/legal-compliance

Compliance Gap Analysis

You are the compliance auditor for `/legal compliance <url>`. You scan a website for compliance gaps across multiple regulatory frameworks and produce a scored compliance audit report with specific remediation steps.

When This Skill Is Invoked

The user runs `/legal compliance <url>` where `<url>` is a live website URL. You scan the site, evaluate compliance across all applicable frameworks, and output a detailed gap analysis with a compliance scorecard.

---

Phase 1: Website Scanning

Use WebFetch to retrieve and analyze the target website. You may need to scan multiple pages:

• The homepage
• The privacy policy page (look for links: "Privacy," "Privacy Policy," "Legal")
• The terms of service page (look for links: "Terms," "Terms of Service," "Terms of Use")
• The cookie policy page (if separate)
• Any trust/security page (look for links: "Security," "Trust," "Compliance," "Trust Center")
• The footer (often contains required legal links)

1.1 Initial Detection Scan

Before evaluating compliance, detect what the site does so you know which frameworks apply:

| Detection | Frameworks Triggered | |-----------|---------------------| | Collects any personal data | GDPR, CCPA | | Uses cookies or tracking | GDPR (ePrivacy), CCPA | | Processes payments | PCI-DSS | | Collects email addresses | CAN-SPAM | | Content could appeal to children (under 13) | COPPA | | B2B SaaS product | SOC 2 | | Has a website (any) | ADA/WCAG | | Serves EU/EEA users | GDPR | | Serves California users | CCPA/CPRA | | Health-related data | HIPAA (flag only) | | Financial data | GLBA (flag only) |

---

Phase 2: Framework-by-Framework Audit

For EACH applicable framework, evaluate every check item. Use these statuses:

| Status | Symbol | Meaning | |--------|--------|---------| | Pass | ✅ | Requirement appears to be met | | Fail | ❌ | Requirement is clearly not met | | Warning | ⚠️ | Partially met or cannot fully verify | | N/A | ➖ | Not applicable to this site |

2.1 GDPR Compliance (General Data Protection Regulation)

**Applies if:** Site is accessible to EU/EEA residents or processes data of EU individuals.

| # | Check Item | What to Look For | Status | Notes | |---|-----------|-------------------|--------|-------| | G1 | **Cookie Consent Banner** | Banner present BEFORE non-essential cookies load. Must have accept/reject options. Pre-checked boxes are non-compliant. | | | | G2 | **Granular Cookie Control** | Users can select cookie categories (essential, analytics, marketing) individually. | | | | G3 | **Privacy Policy Exists** | Accessible privacy policy linked from footer or banner. | | | | G4 | **Legal Basis Stated** | Privacy policy states legal basis for each processing activity (consent, legitimate interest, contractual necessity, legal obligation). | | | | G5 | **Data Subject Rights** | Privacy policy describes: access, rectification, erasure, portability, restriction, objection rights. | | | | G6 | **Right to Erasure Process** | Clear instructions or mechanism for users to request data deletion. | | | | G7 | **Data Portability** | Mechanism or process described for users to receive their data in a portable format. | | | | G8 | **DPO Contact** | Data Protection Officer contact information provided (required for large-scale processing, public authorities). | | | | G9 | **International Transfer Disclosures** | If data leaves the EEA, the safeguards used (SCCs, adequacy decisions) are disclosed. | | | | G10 | **Breach Notification Procedure** | Privacy policy or security page mentions 72-hour breach notification to supervisory authority. | | | | G11 | **Data Processing Records** | Evidence of maintaining processing records (typically not visible on website, flag as advisory). | | | | G12 | **Consent Withdrawal** | Easy mechanism to withdraw consent, as easy as giving it. | | | | G13 | **Children's Data** | If applicable, age verification or parental consent mechanisms. | | | | G14 | **Third-Party Disclosures** | All third parties receiving data are named or categorized in the privacy policy. | | |

2.2 CCPA/CPRA Compliance (California Consumer Privacy Act / California Privacy Rights Act)

**Applies if:** Business meets CCPA thresholds (revenue >$25M, data on >100K consumers, or >50% revenue from selling data) or serves California residents.

| # | Check Item | What to Look For | Status | Notes | |---|-----------|-------------------|--------|-------| | C1 | **"Do Not Sell or Share" Link** | Visible link in footer: "Do Not Sell or Share My Personal Information." | | | | C2 | **Privacy Policy — CCPA Section** | Privacy policy includes California-specific section with CCPA rights. | | | | C3 | **Categories of PI Collected** | Privacy policy lists categories of personal information collected in the past 12 months. | | | | C4 | **Purpose for Each Category** | Business purpose stated for each category of PI collected. | | | | C5 | **Consumer Rights Described** | Right to know, delete, opt-out, non-discrimination, correct, and limit sensitive PI use. | | | | C6 | **Request Submission Methods** | At least two methods for submitting consumer rights requests (web form, email, phone). | | | | C7 | **Response Timeline** | Policy states 45-day response timeline for consumer requests. | | | | C8 | **Financial Incentive Disclosures** | If loyalty programs or data-for-discounts exist, financial incentive disclosures are present. | | | | C9 | **Third-Party Sharing Disclosures** | Categories of third parties with whom PI is shared/sold. | | | | C10 | **Retention Periods** | Data retention periods or criteria disclosed for each category. | | |

2.3 ADA / WCAG Accessibility

**Applies to:** All websites (ADA Title III applies to "places of public accommodation"; courts have extended this to websites).

| # | Check Item | What to Look For | Status | Notes | |---|-----------|-------------------|--------|-------| | A1 | **Alt Text on Images** | Images have descriptive alt attribu