Analyze

Analyze a statute against the conduct you actually have

Breaks a statute into elements, exceptions, and definitional traps, then says plainly whether your client's conduct is covered, clear, or a genuine close call.

About 14 minintermediateRegulatory, In-house

Your prompt5,224 characters

Still to fill in: Statute or regulation, Conduct you are testing, Jurisdiction

RoleYou are a regulatory lawyer who maps a statute into elements and exceptions before forming any view of it. You read the operative text first, the definitions section second, agency guidance third, and your instinct last, because in regulatory work the answer usually hides in a definition, not in the prohibition. You do not call a close question clean, and you never let a summary of the statute masquerade as an application of it.What I needTake the statute below and tell me whether it reaches Conduct you are testing in Jurisdiction. I act for Who you act for. Calibrate the reading you recommend to this risk posture: aggressive.InputsStatute or regulation: Statute or regulation Conduct being tested: Conduct you are testing Jurisdiction: Jurisdiction Who I act for: Who you act for Risk posture: aggressiveHow to work this1. List the elements as a numbered set, each with the operative text quoted and its subsection cite. Where an element comes from the definitions section rather than the prohibition, mark it. That is usually where coverage turns. 2. State scope in three parts: who is a covered party, what conduct triggers the obligation, and what nexus Jurisdiction needs to reach this client. 3. Quote every exception and safe harbor with its section number, and name who carries the burden of establishing each one. 4. Identify at least two definitional traps: defined terms whose statutory meaning is broader or narrower than the ordinary word. If there genuinely are none, say so rather than manufacturing one. 5. Separate the text from the agency's position. Where guidance or an enforcement posture reaches past the words, label it as the agency's view, not as law. 6. Apply the statute to Conduct you are testing element by element, then commit to exactly one of: Covered / Not covered / Close call. If close call, name the single fact that would move it either direction. 7. State enforcement exposure in the statute's own numbers: penalty per violation, per day, aggregate cap, cure period, and whether a private right of action exists or enforcement is agency-only.Ask me firstBefore you analyze anything, ask me these questions, then stop and wait: 1. Which text am I working from (the enacted statute, the implementing regulation, or agency guidance) and as of what date? Amendments and rulemakings change the answer. 2. Is the client already a covered entity under this scheme, or is threshold coverage itself the question I am asking? 3. What has the agency already said about conduct like this: enforcement actions, advisory opinions, no-action letters, consent decrees you have in hand? 4. Is the decision "can we do this at all" or "how do we do this defensibly," and is there still a cure period or notice window available? Do not begin until I answer. If I tell you to proceed anyway, state each assumption at the top of your output and mark it [ASSUMPTION - verify].Output formatOpen with the bottom line in two sentences: covered, not covered, or close call, and why. Then: full citation; scope paragraph; numbered elements with quoted text; exceptions and safe harbors; definitional traps; text-versus-agency-position; open questions; enforcement exposure with figures; and the element-by-element application. Close with the assumptions the analysis rests on. End with one line naming the two of my answers that most changed the conclusion, and whether the call would still have been Covered / Not covered / Close call without them. If an answer changed nothing, say so. It means I should not have been asked.Never do this- If your analysis would read the same for any company facing any regulator, it is too generic. You have summarized the statute instead of applying it. Start over from the conduct I described. - No hedging filler. Cut "arguably," "it should be noted," "it depends," and "this is a gray area" used in place of naming what makes it gray. Do not tell me to consult an attorney. I am the attorney advising this client. - Every subsection, regulation, case, or agency document you cite must come from my inputs or be marked [UNVERIFIED - check the current text before advising]. Never invent a section number, a penalty figure, or a quotation from an agency release. - Where you do not know whether the agency or a court has resolved a question, say you do not know. Do not smooth over an open question with fluent prose. The open question is the client's actual risk. - Do not pad. If the statute plainly does not reach this conduct, say so in three sentences and stop. Length is not value.Before you answer- Did I quote operative text with a subsection cite for every element, or did I paraphrase my way through? - Have I named at least two definitional traps, or said honestly that there are none? - Is any section number, penalty amount, or agency document unmarked and unverified? - Would this read the same for entirely different conduct under the same statute? It should not. - Did I commit to Covered / Not covered / Close call, and for a close call, name the one fact that flips it?

Adds driver's-seat tunes: options instead of answers, questions before work, every citation flagged. Your values come with it.

Pressure-test it

Makes the AI switch hats and attack its own answer.

The enforcement attorney at the agency that administers this statute is measured on charging decisions, reads definitions expansively, and has brought this theory before. Build the most aggressive reading that pulls the conduct inside the statute, and name the document or data point they would subpoena first to prove it. Then come back as the client's lawyer and rewrite the application section to meet that reading. Finish by telling me the smallest operational change that would put the client cleanly outside the statute.

Go deeper

Pushes the work further once the basics are right.

No one in operations has a law degree, and no one there reads past the first page. Turn this into a one-page memo the client's operations lead can act on: the rule in plain English, the bottom-line conclusion, the three things they must change this quarter with an owner for each, the three things to stop doing immediately, and the trigger that would require them to come back to us.

Before you run it

What to gather first

The statutory or regulatory text, or a full citation with the version date
The specific conduct you are testing, described operationally rather than in legal labels
The jurisdiction, and whether a federal scheme is layered over a state one
Any agency guidance, advisory opinion, or enforcement action you already have
Whether the client is already a regulated entity or whether threshold coverage is the question

Watch for

Statutes and rules get amended and regulations get repromulgated. Confirm you are working from the current text and effective date before advising anyone.
Agency guidance, FAQs, and enforcement positions routinely reach further than the statutory text. Treat them as the agency's view, and check whether a court has ever endorsed it.
State schemes often layer on top of federal ones with different definitions and lower thresholds. Coverage under one says nothing about the other.
The model will state penalty figures and subsection numbers with total confidence. Verify every one against the code before it goes in a memo.
Do not paste client-identifying facts or product data into a general model unless your firm's AI policy and the client's engagement terms allow it.

What comes back

A two-sentence bottom line, then the full citation, a scope paragraph, numbered elements with quoted operative text and subsection cites, exceptions and safe harbors with burden allocation, definitional traps, a text-versus-agency-position split, open questions, enforcement exposure in the statute's own figures, and an element-by-element application ending in Covered / Not covered / Close call. Closes with the assumptions relied on.

See an example of what you’ll get

*(After you answer the four questions: you are working from the enacted CCPA as amended by the CPRA rather than the CPPA's regulations, the client is already a covered business so threshold coverage is not the question, you hold no agency guidance or enforcement action on conduct like this, and the decision is "how do we do this defensibly" rather than "can we do this at all.")* Bottom line. Close call, leaning covered. The transfer is almost certainly a "share" for cross-context behavioral advertising even though no money changes hands, and the aggregation carve-out does not survive the hashed email addresses. Citation. Cal. Civ. Code §§ 1798.100, 1798.120, 1798.140 (CCPA as amended by CPRA, eff. Jan. 1, 2023). Scope. A "business" doing business in California that meets one of three thresholds: over $25M gross annual revenue, personal information of 100,000+ consumers or households, or 50%+ of revenue from selling or sharing personal information. § 1798.140(d)(1). At $40M revenue the client clears the first threshold on its own. Elements of "share." 1. *Personal information*: "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." § 1798.140(v)(1). 2. *Disclosure to a third party*: "sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means." § 1798.140(ah)(1). 3. *For cross-context behavioral advertising*: targeting based on activity across nonaffiliated sites. § 1798.140(k). 4. Consideration is not an element of "share," unlike "sell." § 1798.140(ah)(1) ("whether or not for monetary or other valuable consideration"). Definitional traps. - "Share" does not require payment. The client's belief that receiving no money keeps them out of scope is the single biggest error in the current posture. - "Personal information" expressly includes "inferences drawn" and household-level data, § 1798.140(v)(1)(K), so the returned audience segments are themselves personal information coming back in. - "Deidentified" under § 1798.140(m) requires reasonable measures plus a public commitment plus contractual downstream obligations. A hash is a pseudonym, not deidentification. Text versus agency position. The CPPA's rulemaking on ADMT and risk assessments treats hashed identifiers as personal information; no California court has squarely held so [UNVERIFIED - confirm current CPPA regulation text before advising]. Enforcement. CPPA administrative enforcement plus AG civil actions: up to $2,500 per violation, $7,500 per intentional violation or violation involving a minor. § 1798.155(a). Private right of action limited to data breaches under § 1798.150, not to sharing violations. Application. Element 1 met (hashed email is reasonably linkable). Element 2 met. Element 3 turns on whether the vendor uses the data to target on nonaffiliated properties: the one fact that flips this. If the vendor's use is confined to measurement of the client's own site, this falls outside "share" and inside the § 1798.140(ag) service-provider path, but only if the contract carries the required restrictions. Assumptions. The vendor contract was not provided [verify - service-provider status lives or dies on its terms]. I assumed the hashes are SHA-256 of raw email without salting [verify]. What your answers changed. "Already a covered business" is what let this memo spend itself on the meaning of "share" instead of on the § 1798.140(d)(1) thresholds. If coverage were the open question, the $40M revenue line would be the whole analysis and everything after it would be conditional. "How do we do this defensibly" is why the application ends on the service-provider path and the vendor contract rather than on a recommendation to stop the transfer; on "can we do this at all" the answer to you is simply yes, with exposure. Your answer that you hold no agency guidance changed nothing except to leave the CPPA line marked [UNVERIFIED]. I had nothing to check it against either way.

Why this prompt is built the way it is

## Framework 1. **Elements from the operative text.** A numbered list, each element quoted with its subsection cite. Where an element comes from a definition rather than the prohibition, say so. That is where coverage usually turns. 2. **Scope in three parts.** Who is a covered party, what conduct triggers the obligation, and what territorial or transactional nexus the jurisdiction needs to reach it. 3. **Exceptions and safe harbors.** Quoted, with section number, plus who carries the burden of establishing each one. 4. **Definitional traps.** Defined terms whose statutory meaning is broader or narrower than the ordinary word. Name at least two, or say honestly there are none. 5. **Text versus agency position.** Where guidance, an FAQ, or an enforcement posture extends past the text, label it as the agency's view, not as law. 6. **Enforcement in numbers.** Agency, civil or criminal, penalty per violation and per day, aggregate caps, cure periods, and whether there is a private right of action. 7. **Apply and commit.** Covered / Not covered / Close call. A close call must name the single fact that would move it either direction.