consumer-privacy git:20260920.2cbc56dA

Immutable. This exact content is served forever at /api/v1/blob/a236a4db7649144f.

---
name: consumer-privacy
description: "Playbook for consumer-privacy compliance — CCPA / CPRA (California), state privacy laws (VA / CO / CT / UT / TX / others), India DPDP overlay, sensitive-data special handling, opt-out signals, do-not-sell."
---

## Codex host binding

- Treat references to Claude slash workflows as the equivalently named Codex skill.
- Before delegating to any specialist, read the `great-pm-runtime` skill and the selected packaged role file.
- Treat "invoke", "assign", "delegate", "spawn", and source Agent-tool instructions as a required Codex `spawn_agent` call with that role and a bounded assignment.
- For the spawn tool's `task_name` or `agent_name` identifier, replace canonical role-name hyphens with underscores (`query-refiner-pm` → `query_refiner_pm`). Keep canonical names unchanged in prompts, filenames, verdict logs, and user-facing output; this is an internal identifier mapping, not a role rename.
- Store every returned agent identifier. Never call a wait tool until a spawn has returned an identifier, and wait only on identifiers returned by successful spawns.
- If `spawn_agent` is unavailable or a spawn fails, report BLOCKED; do not impersonate the specialist or wait on an empty agent set.
- Resolve bundled paths from the installed GreatPM plugin root.
- Ignore Claude-only model aliases, colors, turn limits, and tool allowlists.
- Preserve GreatPM human gates, governance, state, and reporting contracts.


# Consumer privacy — product-side playbook

US consumer privacy is no longer "just California". A dozen states have
comprehensive privacy laws (2023-2026), and India's DPDP Act adds
another regime. Each has slightly different definitions, thresholds,
and user rights. The PM job is to design the consent + opt-out UX once
in a way that satisfies all.

## 1. The US state-privacy landscape (mid-2026)

| State | Law | In force | Key features |
|---|---|---|---|
| California | CCPA + CPRA | 2020 / 2023 | DNS (Do Not Sell), opt-out + opt-in for sensitive, private right of action for breaches |
| Virginia | CDPA | 2023 | Similar to CPRA; no PROA |
| Colorado | CPA | 2023 | Universal opt-out signal recognition (Global Privacy Control) |
| Connecticut | CTDPA | 2023 | GPC + sensitive-data opt-in |
| Utah | UCPA | 2023 | Weaker; B2B-friendly |
| Texas | TDPSA | 2024 | Broad applicability |
| Iowa, Indiana, Tennessee | Various | 2024-2026 | Generally similar to VA |
| Montana, Oregon, Delaware, NH, NJ | Various | 2024-2026 | Various |
| Washington | My Health My Data Act | 2024 | Health-data specific; opt-in for sensitive |

**Number is growing.** 15+ states by end of 2026.

## 2. The common thread (across most)

Every state law shares this skeleton:

- **Consumer rights**: access, delete, correct, opt-out of sale / targeted ads.
- **Sensitive data**: separate treatment (sexual orientation, immigration
  status, biometrics, geolocation precise, health, etc.).
- **Privacy notice**: required, with specifics.
- **Vendor agreements**: required.
- **Universal opt-out signals**: increasingly required (GPC).

## 3. Universal opt-out signals (GPC / DNT)

Global Privacy Control (GPC) — a browser-level opt-out signal.

- **CA, CO, CT, OR** require honoring GPC.
- More states will likely follow.
- Engineering implications: detect the signal at server-side AND
  client-side, propagate, respect.

**PM implication**: build GPC detection into the privacy stack from
launch. Retrofitting at scale is painful.

## 4. Sensitive data — special handling

Across most state laws, "sensitive personal information" includes:

- Racial / ethnic origin
- Religious or philosophical beliefs
- Sexual orientation
- Citizenship / immigration status
- Health / medical info
- Genetic / biometric data
- Precise geolocation
- Children's data
- Mental health (Washington MHMDA)

**Treatment varies:**
- CA: opt-out of sale (and limit use/disclosure of sensitive).
- VA/CO/CT/UT: opt-in required for sensitive.
- WA MHMDA: strict opt-in for health.

**PM rule**: design sensitive data flows assuming opt-IN is required.
That covers more jurisdictions; CA's opt-out becomes a no-op for users
who haven't opted in anyway.

## 5. Consumer rights operational SLAs

Mostly aligned across states:

- **Verifiable request**: must verify the requester is the consumer.
- **Response window**: 45 days (extendable to 90 with notice).
- **Free for first request per year**; reasonable fee for excessive.
- **No retaliation** for exercising rights.

**PM implication**: build a self-service privacy portal. Manual ops
collapses at scale.

## 6. Privacy notice — the disclosure layer

Required fields (composite of state laws):

- Categories of personal data collected.
- Purposes of collection.
- Categories of recipients (vendors / third parties).
- Whether personal data is sold / used for targeted ads.
- Sensitive-data treatment.
- Consumer rights + how to exercise.
- Authorized agent process.
- Retention period.
- Contact info.

**PM rule**: don't write privacy notice as one giant block of legalese.
Layer it: short summary up front, detail behind clicks. Some states are
beginning to require this.

## 7. India DPDP — overlay for global products

DPDP Act 2023 (India) sits alongside US state laws for products with
Indian users. Key differences:
- **Notice required in 22 languages** on demand.
- **Verifiable parental consent for under-18** (vs US-13).
- **Significant Data Fiduciary** designation may apply.
- **Cross-border transfer**: government can restrict.

(See `india-fintech` skill for more.)

## 8. Vendor / subprocessor management

- **Data Processing Agreement (DPA)** required with every vendor that
  processes consumer data.
- **Subprocessor list** maintained, often disclosed publicly.
- **Vendor due diligence** before signing.

**PM rule**: maintain the subprocessor list as a real document, not a
fiction. Audit-readiness depends on it.

## 9. Targeted ads — the opt-out moment

Most state laws give a right to opt out of "targeted advertising" /
"profiling". Implications:

- Default targeted ads = OPT-OUT required (most states).
- Display the opt-out clearly (footer link is common).
- Honor GPC (universal opt-out).
- For sensitive data: targeted ads typically require OPT-IN.

## 10. Operational checklist (US + India)

- [ ] Privacy notice drafted, reviewed, layered UX
- [ ] Cookie / tracking consent banner (where required)
- [ ] GPC server + client detection
- [ ] Consumer rights self-service portal
- [ ] Verification flow for rights requests
- [ ] DSAR queue + 45-day SLA tracker
- [ ] Sensitive-data opt-in flow
- [ ] Subprocessor list public + maintained
- [ ] DPA template for all vendors
- [ ] DPDP-compliant notice + age-of-consent matrix
- [ ] Breach notification flow per state
- [ ] Privacy training for all teams handling data

## 11. When great-pm agents consume this skill

| Agent | What it pulls from here |
|---|---|
| consumer-app-pm-reviewer | Privacy notice + consent UX + DSAR portal |
| fintech-pm-reviewer | Sensitive-data treatment + state matrix |
| data-strategist | Sensitive-data opt-in design + vendor management |
| spec-writer | Consent UX patterns + opt-out flows + GPC respect |
| ai-ethics-pm | Sensitive-data fairness; profiling opt-out |

## 12. References

- CCPA + CPRA: cppa.ca.gov
- IAPP state tracker: iapp.org/resources/article/us-state-privacy-legislation-tracker
- GPC: globalprivacycontrol.org
- WA MHMDA: atg.wa.gov
- India DPDP: meity.gov.in

## 13. The honesty filter

If a privacy posture says "we comply with CCPA", that's table stakes; ask
about the next 14 states. The architecture must be multi-state by
default, not California-first then retrofit.