compliance

Build a banner that blocks non-essential cookies until affirmative opt-in, with Reject and Accept buttons of equal prominence and granular category choices. Store preferences in localStorage and only initialize analytics or marketing scripts after consent is recorded.

Create an account deletion flow that cancels subscriptions, cascades deletion across all user-related tables in a transaction, and removes data from external services like analytics and email providers. Retain only anonymized audit records and data required by legal obligations such as tax records.

CCPA applies if your business has annual revenue over $25M, processes data on 100K+ consumers, or derives 50%+ of revenue from selling personal data. If it applies, you must provide a "Do Not Sell or Share My Personal Information" link and respect the Global Privacy Control header.

Retention depends on data type and lawful basis: authentication logs around 90 days, analytics events one year, payment records seven years for tax obligations, and server logs 30 days. Implement scheduled auto-purge jobs to enforce each period automatically.

Type I verifies that security controls are designed properly at a point in time, typically taking 1-3 months. Type II verifies controls operate effectively over a 6-12 month observation period and costs more, but is what enterprise customers usually request.

No. The Skill explicitly states it is not legal advice and recommends consulting a qualified attorney for your specific situation. Generated policies and implementations should always receive legal review before launch.