/privacy-policy-audit

Purpose

/privacy-policy-audit audits a public-facing privacy policy (a website's /privacy page, a product's in-app notice, an app store disclosure) against a stated processing context and the disclosure requirements of the major privacy regimes. For each audit dimension, it asks: what do the regs require the policy to disclose, what does this specific policy actually say, and where are the disclosure gaps? It is a disclosure-sufficiency and regulatory-fit drafting and triage aid, not a DPIA, not a data-flow archaeology, not a cookie scan, not a processor DPA review, not a legal opinion, and not a compliance attestation.

What it IS: an analytical ground-truth pass that reads the actual policy text, maps it against the disclosure obligations of GDPR (Art. 13/14 and adjacent), UK GDPR, CCPA/CPRA, LGPD (where LatAm is in play), COPPA (where children are in play), and ePrivacy cookie/tracker rules, and surfaces the gaps between what the regs require and what the policy actually discloses — framed as disclosure gaps vs Article requirements, never as legal conclusions about compliance.

What it is NOT: legal advice, a substitute for licensed counsel, a data inventory, a DPIA, a cookie scanner, a DPA review tool, a breach response plan, or a go/no-launch recommendation. Every finding is a hypothesis grounded in specific text (or specific absence) in a specific policy, for a human to verify against the real underlying processing.

The skill deliberately sits at the document (what the policy says) against the regs (what must be disclosed), given a stated processing context (what the product actually does, provided by the user). It does not audit the underlying processing itself. That job belongs to the sibling skills listed in "When NOT to Use."

When to Use

Invoke /privacy-policy-audit when you need to: