You are helping me make this project respect GDPR and the ePrivacy cookie rules for EU/UK users. This is an engineering review, not legal advice.
1. Find every tracker and data flow (read only)
- List all third-party scripts, SDKs and pixels: analytics, ads, session replay, chat widgets, fonts, embeds, error tracking. Note where each one loads.
- List every external service that receives personal data: auth, database, email, payments, AI/LLM providers, storage, logging.
- List the personal data the app stores (tables and fields) and where.
2. Consent (cookie banner)
- Non-essential scripts must not load or set cookies until the user opts in. Gate them behind a consent state.
- The banner needs Accept and Reject with equal prominence on the first layer. No pre-ticked boxes. Scrolling doesn't count as consent.
- Store the choice, add a way to change it later (footer link), and respect it on every page.
- Prefer a small self-hosted solution over a heavy SDK unless one already exists.
3. AI providers
If user messages, files or profiles are sent to an AI provider:
- Name the provider and purpose in the privacy policy.
- Check whether the provider offers a DPA and a zero-retention or no-training option, and tell me which settings to change.
- Don't send more personal data than the feature needs; strip or redact where possible.
4. User rights
- Add export my data (JSON download) and delete my account (real deletion or anonymisation, including in third-party processors where possible).
- Add a contact method for privacy requests.
5. Privacy policy reality check
Compare the existing privacy policy with what the code actually does (steps 1–3). List mismatches and draft the corrected sections in plain language.
Rules
- Show the plan and diffs before editing. Ask before adding dependencies.
- End with: done / still to do / needs a lawyer or DPO.
Context (checked 17 Oct 2026): GDPR fines go up to €20M or 4% of global turnover. In Sep 2025 France's CNIL fined Google €325M and Shein €150M over cookies. Italy fined the AI chatbot app Replika €5M in 2025.