compliance-testing

Discovery Questions

First, check for .agents/qa-project-context.md in the project root — it carries applicable regulations, CMP details, ad networks, and geographic scope. Skip any question already answered there. If it is missing, suggest creating one with the qa-project-context skill.

Applicable regulations

• Which privacy and platform regulations apply? This sets the entire test matrix.
  • EU: GDPR, ePrivacy Directive (cookies), Digital Services Act (DSA, applied 17 Feb 2024), EU AI Act (prohibitions + AI literacy live since 2 Feb 2025; GPAI obligations + penalties since 2 Aug 2025; Article 50 transparency from 2 Aug 2026 — high-risk obligations postponed, see below).
  • US: CCPA/CPRA plus comprehensive state laws now active in ~20 states (Texas TDPSA, Indiana CDPA eff. 1 Jan 2026, Delaware DPDPA, Nebraska NDPA, Minnesota CDPA, Rhode Island DTPPA, …). Most require honoring Global Privacy Control (Sec-GPC: 1).
  • UK: UK GDPR/DPA, PECR (cookies), Online Safety Act 2023, Data Use and Access Act (DUAA).
  • Other: LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa).
• What is the legal basis for processing? Consent (opt-in), legitimate interest, or contractual necessity — this decides whether explicit consent must precede processing.
• Is there a DPO or legal team? They define the legal requirements; this skill only validates the technical implementation against them.