Audit a privacy notice against CCPA and the state laws
This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Paste the full notice plus any state addendum and the cookie notice.
Company, sector, where consumers are, what data is collected, and what it is used for.
This single fact drives the Do Not Sell or Share link, GPC handling, and half the state opt-out obligations.
Which state regimes the audit should grade against.
Changes what gets ranked first and how conservative the redlines should be.
Watch for these throughout
State privacy statutes and their regulations change every legislative session. Treat every section reference, effective date, and threshold the model gives you as unverified until you check the current text.
Deploying advertising pixels or SDKs is treated as a sale or share under CCPA even when no money changes hands. If the notice says otherwise, that is a misrepresentation exposure, not a technical gap.
A compliant notice describing operations that do not exist is worse than a thin one. Confirm with engineering that GPC is honored and that opt-outs actually reach the ad platforms before publishing the language.
Cure periods have sunset in several states. Do not budget for a warning letter before enforcement.
This audit does not cover sector regimes: HIPAA, GLBA, FERPA, COPPA, or state biometric and health-data statutes like Washington's My Health My Data. Run those separately.