# Privacy Risk Audit

See what a regulator would, before they do. Paste a page source into Claude and get a compliance audit covering GDPR, CPRA, CIPA, dark patterns, tracker behavior, and enforcement exposure.

## What it covers

The audit runs eight categories — the same ones a regulator opens with:

- **Cookie banner & consent** — is the site opt-in (GDPR) or opt-out (CPRA), and does the banner actually do what the law requires?
- **Tracker & script behavior** — which scripts fire _before_ consent. Ad tech, analytics, and session replay all flagged.
- **Privacy policy completeness** — vague language, missing retention periods, overbroad purpose clauses, weak legal basis.
- **Dark patterns** — asymmetric buttons, hidden reject, multi-step opt-out, pre-checked toggles.
- **Data subject rights & DSAR** — are all required rights listed, and is the process actually accessible?
- **International transfers** — SCCs, Data Privacy Framework, supplementary measures, Schrems II.
- **Sector-specific risk** — healthcare pixel exposure, financial privacy, children's data.
- **Enforcement exposure** — every finding mapped to real fines and active enforcement trends.

## What you get back

A full compliance report, structured like an enforcement memo:

- Executive summary with an overall risk rating — **Green / Yellow / Red**
- Regional consent-compliance matrix
- Tracker inventory, with pre-consent firing flagged
- Privacy-policy scorecard against 14 requirements
- Regulatory exposure matrix with fine ranges
- Prioritized fix checklist — **Immediate / 30-day / Ongoing**
- Follow-up verification steps

## The skill

This skill ships as a **folder** — a core file plus reference and output templates that work together. Download the .zip and drop the whole folder into your skills directory — the core file is previewed below.

## What’s in the folder

```plaintext
privacy-risk-audit/
  privacy-risk-audit.md      # Core skill — workflow + gotchas
  README.md                  # How to run it (Claude Code or claude.ai)
  references/
    audit-framework.md       # The 8-category analysis framework
    output-template.md       # The exact report structure
  assets/
    audit-log.md             # Running log of audits performed
```

## Workflow

### Step 1: Collect Page Data

1. **Homepage (raw HTML)** — Extract all `<script src="...">` tags. This is how you detect trackers, ad tech, session replay, and consent management platforms.

2. **Homepage (markdown)** — Look for cookie banner text, footer links to privacy policy / cookie policy / "Do Not Sell" page, and any AI-generated content disclosures.

3. **Privacy Policy (markdown)** — Scrape the privacy policy URL from the footer links. This is the document you audit word-by-word.

### Step 2: Detect Trackers

From the raw HTML, extract all script sources and match against known tracker signatures:

- **Advertising:** Google Ad Manager/DoubleClick, Amazon Ads, Criteo, Meta Pixel, TikTok Pixel, LinkedIn Insight, Twitter/X, Taboola, Outbrain
- **Analytics:** Google Analytics/GTM, Adobe Analytics, Chartbeat, Parsely, Comscore, Quantcast
- **Session Replay:** FullStory, Hotjar, LogRocket, Microsoft Clarity, Mouseflow, Smartlook
- **Consent Management:** OneTrust, Ketch, Cookiebot, TrustArc, Osano
- **Data Platforms:** Segment, Tealium, mParticle

### Step 3: Map the Consent Model

Determine the consent model per region. Is it opt-in (GDPR/ePrivacy), opt-out (CCPA/CPRA), or notice-only? What does the banner actually do vs. what the law requires?

### Step 4: Audit the Policy

Read the privacy policy word by word. Flag vague language, missing disclosures, retention gaps, and rights coverage.

### Step 5: Check Dark Patterns

Evaluate the consent UX against the EDPB dark patterns guidelines and California's regulations on dark patterns in consent.

### Step 6: Report

Produce the full report following the reference structure. Every section is mandatory. Save the report to assets.

### Step 7: Log

After completing the audit, append a one-line entry to the audit log with the date, website, overall risk rating, and key finding count.

## Usage

```
/privacy-risk-audit [website URL or company name]
```