/policy-monitor

Sweep mode (no argument or --sweep):

1. Read ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md → outputs folder path, policy document, last sweep date.
2. Run the workflow below. Scan outputs folder for files since last sweep.
3. For each output: extract approved practices → diff against current policy commitments.
4. Classify gaps: REQUIRED (policy misrepresents current practice) vs ADVISABLE (policy silent).
5. For each gap: quote current policy, describe gap, draft suggested language.
6. Update Last policy sweep date in ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md.

Direct query mode (with description argument):

1. Read ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md → current policy commitments + actual policy document.
2. Parse proposed practice. Diff against policy: data categories, purposes, third parties, retention, user rights, disclosure.
3. Output: covered / missing / conflicting + suggested language for each gap + timing recommendation.

Schedule: Set up a recurring reminder in your own scheduler (calendar, task manager, or CI) to run /privacy-legal:policy-monitor weekly. Scheduled execution requires a scheduled-tasks integration, which is not bundled with this plugin.

/privacy-legal:policy-monitor
/privacy-legal:policy-monitor "We want to start using behavioral data to personalize onboarding emails"

Privacy Policy Monitor

Purpose

Privacy policies drift from practice in one direction: practice moves forward, policy stays behind. A PIA approves a new data category. A DPA is signed with a subprocessor not listed anywhere. A triage result marks a new use case conditional with a disclosure requirement that the policy doesn't yet make. Months later, someone reads the policy and it doesn't reflect what actually happens.

This skill catches the drift before it becomes a problem — either by crawling the outputs folder weekly, or by answering the direct question: "we're about to start doing X, what does that mean for the policy?"

The output is always the same: here's the gap, here's the suggested language.

Load current state

Read ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md:

• ## Who we are → ## Regulatory footprint — the regimes in scope (GDPR, CCPA / CPRA / other state consumer privacy, GLBA, HIPAA, FERPA, COPPA, VPPA, CPNI, etc.)
• ## Privacy policy commitments — the commitments extracted from the published policy
• ## Outputs — outputs folder path, policy document location, last sweep date

If ## Outputs contains [PLACEHOLDER]:

"Outputs aren't configured yet. I can still run a direct-query check — describe what you're planning to do and I'll diff it against your current policy. To enable the crawl sweep, run /privacy-legal:cold-start-interview and provide the outputs folder path."

Read the actual privacy policy document from the path in ## Outputs → Privacy policy document. The commitments in the config CLAUDE.md are a summary; the actual document is authoritative for suggesting edits.

Privacy commitments live on multiple surfaces — sweep all of them

The website privacy policy is one surface. Modern privacy programs make binding commitments in at least four more places that regulators actively scrutinize for inconsistencies:

1. Cookie consent banners / CMPs. The consent management platform promises specific cookie categories and purposes. If the privacy policy says "we use analytics cookies" and the CMP offers "strictly necessary only," there's a conflict. EU DPAs and the FTC have both enforced against CMP misconfigurations.

…