Specly
All specs
compliancemedium complexity

Consent & Privacy Management

Cookie consent, data-subject rights (export / deletion), residency, and retention controls to meet GDPR, CCPA, and COPPA obligations.

Options

Consent Scope & Presentation*

Single-accept banner on first visit; stores a consent cookie.
Separate toggles for necessary, analytics, marketing, and personalization cookies.
Detect visitor region (IP-based) and show full categorical consent only where required (EU, UK, California, Brazil).

Data-Subject Rights*

In-app flow that generates a downloadable archive of a user's data on request.
User-initiated delete flow that purges (or anonymizes) personal data within the configured window.
Replace personal identifiers with pseudonyms instead of hard-delete; preserves referential integrity in shared content.

Data Residency Model*

All customer data stored in one region (typically us-east-1 or eu-west-1).
Separate primary storage regions for EU and US tenants; workspace assigned to a region at creation.
Tenant picks region at setup; support for migration between regions with downtime window.

Governance & Audit

Published list of subprocessors with a mechanism to notify customers when new ones are added.
Scheduled jobs that delete or anonymize data older than the configured retention window per data type.
Per-user log of consent state changes with timestamp, source IP, and granted categories.
Age gate at signup; parental-consent flow for under-13 users or outright block.

Decision Points

Cookie/consent banner shown on first visit?

If yes

Required in EU, UK, and increasingly California. Ship a reject-all option equal in prominence to accept — regulators cite dark patterns regularly.

If no

Acceptable only for products with no cookies beyond strictly-necessary session cookies. Re-check after you add any analytics, A/B tooling, or ad pixels — you'll likely need one.

Granular per-category consent or blanket opt-in?

If yes

Granular (necessary / analytics / marketing / personalization). This is what GDPR enforcement assumes in 2026. Reject and accept must be equally prominent.

If no

A blanket opt-in banner is not GDPR-safe. Only acceptable in jurisdictions without category-level requirements — document this scoping explicitly.

Region-aware banner (EU only) or global prompt?

If yes

Best UX: IP-geolocate and show the full categorical banner only in regulated regions. Use a mature CMP (OneTrust, Osano) — rolling your own region logic is a common compliance hole.

If no

Global prompt is safer but hurts analytics coverage and bounce everywhere. Only choose it if your privacy posture is "we treat everyone to EU standards."

Honor Do-Not-Track / Global Privacy Control signals?

If yes

California's CPRA regulations now require honoring GPC. Treat GPC as an automatic reject for analytics and marketing categories. Log the signal receipt for audit.

If no

Not honoring GPC for California users is an active compliance risk. DNT is effectively dead but honoring it costs nothing.

Self-serve data export (DSR) in the app?

If yes

Async job that emails the user a signed download link when ready. Include all PII entities — profile, content, audit events, billing invoices. 30 days SLA for GDPR.

If no

A ticket-based DSR process works below ~10 requests/month. Automate before you scale — the response window is legally binding.

Self-serve account deletion or contact-required?

If yes

Self-serve with an irreversible confirmation step. Run the deletion as an async pipeline — synchronous deletes across billing/analytics/backups will time out.

If no

'Email us to delete' is increasingly cited as non-compliant. Acceptable only for early B2B where deletion is a quarterly event.

Hard-delete or soft-delete on account removal?

If yes

Hard-delete after a grace window (30 days for reversibility). Soft-delete alone is not GDPR-compliant — the data still exists. Schedule the hard-delete as a cron job.

If no

Anonymization (replace PII with pseudonyms, keep referential integrity) is the right pattern when content is shared with other users.

Anonymize or purge analytics on deletion?

If yes

Propagate deletion to every analytics and data-warehouse destination. Most analytics providers expose a user-deletion API (Amplitude, Mixpanel, Segment). Include these in your DSR pipeline.

If no

Leaving PII in analytics after account deletion is a common compliance gap and will fail an audit. Don't treat analytics as out-of-scope.

Block tracking until consent granted (consent-gated analytics)?

If yes

Gate analytics SDK init on consent state. Google Consent Mode and Segment Consent Manager exist for exactly this; do not reinvent.

If no

Tracking before consent is the most common GDPR violation found in audits. Do not ship analytics unconditionally in EU-served regions.

Publish a subprocessor list and notify on changes?

If yes

Ship /subprocessors as a public page plus an email opt-in for change notifications. Enterprise DPAs will require a 30-day advance-notice clause regardless.

If no

Fine pre-revenue; the first enterprise deal will require it. Build the page before you need it so legal review isn't blocking the deal.

Offer data residency (EU-only, US-only) as a setting?

If yes

Single regional split (EU / US) covers 90% of residency-driven deals. Customer-configurable residency is a significantly bigger lift and only worth it for Germany-only / Canada-only type deals.

If no

Single-region is fine until a specific enterprise buyer requires otherwise. Flag residency early in enterprise deals — it's a long lead-time engineering project.

COPPA flows for under-13 users?

If yes

Parental-consent flow (verified via credit card or signed form) plus restricted data collection. Expensive to implement correctly — most companies outright ban under-13 users in TOS instead.

If no

TOS ban on under-13 users plus an age gate at signup is the standard approach. Enforce the gate — an unenforced TOS clause does not insulate you from a COPPA complaint.

Age gate before signup?

If yes

Date-of-birth field before account creation with explicit block for users under the TOS minimum. Don't rely on a checkbox — a DOB field is defensible.

If no

Acceptable for B2B products that are plainly work tools. Revisit the moment a consumer or education angle appears.

Automated retention-based purges for old data?

If yes

Per-entity retention policies (sessions: 90d, logs: 1y, tickets: 3y) run as scheduled jobs. GDPR storage-limitation principle expects you to have and enforce a policy.

If no

Indefinite retention is a direct GDPR violation. Even if you never get audited, it inflates your breach blast-radius.

Keep an audit trail of consent changes per user?

If yes

Immutable log of consent events (timestamp, IP, categories granted/revoked, source) exposed to the user in privacy settings. Essential to defend against "I never consented" complaints.

If no

Without a trail you cannot prove valid consent — regulators will side with the complainant by default.

Tradeoffs

ComplexityGranular consent categories enabled

Analytics and marketing pixels must gate on consent state — non-trivial client-side plumbing

CostEU/US residency split

Duplicated infrastructure, regional DR, and tenant-region routing — one of the heaviest ops investments

ComplexitySelf-serve deletion enabled

Cascading deletes across billing, analytics, backups, and audit logs must be designed — not a button

UXRegion-aware banners

Non-EU users see no banner — lower bounce and higher consent-to-analytics rates

Dependencies

user-system

Implementation Examples

OneTrust

Enterprise privacy platform covering consent management, DSR automation, and subprocessor tracking.

Osano

Mid-market CMP with auto-scanning of third-party scripts and region-aware banners.

Cookiebot

Scanner-driven cookie consent — discovers trackers on your site and auto-categorizes them in the banner.

Didomi

Consent and preference management with strong TCF-framework support for advertising use cases.

DataGrail

DSR automation that connects to SaaS systems of record so deletion and export flow across the stack.