# Multi State Privacy Law Gap Analysis > Multi-state consumer privacy law gap analysis comparing a current privacy program, data inventory, and vendor agreements against enacted state comprehensive privacy laws, identifying data classification issues, state-specific stricter requirements, and universal opt-out signal obligations. - Skill: `finchipaiorg/multi-state-privacy-law-gap-analysis` (Agent Skill) - Install (CLI): `npx skillmds@latest add finchipaiorg/multi-state-privacy-law-gap-analysis` - Raw SKILL.md: https://api.skillmd.com/api/skills/finchipaiorg/multi-state-privacy-law-gap-analysis/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: FinchipAIOrg (https://skillmd.com/u/finchipaiorg) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/finchipaiorg/multi-state-privacy-law-gap-analysis --- # Skill: Multi-State Consumer Privacy Law Gap Analysis ## 1. Subject-matter triage - Confirm the company is plausibly within scope for one or more enacted state comprehensive privacy laws before doing state-by-state analysis. - Separate enacted-law coverage from planned-market expansion, because planned entry into an effective state is current compliance work, not hypothetical planning. - Identify the source set by document type first: privacy notice, inventory, vendor terms, internal policy, assessment records, intake forms, and technical implementation notes. - Treat the presence of multiple states, multiple data types, and multiple processing purposes as distinct analytical dimensions that each require independent checking. ## 2. Failure modes the skill is correcting - Accepting the provided data inventory classification without re-testing whether specific data types meet biometric, health, sensitive, or comparable statutory definitions. - Treating exemptions for regulated health, protected data, or similar categories as blanket shields when the processing falls outside the exempt entity, dataset, or activity. - Missing universal opt-out obligations that are already effective and mislabeling them as future work. - Collapsing different states into a California-only baseline and overlooking stricter notice, minimization, opt-out, or sensitive-data rules elsewhere. - Assuming a response workflow that satisfies one state also satisfies faster or otherwise different state deadlines. - Failing to spot data protection assessment duties for targeted advertising, sale, profiling, or other heightened-risk processing. - Assuming de-identified data is outside scope without checking linkage, crosswalk, or re-identification capability retained by the company. - Overlooking profiling opt-out rights where analytics are used for legal or similarly significant effects. - Treating enforcement risk as uniform despite differences in cure periods and AG enforcement posture. - Stopping at issue description without tying each issue to scope, interacting documents, and operational consequence. ## 3. Legal frameworks / domain conventions that apply - State comprehensive consumer privacy laws must be analyzed state by state under each law’s own applicability threshold, definitions, rights, notice rules, opt-out mechanics, sensitive-data treatment, assessment triggers, and enforcement structure. - Coverage analysis should rely on the relevant statute and implementing provisions for each enacted state law, not on a single baseline substitute. - Sensitive-data classification turns on statutory definitions; health-monitoring outputs, device-derived measurements, and similar data may fall within sensitive or specially regulated categories depending on the jurisdiction. - Health and regulated-data exemptions are generally limited by entity, dataset, or activity and do not automatically extend across unrelated products, affiliates, or business lines. - Consumer rights regimes commonly include access, deletion, correction, portability, and appeal rights, but the response timeline and procedural details vary by state. - Universal opt-out regimes require recognition of browser or device signals where the applicable state law and effective date make the obligation current. - State-specific stricter requirements may include notice content, sale or targeted advertising constraints, purpose limitation, minimization, and special rules for sensitive categories. - Data protection assessments are required under many state laws for processing that presents heightened risk, including targeted advertising, sale, profiling, and sensitive-data processing; the applicable statute and retention expectations should be named. - De-identification status depends on whether the business retains linkage or crosswalk data that could reasonably enable re-identification. - Profiling opt-out rights may apply where outputs are used for decisions with legal or similarly significant effects. - Enforcement risk differs materially between states with cure periods and states where the cure opportunity is limited or absent. ## 4. Analytical scaffolds - Build a state-by-state applicability table first, and proceed only for states where coverage is confirmed. - For each state, map: coverage threshold, personal-data definition, sensitive-data categories, consumer rights, universal opt-out requirement, profiling rights, assessment trigger, cure period, and any notice-specific rule that exceeds the baseline program. - For each inventory category, re-test classification against the controlling state definition and flag any mismatch as a compliance gap, not a mere taxonomy preference. - For each exemption relied upon, verify the entity, dataset, and processing activity all fit the exemption’s scope. - For each consumer-rights workflow, compare the current response and appeal process against the state’s deadline and procedural requirements. - For each opt-out mechanism, identify whether the state requires recognition of universal signals, whether the effective date has passed, and whether the current stack recognizes the signal automatically. - For each high-risk processing activity, confirm whether a documented assessment exists, whether it addresses the actual use case, and whether it is retained for review. - For each de-identification claim, check whether internal linkage data, hashes, or other connectors undermine the claim under the state standard. - For each profiling use case, determine whether the output is used for decisions that trigger a statutory opt-out right. - For each gap, state the legal rule, the affected process, the current status, and the operational consequence. ## 5. Vertical / structural / temporal relationships - A single misclassification can cascade into notice, consent, opt-out, and assessment defects, so remediation should be sequenced to fix classification before downstream disclosures and controls. - Universal opt-out defects are time-sensitive once effective dates have passed; policy edits alone are insufficient if the technical stack does not recognize signals. - Exemption analysis must track organizational boundaries and product boundaries separately; a compliant health-data workflow in one line of business can still create violations in another. - States with shorter timelines or no meaningful cure opportunity should be prioritized ahead of states where the immediate enforcement risk is lower. - Planned market entry should be treated as present-tense compliance work if the target state’s law is already effective. ## 6. Output structure conventions - Begin with a concise executive summary stating overall risk posture, the highest-priority gap themes, and which items are current non-compliance versus forward-looking remediation. - Include a multi-state comparison matrix organized by state, using conventional columns such as law, applicability, data categories, rights, opt-out signals, assessments, cure/enforcement posture, and current status. - Define a simple ordinal severity scale once and use it consistently for every gap entry. - Include an issue-by-issue gap section that gives, for each issue, the severity, the governing state rule, the implicated process or data set, the current deficiency, and the consequence if not remediated. - Where a rule depends on multiple states or multiple data types, enumerate the relevant states or categories first and then analyze each one separately rather than combining them into a single generic pass. - Include a remediation roadmap ordered by urgency, with immediate fixes first, then near-term policy and technical changes, then longer-term governance updates. - End with an explicit Recommended Actions block that assigns each action to a role or owner and ties it to a deadline, effective date, or other timing anchor. - Cite the controlling statutory or regulatory authority by name and section for each legal proposition relied upon; do not state a conclusion without naming the rule that supports it. - Use conventional privacy-compliance terminology and avoid idiosyncratic section headings that obscure the matrix, gap analysis, roadmap, and enforcement-risk conclusions.