/consent-flow

name: consent-flow
description: Generates GDPR/CCPA/DPDP privacy consent flows with granular category preferences, consent state persistence, audit logging, and ATT (App Tracking Transparency) integration. Use when user needs privacy consent UI, cookie/tracking consent, or compliance management.
allowed-tools: [Read, Write, Edit, Glob, Grep, Bash, AskUserQuestion]
last_verified: 2026-07-16
review_by: 2027-06-22
os_version: iOS 27 / macOS 27

Consent Flow Generator

Generate a production privacy consent system with granular category-based consent, persistent state management, a consent banner and preferences UI, audit logging for compliance, and App Tracking Transparency integration.

When This Skill Activates

Use this skill when the user:

• Asks about "privacy consent" or "consent management"
• Mentions "GDPR consent" or "GDPR compliance"
• Wants "cookie consent" or "tracking consent"
• Mentions "ATT prompt" or "App Tracking Transparency"
• Asks for "privacy preferences" or "consent preferences"
• Mentions "CCPA compliance" or "DPDP compliance"
• Wants to "manage user consent" or "consent banner"
• Asks about "consent audit log" or "consent records"

Pre-Generation Checks

1. Project Context Detection

• [ ] Check Swift version (requires Swift 5.9+)
• [ ] Check deployment target (iOS 16+ / macOS 13+)
• [ ] Check for @Observable support (iOS 17+ / macOS 14+)
• [ ] Identify source file locations

2. Conflict Detection

Search for existing consent or privacy code:

Glob: **/*Consent*.swift, **/*Privacy*.swift, **/*Tracking*.swift, **/*GDPR*.swift
Grep: "ATTrackingManager" or "ConsentManager" or "trackingAuthorizationStatus"

If third-party library found (OneTrust, Usercentrics, CookieBot):

• Ask if user wants to replace or keep it
• If keeping, don't generate — advise on integration best practices instead

3. ATT Framework Availability

Check for App Tracking Transparency framework:

Grep: "AppTrackingTransparency" in project files
Grep: "NSUserTrackingUsageDescription" in Info.plist

If `NSUserTrackingUsageDescription` is missing from Info.plist, warn the user that ATT requires this key and offer to add it.

4. Platform Detection

Determine if generating for iOS (primary ATT target) or macOS (ATT not applicable) or both.

Configuration Questions

Ask user via AskUserQuestion:

1. **Target regulations?**

• GDPR only (EU — opt-in model)
• CCPA only (California — opt-out model)
• DPDP only (India — consent-based)
• All regulations (recommended for global apps)

2. **Consent categories?** (multi-select)

• Essential (always on, cannot be disabled)
• Analytics (usage tracking, crash reporting)
• Marketing (advertising, attribution)
• Personalization (recommendations, content tailoring)
• Functional (preferences, saved settings beyond essential)

3. **Include ATT integration?**

• Yes — request ATT permission before any tracking (recommended for iOS)
• No — handle consent without ATT (macOS, or no IDFA usage)

4. **Consent UI style?**

• Bottom banner with manage preferences (recommended)
• Full-screen consent view (for first launch)
• Settings-embedded (preferences in app settings, no banner)
• Banner + Settings (banner on first launch, preferences in settings)

Generation Process

Step 1: Read Templates

Read `templates.md` for production Swift code. Read `patterns.md` for compliance rules, regulation differences, and UX guidance.

Step 2: Create Core Files

Generate these files: 1. `ConsentCategory.swift` — Enum of consent categories with metadata 2. `ConsentDecision.swift` — Per-category consent state with timestamp 3. `ConsentManager.swift` — @Observable manager with persistence and ATT integration 4. `ConsentAuditLog.swift` — Compliance audit trail with JSON export

Step 3: Create UI Files

5. `ConsentBannerView.swift` — Animated slide-up consent banner 6. `ConsentPreferencesView.swift` — Detailed toggle list for each category

Step 4: Create Optional Files

Based on configuration:

• `ConsentRegulationConfig.swift` — If multiple regulations selected
• `ConsentATTBridge.swift` — If ATT integration selected (extracted for testability)

Step 5: Determine File Location

Check project structure:

• If `Sources/` exists → `Sources/Consent/`
• If `App/` exists → `App/Consent/`
• Otherwise → `Consent/`

Output Format

After generation, provide:

Files Created

Consent/
├── ConsentCategory.swift        # Consent category enum with metadata
├── ConsentDecision.swift         # Per-category decision with timestamp
├── ConsentManager.swift          # @Observable manager with persistence
├── ConsentAuditLog.swift         # Compliance audit trail
├── ConsentBannerView.swift       # Animated consent banner
├── ConsentPreferencesView.swift  # Granular preferences UI
├── ConsentRegulationConfig.swift # Multi-regulation rules (optional)
└── ConsentATTBridge.swift        # ATT integration bridge (optional)

Integration Steps

**Show consent on first launch:**

@main
struct MyApp: App {
    @State private var consentManager = ConsentManager()

    var body: some Scene {
        WindowGroup {
            ContentView()
                .environment(consentManager)
                .overlay(alignment: .bottom) {
                    if consentManager.needsConsent {
                        ConsentBannerView()
                            .environment(consentManager)
                            .transition(.move(edge: .bottom).combined(with: .opacity))
                    }
                }
                .animation(.easeInOut(duration: 0.3), value: consentManager.needsConsent)
        }
    }
}

**Check consent before tracking:**

func trackEvent(_ event: AnalyticsEvent) {
    guard consentManager.hasConsent(for: .analytics) else { return }
    analyticsService.track(event)
}

func showPersonalizedAd() {
    guard consentManager.hasConsent(for: .marketing) else {
        show