draft.md. Present a summary to the user highlighting:
- Cookie categories defined and example cookies listed
- Jurisdictions addressed and consent model per jurisdiction
- Banner implementation recommendations
- Third-party cookie integrations identified
- Areas flagged for attorney review (especially consent mechanism compliance)
1---2name: cookie-policy3description: Draft cookie consent policy and banner implementation guide4---56# Cookie Policy78Draft a cookie consent policy and banner implementation guide for "$ARGUMENTS". Generate a comprehensive cookie policy with practical implementation guidance for consent management.910> **Note:** AI-generated legal content does not constitute legal advice. Consult a qualified attorney.1112## Prerequisites1314Check that `.metapowers/legal/$ARGUMENTS/00-assess.md` exists. If it does not exist, stop and tell the user:1516> "Run an Assess skill first (e.g. `/legal:risk-assessment $ARGUMENTS`) to generate the prerequisite assessment artifact."1718If the user passes `--skip-checks`, bypass this check and log the skip to `.metapowers/legal/$ARGUMENTS/skip-log.md` with a timestamp and the reason "Prerequisite check skipped for cookie-policy".1920## Process21221. **Read inputs:**23 - Read `.metapowers/legal/$ARGUMENTS/00-assess.md` for jurisdiction requirements and data practice context24252. **Draft cookie policy — explanatory sections:**2627 - **What Cookies Are** — plain-language explanation of cookies and similar tracking technologies (pixels, web beacons, local storage, fingerprinting), accessible to non-technical readers28 - **Cookie Categories:**29 - **Strictly Necessary** — essential for site function (authentication, security, load balancing, shopping cart), cannot be disabled, no consent required30 - **Functional / Preferences** — remember user choices (language, region, display settings), enhance user experience but not essential31 - **Analytics / Performance** — measure site usage, traffic patterns, page performance (Google Analytics, Hotjar, etc.), used to improve the service32 - **Advertising / Marketing** — track users across sites, build interest profiles, deliver targeted ads, measure ad campaign effectiveness33343. **Draft cookie inventory table:**35 - For each cookie: name, provider (first-party or third-party with name), purpose, category, duration (session or persistent with expiry), data collected36 - Organize by category37 - Note: instruct the user to audit their actual cookies and update this table with real values38394. **Draft cookie management instructions:**40 - How to manage cookies through the consent banner (re-access preferences)41 - How to manage cookies per browser (Chrome, Firefox, Safari, Edge — link to browser documentation)42 - How to opt out of specific third-party cookies (Google, Meta, etc. — link to opt-out pages)43 - Impact of disabling cookies on site functionality per category44455. **Draft third-party cookie disclosures:**46 - List of third-party services that set cookies47 - Link to each third party's privacy/cookie policy48 - Purpose of each third-party integration49 - Data shared with third parties through cookies50516. **Draft consent mechanism description:**52 - How consent is collected (banner, preference center)53 - What constitutes valid consent (affirmative action, not pre-checked boxes)54 - How consent is recorded and stored55 - How users can withdraw consent56 - Consent expiry and re-consent frequency57587. **Draft policy update procedure:**59 - How changes to the cookie policy are communicated60 - Re-consent requirements when new cookie categories are added61 - Version history or changelog62638. **Draft banner implementation guide:**6465 - **Consent requirements by jurisdiction:**66 - EU/EEA (ePrivacy Directive + GDPR): opt-in required for non-essential cookies, prior consent before setting cookies, granular category-level consent, no cookie walls (consent cannot be condition of access)67 - UK (UK GDPR + PECR): similar to EU, opt-in for non-essential68 - California (CCPA/CPRA): opt-out model for sale/sharing of personal information, "Do Not Sell or Share" link69 - Brazil (LGPD): consent-based, similar to GDPR approach70 - Other jurisdictions: default to opt-in as safest baseline7172 - **Banner design recommendations:**73 - First layer: concise purpose statement, accept/reject buttons of equal prominence, link to cookie settings and full policy74 - Second layer (preference center): category-level toggles with descriptions, individual cookie details, save preferences button75 - Accessibility requirements: keyboard navigation, screen reader compatible, sufficient contrast76 - No dark patterns: no pre-checked boxes, no confusing button hierarchy, no hidden reject option7778 - **Consent storage approach:**79 - Store consent state in a first-party cookie80 - Record consent timestamp, version, and granular choices81 - Sync consent with server-side records for audit trail82 - Recommended consent management platforms (CMP) for implementation8384 - **Re-consent triggers:**85 - New cookie categories added86 - Significant changes to data processing purposes87 - Consent record older than 12 months (recommended refresh)88 - Change in applicable regulations89909. **Write the artifact** to `.metapowers/legal/$ARGUMENTS/01-draft.md` with frontmatter:9192 ```93 ---94 description: Cookie policy and implementation guide draft for $ARGUMENTS95 ---96 ```9798## Output99100The cookie policy and implementation guide draft written to `.metapowers/legal/$ARGUMENTS/01-draft.md`. Present a summary to the user highlighting:101- Cookie categories defined and example cookies listed102- Jurisdictions addressed and consent model per jurisdiction103- Banner implementation recommendations104- Third-party cookie integrations identified105- Areas flagged for attorney review (especially consent mechanism compliance)
bromso