compliance-check

what it does

Run a compliance check on a proposed action, product feature, or business initiative, surfacing applicable regulations, required approvals, and risk areas. Use when launching a feature that touches personal data, when marketing or product proposes something with regulatory implications, or when you need to know which approvals and jurisdictional requirements apply before proceeding.

by Anthropic, PBC · Anthropic, PBC, Apache-2.0 · version 1 · license Apache-2.0

Verified Before and after: 2 models 1 try per case View source Download .zip

Compare the answers

Answers from Claude Sonnet 5.5 and GPT-6.1 Sol · try 1 of 1

Same request, same model, once with the skill and once without. Read both and judge for yourself.

“We scanned about 40,000 badges at a trade show in Amsterdam. Marketing wants to add everyone to our monthly newsletter next week. Lots of them are from Germany and France. Any compliance issues?”

Source material given with the request

Company: Tidewell Software, based in Austin, Texas, with an EU office in Dublin. The badge scans give name, company, job title and work email. The organizer's attendee terms say exhibitors may contact attendees "about the products shown at the booth". Nothing in them mentions newsletters. Plan: import all 40,000 into the newsletter list, no confirmation email, unsubscribe link in footer.

with the skill

## Compliance Check: Adding 40,000 trade show badge scans to the monthly newsletter ### Summary **Requires further review. Do not proceed as planned.** Bulk-importing everyone with no confirmation step and relying on an unsubscribe link is likely non-compliant for German contacts and risky for the rest of the EU. The plan also goes beyond what the organizer's terms allow. A narrower, segmented approach can probably meet next week's goal for part of the list. ### Applicable Regulations and Policies | Regulation/Policy | Relevance | Key Requirements | |---|---|---| | **ePrivacy Directive Art. 13**, as implemented nationally | Governs the email marketing itself, and is usually the deciding issue | Prior consent is the default for electronic marketing. Exceptions are narrow and vary by country. | | **Germany: UWG §7(2) no. 3** | Many contacts are in Germany | Requires prior express consent for marketing email, **including B2B**. Courts expect provable consent, which in practice means double opt-in. | | **France: CPCE art. L34-5 / CNIL guidance** | Many contacts are in France | B2B emails are allowed without prior consent if the recipient was informed at collection, can object easily, and the message relates to their professional role. | | **GDPR** (Arts. 5, 6, 13/14, 21) | Names, work emails and job titles are personal data. Tidewell has a Dublin establishment and targets EU residents. | Lawful basis, purpose limitation, transparency, and an absolute right to object to direct marketing. | | **Organizer attendee terms** | Contractual limit on use | Contact is permitted only "about the products shown at the booth". A general newsletter is arguably outside that scope. | | **Other countries** (e.g. Ireland, Netherlands, Italy, Spain, UK) | Attendees are likely from many countries | Each has its own B2B email rules, so segment by recipient country. | | **CAN-SPAM** (US), **CASL** (Canada) | Applies to any non-EU attendees | CAN-SPAM requires an unsubscribe link and a

Show the rest (59 more lines)

postal address. CASL requires consent. | ### Requirements | # | Requirement | Status | Action Needed | |---|---|---|---| | 1 | Valid basis for email marketing in each recipient's country | **Not Met** (Germany), **Unknown** (others) | Segment by country and apply the correct rule to each segment. | | 2 | Consent, where required, is explicit and provable | **Not Met** | Confirm whether any consent or opt-in language was shown at the scan. If not, there is no consent. | | 3 | Transparency (GDPR Art. 13/14): who we are, purposes, rights | **Unknown** | Find out what attendees were told at the booth. Was there signage, a scan notice, or a privacy link? | | 4 | Purpose limitation and the organizer's terms | **Not Met** for newsletter use | Review the full terms. Consider asking the organizer for written permission, or limit contact to booth-product follow-up. | | 5 | Legitimate interest assessment (where relied on, e.g. France) | **Not Met** | Document it. Newsletter content must be relevant to the recipient's job. | | 6 | Easy opt-out in every email | Partly Met | The footer unsubscribe link is good practice but doesn't cure the lack of a basis. | | 7 | Newsletter tracking (open pixels, click tracking) | **Unknown** | Tracking can need separate consent under ePrivacy rules (e.g. Germany's TDDDG §25). Check the email tool's settings. | | 8 | Processor and transfer terms for the newsletter vendor | **Unknown** | Confirm a DPA is in place and the transfer mechanism is valid (SCCs or DPF certification). | | 9 | Records of processing, privacy notice, retention period | **Unknown** | Update the Art. 30 record and privacy notice, and set a retention rule for unengaged leads. | | 10 | Identify the controller entity (Tidewell Inc. or the Dublin entity) | **Unknown** | This affects the lead supervisory authority (likely the Irish DPC) and which privacy notice applies. | ### Risk Areas | Risk | Severity | Mitigation | |---|---|---| | Unsolicited marketing to German contacts without consent | **High** | Exclude them unless explicit opt-in was captured. Otherwise use only a consent-based route. | | Complaints from recipients (spam, GDPR Art. 21) leading to regulator or competition-law action | **High** | Segment, use a defensible basis, and honor objections immediately. | | Breach of organizer terms (contract and relationship risk) | **Medium** | Check the full terms and seek written clarification or permission. | | Insufficient transparency about use of the scan data | **Medium** | Establish what was disclosed. If it was inadequate, send a compliant Art. 14-style notice. | | Legitimate interest reliance without a documented assessment | **Medium** | Complete and keep a short LIA for the segments where it is relied on. | | Sender reputation damage from a cold 40,000-person blast | **Medium** | Segment and warm up sends. This also reduces legal risk. | | Scope assumptions are unverified (country mix, what was said at the booth) | **Medium** | Pull country data from the scan list and confirm the booth process with the event team. | ### Recommended Actions 1. **Pause the import** until the list is segmented by country and booth consent practices are confirmed. 2. **Ask the event team what attendees saw or agreed to at the scan**, such as consent language, signage, or a privacy notice, and whether anyone ticked a newsletter box. 3. **Segment the list:** - **Explicit newsletter opt-in at the booth:** add them, with a welcome email. - **Germany, no explicit opt-in:** do not add them to the newsletter. Limit contact to what the organizer's terms and German law permit, and get counsel's view on any one-off follow-up. German courts have treated even opt-in request emails as advertising without prior consent. - **France:** may be addable under the B2B rules, but only if notice was given at collection, content is relevant to the person's role, and the opt-out is clear. Confirm with counsel. - **Other EU/UK:** apply country-specific rules before adding. - **US and other non-EU:** CAN-SPAM-compliant sending is generally fine, but check CASL for Canada and local rules elsewhere. 4. **Send a booth-follow-up message first** about the products shown, which fits the organizer's terms. Include a clear invitation to subscribe through a **double opt-in** link and a privacy notice. For Germany, confirm with counsel that this message itself is permissible. 5. **Use double opt-in for the newsletter** wherever you have no provable consent. It is the safest approach for German recipients and good practice elsewhere. 6. **Complete the paperwork:** LIA for any segment relying on legitimate interest, an Art. 30 record update, a privacy notice covering event leads, and vendor DPA/transfer checks. Disable tracking pixels for segments without consent for tracking. 7. **Set a process for objections**, with suppression across systems, and a retention period for non-responders. ### Approvals Needed | Approver | Why | Status | |---|---|---| | Legal / privacy counsel (ideally with German and French expertise) | Country-specific marketing rules and sign-off on segmentation | Pending | | DPO or privacy lead (if appointed) | LIA, notices, records of processing | Pending | | Marketing leadership | Agree revised plan and timeline | Pending | | Events team | Confirm what attendees were told or agreed to at the booth | Pending | | Whoever owns the organizer relationship | Clarify the attendee terms or get written permission | Pending | | Security/IT or procurement | Newsletter vendor DPA, transfers, tracking configuration | Pending | ### Further Review Recommended - **Outside counsel in Germany and France** should confirm the segment rules, since national implementations and case law differ and change. - **Ireland and other member states** need a check if sizable numbers of contacts come from there. - **Organizer terms:** a full read-through, and possibly outreach to the organizer, if you want to use the data beyond booth-product follow-up. - **Lead supervisory authority and controller structure** (Tidewell Inc. vs. Dublin entity), if not already settled. - I haven't seen the full organizer terms or the badge-scan process. If attendees gave explicit consent at scan, the analysis changes materially. *This is a compliance review to support your legal team, not legal advice. Regulatory requirements and case law change, so confirm current rules with qualified counsel before acting.*

without

Yes, the plan as written has real compliance problems, mainly for the German contacts but also for the rest. I'd hold it. ## Main issues **1. Email marketing rules (ePrivacy, national laws) are stricter than GDPR here** - **Germany (UWG §7):** Marketing email, even B2B, requires prior express consent. The "existing customer" exception doesn't apply to a badge scan. Unsolicited newsletters to German addresses are the highest-risk part of your plan. Germany also has a culture of cease-and-desist letters (*Abmahnungen*) from competitors and consumer groups, on top of regulator action. - **France (CNIL/CPCE):** B2B email prospecting is more permissive. You can generally rely on legitimate interest without prior consent if the message is relevant to the person's professional role, and they were told at collection that their data would be used this way and could object. The second condition is your problem (see below). - **Other countries:** Rules vary (Netherlands, Italy, Spain, UK, etc.), and the law of the recipient's country generally applies, not Ireland's or Texas's. **2. The organizer's terms don't cover a newsletter** Contact is allowed "about the products shown at the booth." A general monthly newsletter is arguably a different purpose, which creates purpose-limitation and transparency problems under GDPR. It also weakens any legitimate-interest argument in France, because people weren't told to expect it. A product-specific follow-up is within scope. A newsletter is a stretch. **3. Transparency (GDPR Art. 14)** You collected the data via the organizer, so you must give attendees your privacy notice, including your purposes, legal basis, retention, and their rights, at the latest in your first communication and within one month. **4. "Unsubscribe in the footer" doesn't fix a missing legal basis** Opt-out is a requirement, not a substitute for consent where consent is required. **5. Other points** - Check whether every scan was voluntary and whether the

Show the rest (17 more lines)

organizer's privacy notice names exhibitors as recipients. You're relying on their upstream compliance. - You, as a US company with a Dublin office, are subject to GDPR. The Irish DPC may be your lead authority for GDPR, but email-marketing enforcement is by the country of the recipient. - Practically, mailing 40,000 cold contacts will likely produce spam complaints and hurt your sender reputation. ## Safer approach 1. **Don't bulk-import.** Segment by country and by engagement (e.g., had a real booth conversation, requested info, or just got scanned). 2. **Send one follow-up email about the products shown at the booth.** This fits the organizer's terms. Include your privacy notice, an easy opt-out, and a clear invitation to subscribe to the newsletter. 3. **Add people to the newsletter only if they opt in**, using double opt-in. This is mandatory for Germany and best practice everywhere. 4. **Germany specifically:** Be cautious even with the follow-up. Contact only people with a clear connection to the booth interaction, and keep the message strictly about the products discussed. German courts have treated an unsolicited "please confirm your subscription" email as spam in itself, so don't send one to people who never asked. 5. **France and other B2B-tolerant countries:** If counsel agrees, you could rely on legitimate interest for relevant, role-appropriate messages, with a documented legitimate-interest assessment, but the newsletter would still be safer on opt-in. 6. **Document everything:** data source, the organizer's terms, your legitimate-interest assessment, and suppression lists. Honor opt-outs immediately. 7. **Check the organizer's data-sharing terms and privacy notice** for any extra restrictions. This is general guidance, not legal advice. Because of the German exposure and the scale, I'd have your DPO or EU counsel review the final approach before launch. A one-week delay to restructure this as follow-up plus opt-in is a small cost compared with the risk. If you want, I can draft the booth follow-up email with the Art. 14 notice and subscribe link.

Answers are shown exactly as the model wrote them, from the first try, and nothing is picked by hand.

The models

2 models

Claude Sonnet 5.5

made by Anthropic

claude-sonnet-5-5 · revision not reported by the provider

1 try per case · tested 3 Nov 2026

GPT-6.1 Sol

made by OpenAI

gpt-6.1-sol · revision not reported by the provider

1 try per case · tested 3 Nov 2026

The tasks

written by Carte Blanche

deletion-request-during-dispute

“A customer in California emailed asking us to delete all their data. They're also in a billing dispute with us that might go to small claims. What do we do?”

face-login-illinois

“We're adding face recognition login to our personal budgeting app. Users are all over the US, including a lot in Illinois. We'd store the face templates on our servers indefinitely. What do we need to check?”

kids-chat-feature

“Our reading app for kids aged 8 to 12 is adding chat between students in the same class. Product also wants to share chat transcripts with an ad partner to improve targeting. Can we launch next month?”

trade-show-badge-list

vendor-dpa-review

“Our new analytics vendor sent their data processing addendum. We're the controller and send them EU customer data. Can you check it before procurement signs?”

Install

Download the .zip and unzip it. Put its files, in a folder named compliance-check, here:

Claude Code~/.claude/skills/Every project. For one project only, use .claude/skills/ inside it.

Codex~/.agents/skills/Every project. For one repository only, use .agents/skills/ inside it.

Cursor~/.cursor/skills/Cursor also reads the Claude Code and Codex folders above.

Then start a new session and ask for what the skill does. Other agents that read SKILL.md have their own skills folder; check their docs.

Coming after launch: get skills from inside your agent, no download needed.