product-on-purpose privacy-notice-review
Read a published privacy notice and say, item by item, whether it discloses what the US state privacy statutes require. The output is a redline for a human reviewer, not a filing.
The seven-point checklist
This is the canonical list. Every review reports a verdict for each of the seven items, in this order, and never renumbers them.
- Categories of personal data collected, stated by category rather than by field name.
- Purposes of processing, stated per category, not as one paragraph covering everything.
- Third parties and categories of recipients, including processors and advertising partners.
- Retention, either a period per category or the criteria used to set one.
- Consumer rights and how to exercise them, with a working request route.
- The appeal path for a request the controller denies, with the deadline for the appeal.
- Contact details and the effective date, including the date of the last substantive change.
Procedure
- Read the notice end to end before judging any item. A disclosure often lands in a section its heading does not advertise.
- For each checklist item, quote the sentence in the notice that satisfies it, or record the item as missing. A paraphrase is not evidence.
- Check the state-specific requirements in the state law reference for every state the notice names, plus every state the product actually sells into.
- Return the redline in the shape described in the output contract: the per-item verdict table first, then the quoted evidence, then the recommended wording for each gap.
What this skill does not do
It does not read the product's data flows, so a disclosure that is present but untrue reads as satisfied here. Say so in the redline when the claim is one the notice cannot support on its face.
Changelog
- 0.4.0 - added the appeal path as checklist item 6 and renumbered contact details to item 7.
- 0.3.0 - removed the in-place write. The review now returns a report and never edits the source notice.
- 0.2.0 - added the state law reference.