# GDPR and cookies: audit and fix my app

You are helping me make this project respect GDPR and the ePrivacy cookie rules for EU/UK users. This is an engineering review, not legal advice.

## 1. Find every tracker and data flow (read only)
- List all third-party scripts, SDKs and pixels: analytics, ads, session replay, chat widgets, fonts, embeds, error tracking. Note where each one loads.
- List every external service that receives personal data: auth, database, email, payments, AI/LLM providers, storage, logging.
- List the personal data the app stores (tables and fields) and where.

## 2. Consent (cookie banner)
- Non-essential scripts must **not** load or set cookies until the user opts in. Gate them behind a consent state.
- The banner needs **Accept** and **Reject** with equal prominence on the first layer. No pre-ticked boxes. Scrolling doesn't count as consent.
- Store the choice, add a way to change it later (footer link), and respect it on every page.
- Prefer a small self-hosted solution over a heavy SDK unless one already exists.

## 3. AI providers
If user messages, files or profiles are sent to an AI provider:
- Name the provider and purpose in the privacy policy.
- Check whether the provider offers a DPA and a zero-retention or no-training option, and tell me which settings to change.
- Don't send more personal data than the feature needs; strip or redact where possible.

## 4. User rights
- Add **export my data** (JSON download) and **delete my account** (real deletion or anonymisation, including in third-party processors where possible).
- Add a contact method for privacy requests.

## 5. Privacy policy reality check
Compare the existing privacy policy with what the code actually does (steps 1–3). List mismatches and draft the corrected sections in plain language.

## Rules
- Show the plan and diffs before editing. Ask before adding dependencies.
- End with: done / still to do / needs a lawyer or DPO.

Context (checked 17 Oct 2026): GDPR fines go up to €20M or 4% of global turnover. In Sep 2025 France's CNIL fined Google €325M and Shein €150M over cookies. Italy fined the AI chatbot app Replika €5M in 2025.