git:20260729.5b86b60 to git:20260729.4a3a4d0

4 added, 1 removed. Audit A to A.

---

name: consumer-privacy

description: "Playbook for consumer-privacy compliance — CCPA / CPRA (California), state privacy laws (VA / CO / CT / UT / TX / others), India DPDP overlay, sensitive-data special handling, opt-out signals, do-not-sell."

---

## Codex host binding

- Treat references to Claude slash workflows as the equivalently named Codex skill.

- - Use Codex subagent tools whenever the source role requests the Agent tool.

+ - Before delegating to any specialist, read the `great-pm-runtime` skill and the selected packaged role file.

+ - Treat "invoke", "assign", "delegate", "spawn", and source Agent-tool instructions as a required Codex `spawn_agent` call with that role and a bounded assignment.

+ - Store every returned agent identifier. Never call a wait tool until a spawn has returned an identifier, and wait only on identifiers returned by successful spawns.

+ - If `spawn_agent` is unavailable or a spawn fails, report BLOCKED; do not impersonate the specialist or wait on an empty agent set.

- Resolve bundled paths from the installed GreatPM plugin root.

- Ignore Claude-only model aliases, colors, turn limits, and tool allowlists.

- Preserve GreatPM human gates, governance, state, and reporting contracts.

# Consumer privacy — product-side playbook

US consumer privacy is no longer "just California". A dozen states have

comprehensive privacy laws (2023-2026), and India's DPDP Act adds

another regime. Each has slightly different definitions, thresholds,

and user rights. The PM job is to design the consent + opt-out UX once

in a way that satisfies all.

## 1. The US state-privacy landscape (mid-2026)

|---|---|---|---|

| Colorado | CPA | 2023 | Universal opt-out signal recognition (Global Privacy Control) |

**Number is growing.** 15+ states by end of 2026.

## 2. The common thread (across most)

Every state law shares this skeleton:

- **Consumer rights**: access, delete, correct, opt-out of sale / targeted ads.

- **Sensitive data**: separate treatment (sexual orientation, immigration

status, biometrics, geolocation precise, health, etc.).

- **Privacy notice**: required, with specifics.

- **Vendor agreements**: required.

- **Universal opt-out signals**: increasingly required (GPC).

## 3. Universal opt-out signals (GPC / DNT)

Global Privacy Control (GPC) — a browser-level opt-out signal.

- **CA, CO, CT, OR** require honoring GPC.

- More states will likely follow.

- Engineering implications: detect the signal at server-side AND

client-side, propagate, respect.

**PM implication**: build GPC detection into the privacy stack from

launch. Retrofitting at scale is painful.

## 4. Sensitive data — special handling

Across most state laws, "sensitive personal information" includes:

- Racial / ethnic origin

- Religious or philosophical beliefs

- Sexual orientation

- Citizenship / immigration status

- Health / medical info

- Genetic / biometric data

- Precise geolocation

- Children's data

- Mental health (Washington MHMDA)

**Treatment varies:**

- CA: opt-out of sale (and limit use/disclosure of sensitive).

- VA/CO/CT/UT: opt-in required for sensitive.

- WA MHMDA: strict opt-in for health.

**PM rule**: design sensitive data flows assuming opt-IN is required.

That covers more jurisdictions; CA's opt-out becomes a no-op for users

who haven't opted in anyway.

## 5. Consumer rights operational SLAs

Mostly aligned across states:

- **Verifiable request**: must verify the requester is the consumer.

- **Response window**: 45 days (extendable to 90 with notice).

- **Free for first request per year**; reasonable fee for excessive.

- **No retaliation** for exercising rights.

**PM implication**: build a self-service privacy portal. Manual ops

collapses at scale.

## 6. Privacy notice — the disclosure layer

Required fields (composite of state laws):

- Categories of personal data collected.

- Purposes of collection.

- Categories of recipients (vendors / third parties).

- Whether personal data is sold / used for targeted ads.

- Sensitive-data treatment.

- Consumer rights + how to exercise.

- Authorized agent process.

- Retention period.

- Contact info.

**PM rule**: don't write privacy notice as one giant block of legalese.

Layer it: short summary up front, detail behind clicks. Some states are

beginning to require this.

## 7. India DPDP — overlay for global products

DPDP Act 2023 (India) sits alongside US state laws for products with

Indian users. Key differences:

- **Notice required in 22 languages** on demand.

- **Verifiable parental consent for under-18** (vs US-13).

- **Significant Data Fiduciary** designation may apply.

- **Cross-border transfer**: government can restrict.

(See `india-fintech` skill for more.)

## 8. Vendor / subprocessor management

- **Data Processing Agreement (DPA)** required with every vendor that

processes consumer data.

- **Subprocessor list** maintained, often disclosed publicly.

- **Vendor due diligence** before signing.

**PM rule**: maintain the subprocessor list as a real document, not a

fiction. Audit-readiness depends on it.

## 9. Targeted ads — the opt-out moment

Most state laws give a right to opt out of "targeted advertising" /

"profiling". Implications:

- Default targeted ads = OPT-OUT required (most states).

- Display the opt-out clearly (footer link is common).

- Honor GPC (universal opt-out).

- For sensitive data: targeted ads typically require OPT-IN.

## 10. Operational checklist (US + India)

- [ ] Privacy notice drafted, reviewed, layered UX

- [ ] Cookie / tracking consent banner (where required)

- [ ] GPC server + client detection

- [ ] Consumer rights self-service portal

- [ ] Verification flow for rights requests

- [ ] DSAR queue + 45-day SLA tracker

- [ ] Sensitive-data opt-in flow

- [ ] Subprocessor list public + maintained

- [ ] DPA template for all vendors

- [ ] DPDP-compliant notice + age-of-consent matrix

- [ ] Breach notification flow per state

- [ ] Privacy training for all teams handling data

## 11. When great-pm agents consume this skill

| Agent | What it pulls from here |

|---|---|

| consumer-app-pm-reviewer | Privacy notice + consent UX + DSAR portal |

| fintech-pm-reviewer | Sensitive-data treatment + state matrix |

| data-strategist | Sensitive-data opt-in design + vendor management |

| spec-writer | Consent UX patterns + opt-out flows + GPC respect |

| ai-ethics-pm | Sensitive-data fairness; profiling opt-out |

## 12. References

- CCPA + CPRA: cppa.ca.gov

- IAPP state tracker: iapp.org/resources/article/us-state-privacy-legislation-tracker

- GPC: globalprivacycontrol.org

- WA MHMDA: atg.wa.gov

- India DPDP: meity.gov.in

## 13. The honesty filter

If a privacy posture says "we comply with CCPA", that's table stakes; ask

about the next 14 states. The architecture must be multi-state by

default, not California-first then retrofit.