Compliance — What Claude Gets Wrong

These are regulatory patterns Claude knows conceptually but inconsistently implements. This skill enforces the specifics that matter in court.

CCPA: Honor Global Privacy Control

Claude often misses GPC. The Sec-GPC: 1 header is a legally binding opt-out signal under CCPA. If present, treat it as "Do Not Sell or Share" without requiring any UI interaction.

// In hooks.server.ts — check on EVERY request
const gpc = request.headers.get('sec-gpc') === '1';
if (gpc) {
  // Force marketing/advertising consent to denied
  // Do NOT set tracking cookies
  // Honor as equivalent to clicking "Do Not Sell"
}

Also required: a visible "Do Not Sell or Share My Personal Information" link on homepage.