@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/skills/salesforce/salesforce-marketing-consent-review-skill/references/consent-anti-patterns.md

@@ -0,0 +1,247 @@
+# Consent Anti-Patterns Reference
+
+Common consent management mistakes that create regulatory violations,
+trust failures, or data integrity problems.
+
+---
+
+## 1. Soft Opt-In Misuse
+
+### Description
+"Soft opt-in" is a specific exception under the UK's Privacy and Electronic
+Communications Regulations (PECR) and similar rules. It permits sending
+commercial messages to existing customers about similar products WITHOUT
+explicit prior consent, provided an opt-out was offered at the time of data
+collection.
+
+### What Constitutes Valid Soft Opt-In
+
+All conditions must be satisfied:
+1. Contact details obtained during a **sale or negotiation of a sale**.
+2. Marketing is **only for similar products or services** to what was purchased.
+3. The individual was **given a clear opportunity to opt out** at collection.
+4. An **opt-out mechanism exists in every message**.
+
+### Common Misuses
+
+| Misuse | Why It Fails |
+|--------|-------------|
+| Applying soft opt-in to contacts obtained from bought lists | Not obtained during a sale |
+| Marketing unrelated products using soft opt-in basis | Must be "similar products" only |
+| Using soft opt-in for B2C contacts under GDPR | GDPR requires explicit consent; soft opt-in is a PECR concept |
+| Failing to provide opt-out at collection point | Invalidates the soft opt-in basis |
+| Treating "gave us their card at a conference" as soft opt-in | No sale/negotiation occurred |
+
+### Salesforce Data Model Check
+
+```sql
+-- Find contacts with soft-opt-in consent basis where lawful basis is unverified
+SELECT Id, Name, Email, ConsentBasis__c, ConsentCaptureSource__c,
+       ConsentCaptureDate__c
+FROM Contact
+WHERE ConsentBasis__c = 'SoftOptIn'
+  AND (ConsentCaptureSource__c = null OR ConsentCaptureDate__c = null)
+```
+
+---
+
+## 2. Pre-Checked Consent Boxes
+
+### Description
+Consent forms that preselect the marketing consent checkbox, requiring
+users to actively uncheck to opt out rather than actively check to opt in.
+
+### Why It Is Invalid
+
+Under GDPR Article 7 and Recital 32, consent must be given by a "clear
+affirmative act". Pre-ticked boxes do not constitute affirmative action and
+are explicitly prohibited.
+
+Under CASL, consent obtained via a pre-checked box is **not valid express consent**.
+
+### Detection
+
+Review all forms, landing pages, and registration flows:
+- Web-to-Lead forms (Setup > Web-to-Lead)
+- Marketing Cloud CloudPages and Smart Capture forms
+- Custom LWC or VisualForce forms
+
+Checklist item: every marketing consent checkbox must have `checked="false"`
+(or no `checked` attribute) by default.
+
+### Correct HTML Pattern
+```html
+<!-- WRONG: pre-checked -->
+<input type="checkbox" name="marketingConsent" checked="checked">
+<label>Send me marketing communications</label>
+
+<!-- CORRECT: unchecked by default -->
+<input type="checkbox" name="marketingConsent">
+<label>Yes, I would like to receive marketing communications about [specific products].</label>
+```
+
+---
+
+## 3. Missing Consent Withdrawal Mechanism
+
+### Description
+Users cannot easily opt out of marketing communications, or the opt-out
+mechanism is obscured, dysfunctional, or not honored consistently across
+all channels.
+
+### Regulatory Requirements
+
+| Regulation | Opt-Out Deadline | Mechanism Requirement |
+|-----------|-----------------|----------------------|
+| GDPR | Without undue delay | Must be as easy as giving consent |
+| CAN-SPAM | 10 business days | Clear opt-out in every email |
+| CASL | 10 business days | Unsubscribe link in every CEM |
+| CCPA | 15 business days | Conspicuous "Do Not Sell/Share" link |
+
+### Anti-Patterns
+
+1. **Opt-out link buried in 6pt font at bottom of email:** Fails "as easy to withdraw as to give" requirement.
+2. **Opt-out requires creating an account:** Illegal friction under GDPR.
+3. **Opt-out confirmation page has re-subscribe push:** Acceptable if not coercive; review wording.
+4. **Opt-out updates only Marketing Cloud but not Salesforce CRM:** Cross-system sync gap means the contact may be re-added to future lists.
+5. **Opt-out requires customer service call or email:** Must be automated; human-in-the-loop opt-out processes are too slow.
+
+### Cross-System Sync Verification
+
+```sql
+-- Find contacts opted out in MC but still active in CRM (sync gap)
+-- This query assumes a custom field tracking MC opt-out sync
+SELECT Id, Email, HasOptedOutOfEmail, MCOptOutSyncStatus__c, LastMCOptOutDate__c
+FROM Contact
+WHERE HasOptedOutOfEmail = false
+  AND MCOptOutSyncStatus__c = 'OptedOut'
+```
+
+---
+
+## 4. Stale Consent
+
+### Description
+Consent captured years ago is treated as perpetually valid without considering
+whether the individual's circumstances or the processing purpose has changed.
+
+### Why Stale Consent Is a Risk
+
+Under GDPR Recital 171, when the original basis for consent changes, new consent
+is required. Additionally, inactive contacts who consented years ago and have
+not engaged may no longer reasonably expect to receive marketing.
+
+### CASL-Specific Rule
+
+Implied consent under CASL expires after 2 years from the last transaction.
+Express consent does not expire unless withdrawn.
+
+### Identifying Stale Consent
+
+```sql
+-- GDPR context: consent older than 2 years with no engagement
+SELECT cp.Id, cp.EmailAddress, cpc.CaptureDate, cpc.PrivacyConsentStatus,
+       c.LastActivityDate
+FROM ContactPointConsent cpc
+JOIN ContactPointEmail cp ON cpc.ContactPointId = cp.Id
+JOIN Contact c ON cp.IndividualId = c.IndividualId
+WHERE cpc.PrivacyConsentStatus = 'OptIn'
+  AND cpc.CaptureDate < LAST_N_YEARS:2
+  AND c.LastActivityDate < LAST_N_YEARS:2
+ORDER BY cpc.CaptureDate ASC
+LIMIT 500
+```
+
+### Remediation: Consent Re-Engagement Campaign
+
+Before bulk opt-out of stale contacts:
+1. Send a single re-confirmation email ("Are you still interested in hearing from us?").
+2. Only contacts who click re-confirm are retained as opt-in.
+3. Contacts who do not respond within 30 days are moved to `NotSeen` status.
+4. Document the re-engagement process for compliance record.
+
+---
+
+## 5. Bundle Consent (All or Nothing)
+
+### Description
+Consent for marketing is bundled with consent for terms of service, product
+use, or other processing. Users cannot selectively consent to marketing while
+accepting the terms.
+
+### Why It Is Invalid
+
+GDPR Article 7(2): "If the data subject's consent is given in the context of a
+written declaration which also concerns other matters, the request for consent
+shall be presented in a manner which is clearly distinguishable from the other
+matters."
+
+Bundled consent is not "freely given" because refusal of marketing consent would
+prevent acceptance of the service.
+
+### Correct Form Design
+```
+[  ] I accept the Terms of Service and Privacy Policy (required)
+
+--- Marketing Communications ---
+[  ] I would like to receive product updates by email (optional)
+[  ] I would like to receive SMS offers (optional)
+[  ] I would like to receive personalized recommendations (optional)
+```
+
+Each marketing option must be independently selectable and optional.
+
+---
+
+## 6. Consent Without Purpose Specification
+
+### Description
+Consent is recorded as "marketing consent" without specifying which types
+of marketing, which channels, and which sender entity.
+
+### Why It Is a Problem
+
+Under GDPR, consent must be **specific** to a purpose. Blanket "marketing consent"
+is too vague if the same consent is used for:
+- Product newsletters (via email).
+- SMS promotions (different channel).
+- Profiling for personalization (different processing activity).
+- Third-party data sharing for joint campaigns (different legal entity).
+
+### Correct Approach
+
+Separate `ContactPointConsent` records for each purpose + channel combination:
+
+```
+ContactPointConsent record 1:
+  ContactPointId = [email address]
+  DataUsePurpose = "Monthly Newsletter"
+  PrivacyConsentStatus = OptIn
+
+ContactPointConsent record 2:
+  ContactPointId = [email address]
+  DataUsePurpose = "Product Promotional Offers"
+  PrivacyConsentStatus = OptOut
+
+ContactPointConsent record 3:
+  ContactPointId = [phone number]
+  DataUsePurpose = "SMS Marketing"
+  PrivacyConsentStatus = OptIn
+```
+
+---
+
+## Consent Anti-Pattern Summary
+
+| Anti-Pattern | Regulation Violated | Severity |
+|-------------|--------------------|---------|
+| Pre-checked boxes | GDPR, CASL | CRITICAL |
+| Bundle consent with T&C | GDPR | HIGH |
+| Soft opt-in misapplied | PECR/UK GDPR, CASL | HIGH |
+| Stale consent treated as valid | GDPR, CASL implied expiry | HIGH |
+| Missing opt-out mechanism | CAN-SPAM, CASL, GDPR | CRITICAL |
+| Opt-out not honored in all systems | All regulations | CRITICAL |
+| No consent purpose specification | GDPR | HIGH |
+| Consent obtained via coercion | GDPR | CRITICAL |
+| No consent withdrawal record | GDPR Art 7(1), CASL | HIGH |
+| Withdrawal mechanism requires account creation | GDPR | HIGH |

package/skills/salesforce/salesforce-marketing-consent-review-skill/references/consent-model-reference.md

@@ -0,0 +1,205 @@
+# Consent Model Reference
+
+Reference for Salesforce's consent data model covering the Individual object,
+Contact Point Consent, Communication Subscription objects, and their
+relationships to Contact/Lead records.
+
+---
+
+## Core Consent Objects
+
+Salesforce provides a built-in consent data model in the core platform.
+This model is extended by Marketing Cloud
+and the Health/Financial cloud products.
+
+### Object Map
+
+```
+Contact / Lead / Person Account
+    |
+    v
+Individual (1:1 linked via IndividualId field)
+    |
+    +-- ContactPointConsent (per contact point + purpose)
+    |       |-- ContactPointEmail
+    |       |-- ContactPointPhone
+    |       |-- ContactPointAddress
+    |
+    +-- IndividualHistory (audit changes to Individual record)
+
+Communication Subscription Type (catalog of subscription types)
+    |
+    v
+Communication Subscription (per Individual + Type)
+    |
+    v
+Communication Subscription Channel Type (per channel: email, SMS, push)
+```
+
+---
+
+## Individual Object
+
+The `Individual` sObject is the hub of the consent data model.
+Every Contact or Lead that requires consent management should be linked to an
+Individual record via the `IndividualId` lookup field.
+
+### Key Fields
+
+| Field | API Name | Purpose |
+|-------|----------|---------|
+| Name | `Name` | Individual identifier (typically mirrors Contact name) |
+| Don't Process | `HasOptedOutOfProcessing` | Global processing opt-out |
+| Don't Market | `HasOptedOutOfSolicitationn` | Global marketing opt-out |
+| Don't Profile | `HasOptedOutOfProfiling` | Profiling/segmentation opt-out |
+| Don't Track | `HasOptedOutOfTracking` | Web tracking opt-out |
+| Forget | `ShouldForget` | Erasure request flag |
+| Birth Date | `BirthDate` | Age verification for minor consent |
+| Death Date | `DeathDate` | Deceased flag |
+
+### Querying Individual-Contact Relationship
+```sql
+SELECT Id, IndividualId, Individual.HasOptedOutOfProcessing,
+       Individual.HasOptedOutOfSolicitationn
+FROM Contact
+WHERE Id IN :contactIds
+```
+
+---
+
+## ContactPointConsent Object
+
+`ContactPointConsent` records store granular consent for a specific contact
+point (email address, phone number) and a specific data use purpose.
+
+### Key Fields
+
+| Field | API Name | Type | Purpose |
+|-------|----------|------|---------|
+| Contact Point | `ContactPointId` | Polymorphic lookup | Which email/phone/address |
+| Data Use Purpose | `DataUsePurposeId` | Lookup | Consent purpose |
+| Capture Date | `CaptureDate` | DateTime | When consent was captured |
+| Capture Source | `CaptureSource` | Text | Where consent was captured (form URL, event, etc.) |
+| Privacy Consent Status | `PrivacyConsentStatus` | Picklist | OptIn / OptOut / NotSeen / Seen |
+| Effective From | `EffectiveFrom` | DateTime | When consent takes effect |
+| Effective To | `EffectiveTo` | DateTime | When consent expires |
+
+### Consent Status Values
+
+| Status | Meaning |
+|--------|---------|
+| `OptIn` | Explicit opt-in; can send |
+| `OptOut` | Explicit opt-out; must not send |
+| `NotSeen` | Individual has not been presented with consent request |
+| `Seen` | Individual saw the consent request but did not act |
+
+**Best practice:** Only send to contacts with `PrivacyConsentStatus = 'OptIn'`
+for regulated channels. `NotSeen` and `Seen` are ambiguous and should be
+treated as opt-out in GDPR/CASL contexts.
+
+---
+
+## ContactPointEmail and ContactPointPhone
+
+These objects store individual contact points (distinct from the Email field on Contact).
+
+```sql
+-- Find all email contact points for a contact
+SELECT Id, EmailAddress, Individual.Name, Individual.HasOptedOutOfSolicitationn
+FROM ContactPointEmail
+WHERE IndividualId IN (
+    SELECT IndividualId FROM Contact WHERE Id IN :contactIds
+)
+```
+
+A Contact may have multiple ContactPointEmail records (work, personal, newsletter
+address). Consent should be tracked at this granularity.
+
+---
+
+## Communication Subscription Model
+
+The Communication Subscription model provides a catalog-based approach to
+managing preferences for named subscription types.
+
+### Objects
+
+| Object | Purpose |
+|--------|---------|
+| `CommSubscription` | Defines a named subscription type (e.g., "Monthly Newsletter") |
+| `CommSubscriptionConsent` | Records an Individual's consent for a subscription |
+| `CommSubscriptionChannelType` | Maps a subscription type to a channel (Email, SMS, Push) |
+| `CommSubscriptionTiming` | Frequency preferences (daily, weekly, monthly) |
+
+```sql
+-- Get all active subscriptions with their channel types
+SELECT Id, Name,
+       (SELECT Id, ChannelType, CommChannelTypeName
+        FROM CommSubscriptionChannelTypes)
+FROM CommSubscription
+WHERE Status = 'Active'
+```
+
+---
+
+## Salesforce Marketing Cloud Consent Integration
+
+
+In orgs using Marketing Cloud with a Salesforce connector (Marketing Cloud
+Connect or the newer Marketing Cloud Account Engagement / MCAE):
+
+| MC Object | Core Object Counterpart | Sync Direction |
+|-----------|------------------------|----------------|
+| EmailOptIn/OptOut | Individual.HasOptedOutOfSolicitationn | Bidirectional |
+| Subscription status | CommSubscriptionConsent | Configurable |
+| SMS opt-in | ContactPointPhone + ContactPointConsent | Core to MC |
+
+**Key review point:** Verify that opt-out signals from Marketing Cloud propagate
+to the Salesforce core Individual object and vice versa. Unidirectional sync
+can result in opt-out honors on one platform but sends on another.
+
+---
+
+## Consent Data Queries for Review
+
+### Find contacts without Individual records
+```sql
+SELECT Id, Name, Email
+FROM Contact
+WHERE IndividualId = null
+AND Email != null
+LIMIT 500
+```
+
+### Find opt-outs that may still be receiving communication
+```sql
+SELECT c.Id, c.Email, c.Name, i.HasOptedOutOfSolicitationn
+FROM Contact c
+JOIN Individual i ON c.IndividualId = i.Id
+WHERE i.HasOptedOutOfSolicitationn = true
+  AND c.HasOptedOutOfEmail = false
+```
+Mismatch between `Individual.HasOptedOutOfSolicitationn` and `Contact.HasOptedOutOfEmail`
+is a data integrity finding.
+
+### Find expired consent
+```sql
+SELECT Id, ContactPointId, PrivacyConsentStatus, EffectiveTo
+FROM ContactPointConsent
+WHERE EffectiveTo < TODAY
+  AND PrivacyConsentStatus = 'OptIn'
+```
+Expired opt-in consent should be treated as `NotSeen` until re-confirmed.
+
+---
+
+## Consent Model Review Checklist
+
+- [ ] All Contacts with email addresses have an `IndividualId` set.
+- [ ] `ContactPointConsent` records exist for each ContactPointEmail.
+- [ ] Consent capture date and source are recorded on every `ContactPointConsent`.
+- [ ] Opt-out values are synchronized between `Individual` and `Contact` objects.
+- [ ] Expired consent is not treated as active opt-in.
+- [ ] Communication Subscription model in use (not just field-level opt-out).
+- [ ] Consent records are immutable / append-only (history preserved, not overwritten).
+- [ ] Consent withdrawal mechanism captures the withdrawal date and source.

package/skills/salesforce/salesforce-marketing-consent-review-skill/references/regulatory-mapping.md

@@ -0,0 +1,192 @@
+# Regulatory Mapping Reference
+
+Mapping of major privacy and marketing regulations to Salesforce consent model
+fields and compliance requirements.
+
+---
+
+## Regulation Overview Matrix
+
+| Regulation | Jurisdiction | Opt-In Required | Opt-Out Required | Right to Erasure | Consent Record Required |
+|-----------|-------------|----------------|-----------------|-----------------|------------------------|
+| GDPR | EU/EEA | Art 6(1)(a): explicit for marketing | Art 21: right to object | Art 17: yes | Yes |
+| UK GDPR | United Kingdom | Same as EU GDPR | Same as EU GDPR | Same as EU GDPR | Yes |
+| CCPA/CPRA | California, USA | No (opt-out model) | Yes (right to opt out of sale/sharing) | Yes (deletion right) | Yes |
+| CASL | Canada | Express consent required | Unsubscribe required | No erasure right | Yes (3 years) |
+| CAN-SPAM | United States | No (opt-out model) | Yes (unsubscribe mechanism) | No | Recommended |
+| ePrivacy Directive | EU/EEA | Yes (cookies and tracking) | Yes | No | Yes |
+| LGPD | Brazil | Yes (similar to GDPR) | Yes | Yes | Yes |
+| PDPA | Thailand | Yes | Yes | Yes | Yes |
+| POPIA | South Africa | Yes | Yes | Yes | Yes |
+
+Regulations are frequently amended. Verify
+current requirements with qualified legal counsel for the specific jurisdictions
+in scope.
+
+---
+
+## GDPR Article 6 Lawful Basis
+
+GDPR requires a lawful basis for every processing activity. Marketing
+communications typically rely on one of:
+
+| Lawful Basis | Art 6 Reference | When Applicable | Consent Record Needed |
+|-------------|----------------|----------------|----------------------|
+| Consent | Art 6(1)(a) | Marketing emails, profiling, tracking | Yes — must be specific, informed, freely given |
+| Legitimate Interest | Art 6(1)(f) | B2B marketing to existing contacts (with opt-out) | LIA documentation; opt-out mechanism |
+| Contract | Art 6(1)(b) | Service communications (order confirmations) | No specific consent form; document lawful basis |
+| Legal Obligation | Art 6(1)(c) | Compliance notifications | No |
+| Vital Interest | Art 6(1)(d) | Emergency safety information | No |
+| Public Task | Art 6(1)(e) | Public authority processing | No |
+
+**Important:** Consent under GDPR must be:
+- Freely given (not bundled with terms of service acceptance).
+- Specific (separate consent for each purpose).
+- Informed (clear description of what is being consented to).
+- Unambiguous (affirmative action; pre-ticked boxes are not valid).
+
+### Salesforce Mapping
+
+| GDPR Requirement | Salesforce Field |
+|-----------------|-----------------|
+| Consent captured | `ContactPointConsent.CaptureDate` |
+| Consent source | `ContactPointConsent.CaptureSource` |
+| Consent status | `ContactPointConsent.PrivacyConsentStatus` |
+| Lawful basis | Custom field on `ContactPointConsent` or `Individual` |
+| Processing opt-out | `Individual.HasOptedOutOfProcessing` |
+| Right to erasure flag | `Individual.ShouldForget` |
+
+---
+
+## CCPA / CPRA (California)
+
+The California Consumer Privacy Act and its amendment (CPRA) apply to
+businesses meeting volume/revenue thresholds doing business in California.
+
+### Key Rights and Obligations
+
+| Right | Obligation | Salesforce Mechanism |
+|-------|-----------|---------------------|
+| Right to Know | Disclose categories and specific data | Data export / DSAR workflow |
+| Right to Delete | Delete PI within 45 days of verified request | Individual.ShouldForget + deletion batch |
+| Right to Opt Out of Sale/Sharing | Provide "Do Not Sell or Share My PI" mechanism | Custom consent field or ContactPointConsent |
+| Right to Correct | Correct inaccurate PI | Standard Salesforce update flow |
+| Right to Limit Sensitive PI Use | Restrict sensitive PI to primary purposes | Field-level consent + sensitive data classification |
+
+**CPRA additions** (effective 2023):
+- Sensitive personal information (SPI) category requires additional disclosure
+  and opt-out mechanism.
+- Data minimization and purpose limitation principles.
+- Retention period requirements (no longer than reasonably necessary).
+
+### CCPA vs GDPR Key Difference
+
+CCPA is primarily an **opt-out model**: businesses can market to California
+residents without prior consent, but must provide a clear opt-out mechanism
+and honor opt-out requests within 15 business days.
+
+GDPR is primarily an **opt-in model** for marketing: affirmative consent is
+required before most marketing communications.
+
+---
+
+## CASL (Canada's Anti-Spam Legislation)
+
+CASL applies to all commercial electronic messages (CEMs) sent to or from
+Canada.
+
+### Consent Types
+
+| Type | Description | Expiry |
+|------|-------------|--------|
+| Express Consent | Explicit opt-in (form checkbox, signature) | No expiry unless withdrawn |
+| Implied Consent — existing business relationship | Purchase or inquiry in past 2 years | 2 years from last transaction |
+| Implied Consent — conspicuously published address | B2B to published work addresses, relevant to role | Must offer opt-out |
+
+**Implied consent expires.** Track the transaction date that creates the implied
+consent relationship.
+
+```sql
+-- Find contacts with implied CASL consent nearing expiry (< 3 months)
+SELECT Id, Name, Email, LastPurchaseDate__c
+FROM Contact
+WHERE ConsentType__c = 'CASL_Implied'
+  AND LastPurchaseDate__c < LAST_N_DAYS:639  -- (730 - 91 days warning)
+  AND LastPurchaseDate__c != null
+```
+
+### CASL Consent Record Requirements
+
+Per CASL, consent records must be retained for the duration of the relationship
+plus 3 years after opt-out or expiry. Records must contain:
+- Who gave consent (name and contact details).
+- When consent was given.
+- How consent was given (form URL, script, checkbox label).
+- What they consented to (description of CEM types).
+
+---
+
+## CAN-SPAM (United States)
+
+CAN-SPAM applies to commercial emails in the United States. It is an opt-out
+model with no pre-consent requirement for initial contact.
+
+### Requirements
+
+| Requirement | Detail |
+|-------------|--------|
+| Accurate header information | From, To, Reply-To must be accurate |
+| Non-deceptive subject lines | Subject must not mislead about content |
+| Physical postal address | Must include sender's valid physical address |
+| Clear opt-out mechanism | Must provide clear and conspicuous opt-out |
+| Honor opt-out within 10 business days | Process opt-out within 10 business days |
+| No sharing of opted-out addresses | Cannot sell/transfer opted-out addresses |
+
+### Salesforce Mapping for CAN-SPAM
+
+- `Contact.HasOptedOutOfEmail = true` honors CAN-SPAM opt-out.
+- Marketing Cloud Unsubscribe events should sync to `Contact.HasOptedOutOfEmail`.
+- Physical address stored in sender's org settings and included in email templates.
+
+---
+
+## ePrivacy Directive (EU) / Cookie Consent
+
+The ePrivacy Directive (and forthcoming ePrivacy Regulation) governs electronic
+marketing and cookies. In the Salesforce context:
+
+- **Tracking pixels and web analytics:** Require consent before firing in EU.
+- **Marketing Cloud email tracking:** Open and click tracking requires consent
+  under ePrivacy if IP-linked.
+- **ExactTarget/SFMC web tracking (Collect.js):** Requires cookie consent banner
+  before activation.
+
+### Salesforce Tracking Consent Implementation
+
+```javascript
+// Example: Only load SFMC tracking after consent given
+if (userConsentStatus === 'OptIn') {
+    // Load Collect.js for web tracking
+    var _etmc = _etmc || [];
+    _etmc.push(['setOrgId', 'YOUR_ORG_ID']);
+    // ... load script
+} else {
+    // Do not load tracking script
+    console.log('Tracking disabled: user has not opted in.');
+}
+```
+
+---
+
+## Multi-Regulation Compliance Checklist
+
+- [ ] Regulatory map documented for each jurisdiction where customers reside.
+- [ ] Lawful basis documented for each processing purpose (not just "consent").
+- [ ] Express consent captured with date, source, and purpose for GDPR/CASL.
+- [ ] Opt-out honored within: GDPR (promptly), CCPA (15 business days), CAN-SPAM (10 business days), CASL (10 business days).
+- [ ] Implied CASL consent relationships tracked with expiry dates.
+- [ ] Consent records retained for minimum periods (CASL: relationship + 3 years).
+- [ ] Erasure requests trigger data deletion across all connected systems
+  (Marketing Cloud, Data Cloud, CRM, backups).
+- [ ] Minor consent handled separately (parental consent where applicable).
+- [ ] Privacy notice linked at point of consent capture.