cg-web-privacy

Before any legal statement, Claude searches the web and checks the current state: EUR-Lex and gesetze-im-internet.de, the German data protection authorities and the DSK, the EDPB, relevant case law, and the official documentation of each provider in use. Blog posts and policy generators are not primary sources, and the result carries its research date and sources.

Claude inventories what the site really does: pages, forms, cookies, local and session storage, fonts, embeds, maps, videos, analytics, pixels, captchas, consent management, hosting, CDN, email and AI services. It checks the code too — dependencies, script tags, API routes, middleware, server actions — and records each processing with purpose, legal basis, recipients, transfers, retention and a status. Only verified or confirmed facts go into the final policy.

Storing or reading information on the device is one question; the processing of personal data that follows is another. Claude checks both, including local storage, SDKs, pixels and fingerprinting, not just classic cookies. Where consent is required, nothing that needs it loads before it, no category is pre-ticked, and withdrawing consent is as easy as giving it.

When a consent management system exists, provider, purpose, category, legal basis, storage mechanism, recipient and third country have to match everywhere. Claude checks all four directions: does the policy claim something the code doesn't do, does the code do something the policy leaves out, does the banner really block, and does the banner say the same as the policy?

Whatever it cannot find in the site, the code, the configuration or a reliable current source, the skill asks for — the controller, a data protection officer, the hosting provider, retention periods — in a compact table. Until then, the policy is not presented as finished:

The skill's default workflow. The text comes sixth: before it, the site is examined, the law researched, the processing inventoried and the gaps asked for; after it, the banner is checked against it and the final text is checked against the law again.