What problem does it solve? Launching a web product in the EU/UK without a structured privacy audit risks regulatory violations — missing cookie consent, incomplete privacy policies, no data-deletion endpoints, and undocumented cross-border data transfers. This Skill performs a systematic GDPR + ePrivacy technical audit so gaps surface before launch, not after a complaint. ## Core Features & Use Cases - Cookie and tracking audit: Greps for cookie-setting code, analytics SDKs (Google Analytics, Mixpanel, PostHog, Segment), and consent libraries, then verifies consent is obtained before tracking scripts load. - Legal page and user-rights checks: Verifies privacy policy and terms routes exist, cover required disclosures, and that delete-account, data-export, and opt-out mechanisms are implemented. - DFD-driven data handling analysis: Consumes the data flow diagram at omnigrid/artifacts/architecture/dfd.md to trace PII, PCI, and secrets across the system, flag cross-border transfers to non-EU vendors, and identify third-party processors needing DPAs — with a grep-based fallback when no DFD exists. - Use Case: Before launching a SaaS app to European users, run the audit to get a findings table (FAIL/WARN/PASS per area) and a GDPR readiness verdict, then fix the flagged items like gating analytics behind a consent callback. ## Quick Start Run a GDPR and cookie-consent compliance audit on this web project and report any findings before our EU launch.
