Privacy Risk Audit

See what a regulator would, before they do. Paste a page source into Claude and get a compliance audit covering GDPR, CPRA, CIPA, dark patterns, tracker behavior, and enforcement exposure.

What it covers

The audit runs eight categories — the same ones a regulator opens with:

• Cookie banner & consent — is the site opt-in (GDPR) or opt-out (CPRA), and does the banner actually do what the law requires?
• Tracker & script behavior — which scripts fire before consent. Ad tech, analytics, and session replay all flagged.
• Privacy policy completeness — vague language, missing retention periods, overbroad purpose clauses, weak legal basis.
• Dark patterns — asymmetric buttons, hidden reject, multi-step opt-out, pre-checked toggles.
• Data subject rights & DSAR — are all required rights listed, and is the process actually accessible?
• International transfers — SCCs, Data Privacy Framework, supplementary measures, Schrems II.
• Sector-specific risk — healthcare pixel exposure, financial privacy, children's data.
• Enforcement exposure — every finding mapped to real fines and active enforcement trends.

What you get back

A full compliance report, structured like an enforcement memo:

• Executive summary with an overall risk rating — Green / Yellow / Red
• Regional consent-compliance matrix
• Tracker inventory, with pre-consent firing flagged
• Privacy-policy scorecard against 14 requirements
• Regulatory exposure matrix with fine ranges
• Prioritized fix checklist — Immediate / 30-day / Ongoing
• Follow-up verification steps

The skill

This skill ships as a folder — a core file plus reference and output templates that work together. Download the .zip and drop the whole folder into your skills directory — the core file is previewed below.

What’s in the folder

privacy-risk-audit/
  privacy-risk-audit.md      # Core skill — workflow + gotchas
  README.md                  # How to run it (Claude Code or claude.ai)
  references/
    audit-framework.md       # The 8-category analysis framework
    output-template.md       # The exact report structure
  assets/
    audit-log.md             # Running log of audits performed

Workflow

Step 1: Collect Page Data

1. Homepage (raw HTML) — Extract all <script src="..."> tags. This is how you detect trackers, ad tech, session replay, and consent management platforms.

2. Homepage (markdown) — Look for cookie banner text, footer links to privacy policy / cookie policy / "Do Not Sell" page, and any AI-generated content disclosures.

3. Privacy Policy (markdown) — Scrape the privacy policy URL from the footer links. This is the document you audit word-by-word.

Step 2: Detect Trackers

From the raw HTML, extract all script sources and match against known tracker signatures:

• Advertising: Google Ad Manager/DoubleClick, Amazon Ads, Criteo, Meta Pixel, TikTok Pixel, LinkedIn Insight, Twitter/X, Taboola, Outbrain
• Analytics: Google Analytics/GTM, Adobe Analytics, Chartbeat, Parsely, Comscore, Quantcast
• Session Replay: FullStory, Hotjar, LogRocket, Microsoft Clarity, Mouseflow, Smartlook
• Consent Management: OneTrust, Ketch, Cookiebot, TrustArc, Osano
• Data Platforms: Segment, Tealium, mParticle

Step 3: Map the Consent Model

Determine the consent model per region. Is it opt-in (GDPR/ePrivacy), opt-out (CCPA/CPRA), or notice-only? What does the banner actually do vs. what the law requires?

Step 4: Audit the Policy

Read the privacy policy word by word. Flag vague language, missing disclosures, retention gaps, and rights coverage.

Step 5: Check Dark Patterns

Evaluate the consent UX against the EDPB dark patterns guidelines and California's regulations on dark patterns in consent.

Step 6: Report

Produce the full report following the reference structure. Every section is mandatory. Save the report to assets.

Step 7: Log

After completing the audit, append a one-line entry to the audit log with the date, website, overall risk rating, and key finding count.

Usage

/privacy-risk-audit [website URL or company name]