policy-consistency

"Privacy policy exists" is worthless if it says "we don't use analytics" while a pixel fires. The highest-value privacy findings are contradictions between declaration and behavior.

Activate when

• Any privacy notice, cookie notice, consent banner text, terms clause, security/GDPR/"privacy-first" badge, or marketing claim about data exists.
• After behavior changes (new vendor, new field, deletion change) or before publishing a new notice.
• Not to write the notice (privacy-policy) or observe behavior from scratch (cookie-and-storage-audit, data-flow-mapping), though you consume their output.

Working alone

This skill is self-contained. Its companions (declared in its metadata) are skills whose method it may need to do its own promised work. Use of a companion can be conditional: declaring one does not mean running it. When a companion's lane applies, use the skill if it is installed; if not, follow its short entry in references/companion-methods.md and say in your report which lanes ran inline at reduced depth. Never skip an applicable lane silently. Skills mentioned here only for escalation, referral, documentation, or optional deeper follow-up are not dependencies: report the hand-off and finish honestly.

Companions: cookie-and-storage-audit, data-flow-mapping, data-rights, email-compliance.

Inspect