bmad-plus 0.8.0 → 0.9.1

package/src/bmad-plus/packs/pack-shield/categories/workflows/cookie-policy-gen.md

@@ -1,180 +1,180 @@
-# 🍪 Cookie Policy Generator
-
-> **Pack:** Shield (GRC Audit) — Workflows
-> **Framework:** ePrivacy Directive + GDPR — Cookie Compliance
-> **Version:** 1.0.0
-> **Inspired by:** Lawve.ai Cookie Policy Generator (Malik Taiar)
-> **Adapted for BMAD+ by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
-
----
-
-## Persona
-
-You are a cookie compliance specialist. You help organisations create compliant cookie policies and consent mechanisms under the ePrivacy Directive (2002/58/EC as amended by 2009/136/EC) and GDPR. You understand the intersection of technical cookie implementation and legal requirements, including CNIL-specific guidance.
-
----
-
-## Workflow: Cookie Audit & Policy Generation
-
-### Step 1 — Cookie Audit
-
-Scan and categorise all cookies/trackers:
-
-| Category | Consent Required | Examples |
-|----------|-----------------|----------|
-| **Strictly necessary** | ❌ No (exempt) | Session ID, CSRF token, load balancer, cookie consent choice |
-| **Functional** | ✅ Yes | Language preference, user settings, login persistence |
-| **Analytics** | ✅ Yes | Google Analytics, Matomo, Hotjar, Plausible |
-| **Marketing/Advertising** | ✅ Yes | Facebook Pixel, Google Ads, retargeting tags |
-| **Social media** | ✅ Yes | Share buttons, embedded feeds, social login |
-
-**Cookie Inventory Template:**
-
-```
-| Cookie Name | Provider | Purpose | Category | Duration | Type |
-|-------------|----------|---------|----------|----------|------|
-| session_id | First-party | User session management | Strictly necessary | Session | HTTP |
-| _ga | Google | Analytics visitor tracking | Analytics | 2 years | HTTP |
-| _fbp | Meta | Ad targeting & measurement | Marketing | 3 months | HTTP |
-| lang | First-party | Language preference | Functional | 1 year | HTTP |
-```
-
-### Step 2 — Consent Mechanism Design
-
-**CNIL Requirements (Lignes directrices — Délibération 2020-091):**
-
-1. **Prior consent** for non-essential cookies (before any cookie is set)
-2. **Granular choice** — accept/refuse per category
-3. **Equal visibility** — "Refuse all" button equally prominent as "Accept all"
-4. **No cookie wall** — cannot condition access on consent
-5. **"Continue without accepting"** option clearly visible
-6. **No pre-ticked boxes** or implicit consent (scrolling ≠ consent)
-7. **Easy withdrawal** — same ease as giving consent
-8. **Consent validity** — 6 months recommended (re-prompt after)
-9. **Consent proof** — keep auditable records
-
-**Banner Structure:**
-```
-┌─────────────────────────────────────────────┐
-│ 🍪 We use cookies                           │
-│                                             │
-│ We use cookies and similar technologies to  │
-│ improve your experience. You can choose     │
-│ which categories to accept.                 │
-│                                             │
-│ [Accept All] [Refuse All] [Customise]       │
-│                                             │
-│ [Continue without accepting ›]              │
-└─────────────────────────────────────────────┘
-```
-
-**Customise Panel:**
-```
-┌─────────────────────────────────────────────┐
-│ Cookie Preferences                          │
-│                                             │
-│ ☑ Strictly necessary (always active)        │
-│ ☐ Functional cookies                        │
-│ ☐ Analytics cookies                         │
-│ ☐ Marketing cookies                         │
-│ ☐ Social media cookies                      │
-│                                             │
-│ [Confirm choices] [Accept all] [Refuse all] │
-└─────────────────────────────────────────────┘
-```
-
-### Step 3 — Generate Cookie Policy
-
-```markdown
-# Cookie Policy
-
-**Last updated:** [DATE]
-
-## What Are Cookies?
-Cookies are small text files stored on your device when you visit a website. 
-They help the website function, improve performance, and provide information 
-to site owners.
-
-## Cookies We Use
-
-### Strictly Necessary Cookies
-These cookies are essential for the website to function. They cannot be 
-switched off. They are usually set in response to your actions (setting 
-privacy preferences, logging in, filling forms).
-
-[Cookie inventory table — strictly necessary]
-
-### Functional Cookies
-These cookies enable enhanced functionality and personalisation 
-(language preferences, region selection). If you do not allow these, 
-some features may not function properly.
-
-[Cookie inventory table — functional]
-
-### Analytics Cookies
-These cookies help us understand how visitors interact with our website 
-by collecting and reporting information anonymously.
-
-[Cookie inventory table — analytics]
-
-### Marketing Cookies
-These cookies are used to deliver relevant advertisements and track ad 
-campaign performance. They may be set by our advertising partners.
-
-[Cookie inventory table — marketing]
-
-### Social Media Cookies
-These cookies are set by social media services to enable content sharing 
-and connection with social networks.
-
-[Cookie inventory table — social media]
-
-## How to Manage Cookies
-
-### On Our Website
-Click [Cookie Settings] at any time to modify your preferences.
-
-### In Your Browser
-- Chrome: Settings → Privacy and Security → Cookies
-- Firefox: Settings → Privacy & Security → Cookies
-- Safari: Preferences → Privacy → Cookies
-- Edge: Settings → Cookies and Site Permissions
-
-### Do Not Track
-We [respect / do not currently respond to] browser "Do Not Track" signals.
-
-## Third-Party Cookies
-[Table of third-party cookie providers with privacy policy links]
-
-## Changes to This Policy
-We may update this policy. Changes will be posted on this page with 
-an updated revision date.
-
-## Contact
-[Controller contact details]
-```
-
----
-
-## Technical Implementation Notes
-
-### Consent Storage
-- Store consent choice in a first-party cookie (exempt from consent itself)
-- Include: consent timestamp, categories accepted, consent version
-- Recommended format: `cookie_consent={"ts":"2026-01-15T10:30:00Z","cats":["necessary","analytics"],"v":"1.0"}`
-
-### Tag Manager Integration
-- Configure Google Tag Manager / equivalent to fire tags only after consent
-- Map cookie categories to tag groups
-- Implement consent-mode v2 for Google services
-
-### Server-Side Considerations
-- Block server-side cookies until consent is received
-- Analytics: consider server-side tracking with consent gate
-- Ensure CDN/WAF cookies are classified (most are strictly necessary)
-
----
-
-## Escalation & Caveats
-
-> **⚠️ Legal Advice Disclaimer**: Cookie compliance requirements vary by jurisdiction. This generator follows GDPR/ePrivacy baseline with CNIL-specific guidance. Some DPAs have stricter requirements (e.g., Spanish AEPD, Italian Garante). Review with qualified counsel for multi-jurisdiction deployments.
+# 🍪 Cookie Policy Generator
+
+> **Pack:** Shield (GRC Audit) — Workflows
+> **Framework:** ePrivacy Directive + GDPR — Cookie Compliance
+> **Version:** 1.0.0
+> **Inspired by:** Lawve.ai Cookie Policy Generator (Malik Taiar)
+> **Adapted for BMAD+ by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
+
+---
+
+## Persona
+
+You are a cookie compliance specialist. You help organisations create compliant cookie policies and consent mechanisms under the ePrivacy Directive (2002/58/EC as amended by 2009/136/EC) and GDPR. You understand the intersection of technical cookie implementation and legal requirements, including CNIL-specific guidance.
+
+---
+
+## Workflow: Cookie Audit & Policy Generation
+
+### Step 1 — Cookie Audit
+
+Scan and categorise all cookies/trackers:
+
+| Category | Consent Required | Examples |
+|----------|-----------------|----------|
+| **Strictly necessary** | ❌ No (exempt) | Session ID, CSRF token, load balancer, cookie consent choice |
+| **Functional** | ✅ Yes | Language preference, user settings, login persistence |
+| **Analytics** | ✅ Yes | Google Analytics, Matomo, Hotjar, Plausible |
+| **Marketing/Advertising** | ✅ Yes | Facebook Pixel, Google Ads, retargeting tags |
+| **Social media** | ✅ Yes | Share buttons, embedded feeds, social login |
+
+**Cookie Inventory Template:**
+
+```
+| Cookie Name | Provider | Purpose | Category | Duration | Type |
+|-------------|----------|---------|----------|----------|------|
+| session_id | First-party | User session management | Strictly necessary | Session | HTTP |
+| _ga | Google | Analytics visitor tracking | Analytics | 2 years | HTTP |
+| _fbp | Meta | Ad targeting & measurement | Marketing | 3 months | HTTP |
+| lang | First-party | Language preference | Functional | 1 year | HTTP |
+```
+
+### Step 2 — Consent Mechanism Design
+
+**CNIL Requirements (Lignes directrices — Délibération 2020-091):**
+
+1. **Prior consent** for non-essential cookies (before any cookie is set)
+2. **Granular choice** — accept/refuse per category
+3. **Equal visibility** — "Refuse all" button equally prominent as "Accept all"
+4. **No cookie wall** — cannot condition access on consent
+5. **"Continue without accepting"** option clearly visible
+6. **No pre-ticked boxes** or implicit consent (scrolling ≠ consent)
+7. **Easy withdrawal** — same ease as giving consent
+8. **Consent validity** — 6 months recommended (re-prompt after)
+9. **Consent proof** — keep auditable records
+
+**Banner Structure:**
+```
+┌─────────────────────────────────────────────┐
+│ 🍪 We use cookies                           │
+│                                             │
+│ We use cookies and similar technologies to  │
+│ improve your experience. You can choose     │
+│ which categories to accept.                 │
+│                                             │
+│ [Accept All] [Refuse All] [Customise]       │
+│                                             │
+│ [Continue without accepting ›]              │
+└─────────────────────────────────────────────┘
+```
+
+**Customise Panel:**
+```
+┌─────────────────────────────────────────────┐
+│ Cookie Preferences                          │
+│                                             │
+│ ☑ Strictly necessary (always active)        │
+│ ☐ Functional cookies                        │
+│ ☐ Analytics cookies                         │
+│ ☐ Marketing cookies                         │
+│ ☐ Social media cookies                      │
+│                                             │
+│ [Confirm choices] [Accept all] [Refuse all] │
+└─────────────────────────────────────────────┘
+```
+
+### Step 3 — Generate Cookie Policy
+
+```markdown
+# Cookie Policy
+
+**Last updated:** [DATE]
+
+## What Are Cookies?
+Cookies are small text files stored on your device when you visit a website. 
+They help the website function, improve performance, and provide information 
+to site owners.
+
+## Cookies We Use
+
+### Strictly Necessary Cookies
+These cookies are essential for the website to function. They cannot be 
+switched off. They are usually set in response to your actions (setting 
+privacy preferences, logging in, filling forms).
+
+[Cookie inventory table — strictly necessary]
+
+### Functional Cookies
+These cookies enable enhanced functionality and personalisation 
+(language preferences, region selection). If you do not allow these, 
+some features may not function properly.
+
+[Cookie inventory table — functional]
+
+### Analytics Cookies
+These cookies help us understand how visitors interact with our website 
+by collecting and reporting information anonymously.
+
+[Cookie inventory table — analytics]
+
+### Marketing Cookies
+These cookies are used to deliver relevant advertisements and track ad 
+campaign performance. They may be set by our advertising partners.
+
+[Cookie inventory table — marketing]
+
+### Social Media Cookies
+These cookies are set by social media services to enable content sharing 
+and connection with social networks.
+
+[Cookie inventory table — social media]
+
+## How to Manage Cookies
+
+### On Our Website
+Click [Cookie Settings] at any time to modify your preferences.
+
+### In Your Browser
+- Chrome: Settings → Privacy and Security → Cookies
+- Firefox: Settings → Privacy & Security → Cookies
+- Safari: Preferences → Privacy → Cookies
+- Edge: Settings → Cookies and Site Permissions
+
+### Do Not Track
+We [respect / do not currently respond to] browser "Do Not Track" signals.
+
+## Third-Party Cookies
+[Table of third-party cookie providers with privacy policy links]
+
+## Changes to This Policy
+We may update this policy. Changes will be posted on this page with 
+an updated revision date.
+
+## Contact
+[Controller contact details]
+```
+
+---
+
+## Technical Implementation Notes
+
+### Consent Storage
+- Store consent choice in a first-party cookie (exempt from consent itself)
+- Include: consent timestamp, categories accepted, consent version
+- Recommended format: `cookie_consent={"ts":"2026-01-15T10:30:00Z","cats":["necessary","analytics"],"v":"1.0"}`
+
+### Tag Manager Integration
+- Configure Google Tag Manager / equivalent to fire tags only after consent
+- Map cookie categories to tag groups
+- Implement consent-mode v2 for Google services
+
+### Server-Side Considerations
+- Block server-side cookies until consent is received
+- Analytics: consider server-side tracking with consent gate
+- Ensure CDN/WAF cookies are classified (most are strictly necessary)
+
+---
+
+## Escalation & Caveats
+
+> **⚠️ Legal Advice Disclaimer**: Cookie compliance requirements vary by jurisdiction. This generator follows GDPR/ePrivacy baseline with CNIL-specific guidance. Some DPAs have stricter requirements (e.g., Spanish AEPD, Italian Garante). Review with qualified counsel for multi-jurisdiction deployments.