{"schemaVersion":1,"version":"2026-09-30.1","updatedAt":"2026-09-30","title":"Project Readiness","description":"An on-demand project review catalog. Confirm applicability and inspect evidence before judging readiness.","scope":"Product, experience and operational checks with an EU/EEA legal starting point. Other markets and regulated sectors need additional research. This is not a legal certification or an exhaustive compliance standard.","features":[{"id":"public-site","label":"Public website"},{"id":"forms","label":"Forms and search"},{"id":"accounts","label":"User accounts"},{"id":"personal-data","label":"Personal data"},{"id":"tracking","label":"Analytics, cookies or embeds"},{"id":"marketing-email","label":"Marketing email"},{"id":"payments","label":"Payments"},{"id":"subscriptions","label":"Subscriptions"},{"id":"ecommerce","label":"Online store"},{"id":"uploads","label":"File uploads"},{"id":"booking","label":"Bookings"},{"id":"multi-tenant","label":"Teams and organizations"},{"id":"user-content","label":"User-generated content"},{"id":"ai","label":"AI features"},{"id":"children","label":"Children as users"},{"id":"localization","label":"Multiple languages or regions"}],"categories":[{"id":"navigation","title":"Header and navigation","description":"Help users locate the next useful action."},{"id":"hero","title":"Hero and product story","description":"Make public entry pages understandable."},{"id":"footer","title":"Footer and persistent help","description":"Keep useful destinations available across public pages."},{"id":"trust","title":"Content and trust","description":"Support claims and respect ownership."},{"id":"licensing","title":"Licences and assets","description":"Track rights to material shipped with the product."},{"id":"onboarding","title":"First use and onboarding","description":"Guide new users to the first useful result."},{"id":"forms","title":"Forms and search","description":"Keep input understandable and recoverable."},{"id":"accounts","title":"Account lifecycle","description":"Cover both joining and leaving the product."},{"id":"accessibility","title":"Accessibility","description":"Combine automated checks with assistive-technology journeys."},{"id":"privacy","title":"Privacy and personal data","description":"Review the actual data lifecycle."},{"id":"cookies","title":"Cookies and tracking","description":"Check actual behavior before and after choice."},{"id":"commerce","title":"Prices, payments and subscriptions","description":"Verify the complete financial journey."},{"id":"resilience","title":"Errors and recovery","description":"Keep users oriented when dependencies fail."},{"id":"mobile","title":"Mobile experience and performance","description":"Exercise the product under realistic constraints."},{"id":"discovery","title":"SEO and sharing","description":"Control public discovery without confusing it with security."},{"id":"security","title":"Security and abuse resistance","description":"Verify controls at the actual trust boundaries."},{"id":"communication","title":"Support and email","description":"Keep communication actionable and deliverable."},{"id":"operations","title":"Production and maintenance","description":"Prove that the service can be operated and recovered."},{"id":"store","title":"Online-store module","description":"Follow an order through fulfillment and return."},{"id":"teams","title":"Teams and organizations module","description":"Protect membership and ownership boundaries."},{"id":"bookings","title":"Bookings module","description":"Respect time, availability and cancellation."},{"id":"community","title":"User-content module","description":"Provide controls for publication and harm reports."},{"id":"ai","title":"AI module","description":"Bound data use, failures and consequential actions."},{"id":"children","title":"Children module","description":"Determine child-specific duties before collecting data."},{"id":"localization","title":"Languages and regions module","description":"Preserve meaning across supported markets."}],"sources":[{"id":"gdpr","title":"GDPR: processing, transparency and individual rights","url":"https://europa.eu/youreurope/business/governance-and-sustainability/digital-and-data-compliance/data-protection-gdpr/index_en.htm","jurisdiction":"EU/EEA; confirm territorial scope and national requirements","checkedAt":"2026-09-30"},{"id":"cookies","title":"Cookies and consent","url":"https://europa.eu/youreurope/business/growing/digitalising/online-privacy/index_en.htm","jurisdiction":"EU/EEA; national ePrivacy implementation","checkedAt":"2026-09-30"},{"id":"consumer","title":"Distance selling to consumers","url":"https://europa.eu/youreurope/business/selling-in-eu/selling-goods-services/ecommerce-distance-selling/index_en.htm","jurisdiction":"EU consumer contracts; exceptions and national law matter","checkedAt":"2026-09-30"},{"id":"withdrawal","title":"Online withdrawal function","url":"https://eur-lex.europa.eu/eli/dir/2023/2673/oj","jurisdiction":"EU directive; verify applicable national transposition and commencement","checkedAt":"2026-09-30"},{"id":"fairness","title":"Online consumer protection","url":"https://commission.europa.eu/digital-life/protecting-you-when-buying-online_en","jurisdiction":"EU consumer-facing commercial practices","checkedAt":"2026-09-30"},{"id":"children","title":"Children and consent","url":"https://www.edpb.europa.eu/sme/be-compliant/process-personal-data-lawfully_en","jurisdiction":"GDPR Article 8 scope; applicable national age threshold","checkedAt":"2026-09-30"},{"id":"copyright","title":"Copyright and licences","url":"https://europa.eu/youreurope/business/growing/protecting-intellectual-property/copyright/index_en.htm","jurisdiction":"EU guidance; verify individual licences and territories","checkedAt":"2026-09-30"},{"id":"wcag","title":"WCAG 2.2","url":"https://www.w3.org/TR/WCAG22/","jurisdiction":"Technical standard; not a universal statement of legal applicability","checkedAt":"2026-09-30"},{"id":"eaa","title":"Accessibility requirements for services and products","url":"https://europa.eu/youreurope/business/selling-in-eu/selling-goods-services/accessibility/indexamp_en.htm","jurisdiction":"EU covered products/services; exemptions, transitions and national law apply","checkedAt":"2026-09-30"},{"id":"asvs","title":"OWASP Application Security Verification Standard","url":"https://owasp.org/projects/asvs","jurisdiction":"Security verification guidance; scope controls to actual risk","checkedAt":"2026-09-30"},{"id":"seo","title":"Google SEO Starter Guide","url":"https://developers.google.com/search/docs/fundamentals/seo-starter-guide","jurisdiction":"Public search-indexable content","checkedAt":"2026-09-30"},{"id":"email-privacy","title":"Online privacy and marketing preferences","url":"https://commission.europa.eu/digital-life/protecting-your-data-and-privacy_en","jurisdiction":"EU electronic marketing rules; national implementation and message purpose matter","checkedAt":"2026-09-30"}],"checks":[{"id":"navigation.orientation","category":"navigation","title":"Clear navigation and location","kind":"practice","featuresAny":[],"appliesWhen":"The product has several destinations.","verify":"Follow each primary link; check active location, logo destination and browser Back behavior.","evidence":"Routes exercised and desktop/mobile observations.","why":"Users should be able to recover their location.","exceptions":"A single-purpose screen may need only a return path.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"navigation.mobile-menu","category":"navigation","title":"Usable mobile navigation","kind":"practice","featuresAny":[],"appliesWhen":"Navigation collapses on smaller screens.","verify":"Open and close it by touch and keyboard; check focus return and page scrolling.","evidence":"Viewport, keyboard sequence and resulting focus.","why":"Hidden destinations must remain reachable.","exceptions":"Not applicable when navigation does not collapse.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"navigation.primary-action","category":"navigation","title":"A clear next action","kind":"practice","featuresAny":[],"appliesWhen":"A screen invites a purchase, signup or task.","verify":"Check that the primary label explains the action and reaches the promised destination.","evidence":"Screen URL, label and destination.","why":"Competing or misleading actions interrupt the journey.","exceptions":"A reference page may have no primary action.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"hero.value","category":"hero","title":"Explain the product and audience","kind":"practice","featuresAny":["public-site"],"appliesWhen":"A public page introduces the offering.","verify":"Read the first screen without prior context; identify audience, outcome and next step.","evidence":"Exact headline, supporting copy and action.","why":"Visitors need enough context to decide whether to continue.","exceptions":"Internal dashboards do not need a marketing hero.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"hero.demonstration","category":"hero","title":"Show an honest product example","kind":"practice","featuresAny":["public-site"],"appliesWhen":"The offering is difficult to understand from text.","verify":"Inspect a real screenshot, demo or example and distinguish concepts from available features.","evidence":"Example URL and availability comparison.","why":"Concrete examples reduce mistaken expectations.","exceptions":"Text may fully explain a simple service.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"hero.trial","category":"hero","title":"Explain trial commitments","kind":"practice","featuresAny":["public-site"],"appliesWhen":"An entry page advertises a trial or free tier.","verify":"Follow signup and compare card requirements, limits and later billing with the claim.","evidence":"Entry copy and signup/billing observations.","why":"Users should understand what they are accepting.","exceptions":"Not applicable without a trial or free-tier claim.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"footer.links","category":"footer","title":"Group useful footer destinations","kind":"practice","featuresAny":["public-site"],"appliesWhen":"Public pages use a shared footer.","verify":"Check product, help, company and relevant policy links; remove placeholders and dead social links.","evidence":"Link inventory and tested destinations.","why":"A footer should help users complete unfinished tasks.","exceptions":"A compact product may need only a few links.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"footer.identity","category":"footer","title":"Make the operator and contact discoverable","kind":"practice","featuresAny":["public-site"],"appliesWhen":"Visitors need to identify or contact the operator.","verify":"Verify displayed contact details and operator information against the business owner; check any legally required details separately.","evidence":"Contact route and owner-confirmed identity.","why":"People need a reliable point of contact.","exceptions":"Required particulars vary by business and jurisdiction.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"footer.privacy-controls","category":"footer","title":"Keep privacy controls reachable","kind":"practice","featuresAny":["public-site"],"appliesWhen":"The site offers optional tracking choices.","verify":"Reopen preferences after dismissing the banner; change and withdraw choices.","evidence":"Browser steps and resulting storage/network behavior.","why":"Consent choices should remain changeable.","exceptions":"A site without consent-dependent tracking may need no preference dialog.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"footer.context","category":"footer","title":"Put critical information near the decision","kind":"practice","featuresAny":["public-site"],"appliesWhen":"Users submit data, pay or accept terms.","verify":"Check relevant disclosure at the form or checkout as well as persistent footer links.","evidence":"Form/checkout screenshot and policy destination.","why":"A remote footer link alone can leave a decision unclear.","exceptions":"The precise disclosure depends on the transaction.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"trust.reviews","category":"trust","title":"Use authentic reviews","kind":"legal","featuresAny":["public-site"],"appliesWhen":"Testimonials, ratings or customer counts are displayed.","verify":"Trace a sample to permission and provenance; label incentives and explain review verification where relevant.","evidence":"Private provenance reference and public presentation.","why":"Fabricated endorsements mislead customers.","exceptions":"A project with no testimonials needs none.","sources":["fairness"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"trust.claims","category":"trust","title":"Substantiate public claims","kind":"legal","featuresAny":["public-site"],"appliesWhen":"Copy makes performance, outcome or certification claims.","verify":"Compare claims with dated evidence and scope; remove invented badges and guarantees.","evidence":"Claim-to-evidence references.","why":"Users make decisions based on these statements.","exceptions":"Clearly identified opinion differs from a factual guarantee.","sources":["fairness"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"trust.dark-patterns","category":"trust","title":"Avoid coercive choices and fake urgency","kind":"legal","featuresAny":["public-site"],"appliesWhen":"Flows influence consent, signup, purchase or cancellation.","verify":"Compare accept/reject paths; inspect preselected extras, countdown resets and obstructive cancellation.","evidence":"Side-by-side flow observations.","why":"Users should be able to make an informed choice.","exceptions":"A real deadline or necessary confirmation may be appropriate.","sources":["fairness"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"licensing.assets","category":"licensing","title":"Verify font, image and media licences","kind":"legal","featuresAny":[],"appliesWhen":"The product distributes or displays third-party assets.","verify":"Record source, licence, permitted use, attribution and redistribution limits for each asset family.","evidence":"Asset inventory and licence references.","why":"Ownership and usage permission are separate questions.","exceptions":"An original asset still needs a clear ownership record.","sources":["copyright"],"jurisdiction":"Applicable copyright law and individual licence terms; verify territories and distribution model","reviewedAt":"2026-09-30"},{"id":"licensing.software","category":"licensing","title":"Check third-party software obligations","kind":"legal","featuresAny":[],"appliesWhen":"Dependencies or copied snippets are distributed.","verify":"Review relevant licence terms, notices and distribution obligations for the delivery model.","evidence":"Dependency licence report and required notices.","why":"The deployment model can change obligations.","exceptions":"Do not infer legal incompatibility from a licence name alone.","sources":["copyright"],"jurisdiction":"Applicable copyright law and individual licence terms; verify territories and distribution model","reviewedAt":"2026-09-30"},{"id":"onboarding.first-success","category":"onboarding","title":"Reach the first useful result","kind":"practice","featuresAny":["accounts"],"appliesWhen":"The product has setup or onboarding.","verify":"Use a fresh account, complete one core task and identify unnecessary steps.","evidence":"New-account journey and first successful outcome.","why":"Signup alone does not prove usable onboarding.","exceptions":"A simple tool may work without a guided tour.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"onboarding.empty-states","category":"onboarding","title":"Make empty states actionable","kind":"practice","featuresAny":["accounts"],"appliesWhen":"Lists, dashboards or workspaces start empty.","verify":"Test a fresh account and cleared filters; distinguish no data, no results and errors.","evidence":"Screenshots and next actions for each state.","why":"Users need to know how to proceed.","exceptions":"Read-only reports can explain why no action is possible.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"onboarding.progress","category":"onboarding","title":"Preserve setup progress","kind":"practice","featuresAny":["accounts"],"appliesWhen":"Onboarding spans multiple steps.","verify":"Leave and resume midway; inspect optional steps and changed answers.","evidence":"Resume test and persisted fields.","why":"Interruptions should not force unnecessary repetition.","exceptions":"Sensitive short-lived data may intentionally expire.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"forms.validation","category":"forms","title":"Explain and preserve invalid input","kind":"practice","featuresAny":["forms"],"appliesWhen":"A form accepts user input.","verify":"Submit missing, malformed and boundary values; check field-level messages and retained safe input.","evidence":"Inputs tested and resulting errors.","why":"People should be able to correct an error without starting over.","exceptions":"Never repopulate secrets unnecessarily.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"forms.submission","category":"forms","title":"Show a reliable submission outcome","kind":"practice","featuresAny":["forms"],"appliesWhen":"A form triggers a server action.","verify":"Test slow response, retry and double click; confirm success only after acceptance.","evidence":"Request outcomes and UI states.","why":"Ambiguous submission can lose data or duplicate actions.","exceptions":"Some operations deliberately queue work; say so.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"forms.search","category":"forms","title":"Handle no matches and filter changes","kind":"practice","featuresAny":["forms"],"appliesWhen":"The product has search or filters.","verify":"Test zero matches, clear filters, changed query and direct-link navigation.","evidence":"Queries, URLs and displayed controls.","why":"Visible controls and results should describe the same state.","exceptions":"URL persistence is optional for transient local filters.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"forms.labels","category":"forms","title":"Use explicit labels and suitable input aids","kind":"practice","featuresAny":["forms"],"appliesWhen":"People enter structured information.","verify":"Inspect labels, required indicators, autocomplete and input types on mobile.","evidence":"Form markup plus browser observation.","why":"Clear input expectations reduce avoidable mistakes.","exceptions":"Special formats may need custom controls with equivalent accessibility.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"accounts.authentication","category":"accounts","title":"Complete signup and sign-in recovery","kind":"practice","featuresAny":["accounts"],"appliesWhen":"The product requires a user identity.","verify":"Exercise supported login methods, expired links and recovery; verify identity before account changes.","evidence":"Test-account results and recovery paths.","why":"A working happy-path login is not enough.","exceptions":"SSO-only products may delegate recovery to the identity provider.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"accounts.sessions","category":"accounts","title":"Provide session control","kind":"practice","featuresAny":["accounts"],"appliesWhen":"Users authenticate across devices.","verify":"Check logout, expiry, revoked access and available session management.","evidence":"Session tests across two clients.","why":"Lost or stale sessions can retain access.","exceptions":"Per-device controls depend on threat model and provider capabilities.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"accounts.account-changes","category":"accounts","title":"Protect email and identity changes","kind":"practice","featuresAny":["accounts"],"appliesWhen":"Users can edit credentials or identity fields.","verify":"Test verification, notification, conflict and interrupted update paths.","evidence":"Old/new identity behavior and alerts.","why":"Account ownership must survive profile changes safely.","exceptions":"Provider-managed identity may have an external update flow.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"accounts.closure","category":"accounts","title":"Offer understandable account closure","kind":"practice","featuresAny":["accounts"],"appliesWhen":"Users create persistent accounts.","verify":"Trace closure through login revocation, subscriptions, owned workspaces and retained records.","evidence":"UI path, backend effects and retention explanation.","why":"Users need to understand the consequences of leaving.","exceptions":"Closure and statutory erasure are separate; some records must be retained.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"accessibility.keyboard","category":"accessibility","title":"Complete core journeys by keyboard","kind":"standard","featuresAny":[],"appliesWhen":"The product has interactive UI.","verify":"Use Tab, Shift+Tab, arrows and Escape where appropriate; inspect visible focus, order and traps.","evidence":"Journey, browser and observed focus behavior.","why":"Pointer-only controls exclude users.","exceptions":"Spatial input may need a suitable alternative rather than identical interaction.","sources":["wcag","eaa"],"jurisdiction":"WCAG technical guidance; determine applicable accessibility law per market","reviewedAt":"2026-09-30"},{"id":"accessibility.semantics","category":"accessibility","title":"Expose names, roles and state","kind":"standard","featuresAny":[],"appliesWhen":"The interface contains controls, headings or dialogs.","verify":"Inspect the accessibility tree and test a core journey with a screen reader.","evidence":"Control names, hierarchy and announced state changes.","why":"Visual appearance alone does not communicate function.","exceptions":"Use native semantics before adding custom ARIA.","sources":["wcag","eaa"],"jurisdiction":"WCAG technical guidance; determine applicable accessibility law per market","reviewedAt":"2026-09-30"},{"id":"accessibility.contrast","category":"accessibility","title":"Keep content perceptible","kind":"standard","featuresAny":[],"appliesWhen":"Text and controls convey information visually.","verify":"Measure relevant contrast and ensure errors/status are not communicated by color alone.","evidence":"Measured samples and non-color cues.","why":"Users perceive color and contrast differently.","exceptions":"Apply the standard's actual criteria and exceptions.","sources":["wcag","eaa"],"jurisdiction":"WCAG technical guidance; determine applicable accessibility law per market","reviewedAt":"2026-09-30"},{"id":"accessibility.images","category":"accessibility","title":"Give meaningful media alternatives","kind":"standard","featuresAny":[],"appliesWhen":"Images or media convey information.","verify":"Match text alternatives to purpose; hide decorative images appropriately; check captions/transcripts where needed.","evidence":"Representative media and alternatives.","why":"Equivalent information must remain available.","exceptions":"Decorative images generally need empty alt text, not invented descriptions.","sources":["wcag","eaa"],"jurisdiction":"WCAG technical guidance; determine applicable accessibility law per market","reviewedAt":"2026-09-30"},{"id":"accessibility.reflow","category":"accessibility","title":"Support zoom and reduced motion","kind":"standard","featuresAny":[],"appliesWhen":"Pages contain responsive layouts or animation.","verify":"Test zoom, narrow reflow, text enlargement and reduced-motion settings.","evidence":"Viewport/zoom values and motion observations.","why":"Content should remain operable with user preferences.","exceptions":"Some inherently two-dimensional content needs contextual handling.","sources":["wcag","eaa"],"jurisdiction":"WCAG technical guidance; determine applicable accessibility law per market","reviewedAt":"2026-09-30"},{"id":"accessibility.legal-scope","category":"accessibility","title":"Determine applicable accessibility duties","kind":"legal","featuresAny":[],"appliesWhen":"The product serves markets with accessibility legislation.","verify":"Identify service type, operator size, public-sector status, exemptions and national law; confirm applicable standard/version.","evidence":"Market-specific scope assessment and authoritative references.","why":"A WCAG result is not a legal applicability decision.","exceptions":"EU EAA coverage and exemptions do not apply identically to every website.","sources":["eaa"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"privacy.notice","category":"privacy","title":"Publish an accurate privacy notice","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"Personal data is processed within applicable privacy law.","verify":"Compare collected data, purposes, recipients, retention and contact information with the notice.","evidence":"Notice URL and data-flow comparison.","why":"Documentation should describe actual processing.","exceptions":"Required information depends on processing and jurisdiction.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.basis","category":"privacy","title":"Identify the legal basis for each purpose","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"Personal data is processed.","verify":"Map each purpose to its lawful basis; review optional form consents independently of service acceptance.","evidence":"Purpose/basis register and relevant form behavior.","why":"Consent is not the only possible legal basis.","exceptions":"Confirm the chosen basis with the responsible owner or qualified adviser.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.minimization","category":"privacy","title":"Collect only necessary data","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"A field, log or integration receives personal data.","verify":"Challenge why each field is needed and remove or shorten unnecessary collection.","evidence":"Data inventory with purpose and retention.","why":"Unneeded collection increases exposure.","exceptions":"A documented legal obligation may justify retention.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.retention","category":"privacy","title":"Implement retention and deletion schedules","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"Personal data persists in databases, logs or backups.","verify":"Compare promised retention with jobs, backup expiry and vendor settings.","evidence":"Configured schedules and a sample deletion/expiry trace.","why":"A policy alone does not remove stored data.","exceptions":"Legal holds and required records need explicit bounded exceptions.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.rights","category":"privacy","title":"Handle access, correction, export and erasure requests","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"Applicable privacy law grants individual rights.","verify":"Trace receipt, identity verification, response and downstream providers; distinguish rights and exceptions.","evidence":"Request workflow, owner and test results.","why":"Users need a workable process beyond a policy paragraph.","exceptions":"Not every right applies to every processing basis or record.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.vendors","category":"privacy","title":"Audit third-party SDKs and processors","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"Vendors, embeds or SDKs receive personal data.","verify":"Inspect runtime traffic, vendor purposes, agreements and international transfers.","evidence":"Vendor inventory, observed requests and private agreement references.","why":"A dependency can change who receives user data.","exceptions":"Do not publish contracts or sensitive configuration in review artifacts.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"privacy.incident","category":"privacy","title":"Prepare a personal-data incident process","kind":"legal","featuresAny":["personal-data"],"appliesWhen":"The service handles personal data.","verify":"Confirm triage owner, escalation, applicable notification duties and a tabletop scenario.","evidence":"Incident procedure and exercise date.","why":"Response decisions need clear ownership.","exceptions":"Notification requirements depend on the incident and jurisdiction.","sources":["gdpr"],"jurisdiction":"GDPR where territorially applicable; verify national and sector-specific requirements","reviewedAt":"2026-09-30"},{"id":"cookies.inventory","category":"cookies","title":"Classify cookies, storage and third-party tracking","kind":"legal","featuresAny":["tracking"],"appliesWhen":"The site uses browser storage, analytics or embeds.","verify":"Observe a fresh session; list purposes, recipients and necessity without trusting vendor labels.","evidence":"Storage/network inventory.","why":"The implementation determines consent requirements.","exceptions":"Strictly necessary storage can have a different legal basis.","sources":["cookies"],"jurisdiction":"EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately","reviewedAt":"2026-09-30"},{"id":"cookies.prior-choice","category":"cookies","title":"Obtain consent before consent-dependent tracking","kind":"legal","featuresAny":["tracking"],"appliesWhen":"Tracking requires prior consent in the applicable market.","verify":"Test fresh load, reject, partial acceptance and expired choice; confirm blocked requests stay blocked.","evidence":"Network traces for each choice.","why":"A visible banner alone does not control processing.","exceptions":"Do not require a banner solely for strictly necessary cookies.","sources":["cookies"],"jurisdiction":"EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately","reviewedAt":"2026-09-30"},{"id":"cookies.withdrawal","category":"cookies","title":"Make choice and withdrawal usable","kind":"legal","featuresAny":["tracking"],"appliesWhen":"Optional tracking consent is requested.","verify":"Compare accept/reject effort, reopen preferences and withdraw; verify future tracking changes.","evidence":"Interaction steps and post-withdrawal trace.","why":"A saved preference must affect the actual integrations.","exceptions":"Explain technical limits on already transferred data accurately.","sources":["cookies"],"jurisdiction":"EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately","reviewedAt":"2026-09-30"},{"id":"cookies.policy","category":"cookies","title":"Keep cookie information accurate","kind":"legal","featuresAny":["tracking"],"appliesWhen":"Storage/tracking information must be disclosed.","verify":"Compare purposes, lifetimes and providers against the live inventory.","evidence":"Policy URL and inventory diff.","why":"Copied policies can misdescribe a site.","exceptions":"Information may be integrated into a suitable privacy notice.","sources":["cookies"],"jurisdiction":"EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately","reviewedAt":"2026-09-30"},{"id":"commerce.terms","category":"commerce","title":"Provide applicable service and sales terms","kind":"legal","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"Users enter a commercial relationship.","verify":"Compare published terms with the product, operator and acceptance/version records.","evidence":"Terms URL and transaction flow.","why":"Terms should describe the transaction users actually enter.","exceptions":"The required form and content depend on market and contract type.","sources":["consumer"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"commerce.total-price","category":"commerce","title":"Show the payable price and commitments","kind":"legal","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"A user can buy, subscribe or start a paid trial.","verify":"Compare advertised price with taxes, fees, shipping, billing period and renewal disclosures before confirmation.","evidence":"Entry offer and final checkout totals.","why":"Hidden charges undermine informed decisions.","exceptions":"Some costs depend on address or usage; explain how they are determined.","sources":["consumer"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"commerce.refunds","category":"commerce","title":"Explain returns, refunds and withdrawal","kind":"legal","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"Sales are subject to return or withdrawal rights or promises.","verify":"Check eligible transactions, exceptions, request path and refund handling; separate statutory rights from goodwill policy.","evidence":"Policy, request test and processing ownership.","why":"A refund policy must not silently remove applicable rights.","exceptions":"Digital services, customized goods and other cases have specific conditions.","sources":["consumer"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"commerce.withdrawal-function","category":"commerce","title":"Check the online withdrawal mechanism","kind":"legal","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"Applicable EU distance contracts are concluded through an online interface.","verify":"Verify current national implementation of Directive 2023/2673 and whether an accessible online withdrawal function is required; test acknowledgment and timing.","evidence":"Dated legal source plus applicable UI and confirmation test.","why":"Recent legal changes can make a static policy insufficient.","exceptions":"Scope, commencement and statutory exceptions require jurisdiction-specific confirmation.","sources":["withdrawal"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"commerce.cancel","category":"commerce","title":"Make subscription changes and cancellation clear","kind":"practice","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"Recurring billing or a trial exists.","verify":"Test cancel, downgrade, trial expiry and reactivation; explain access end date and final charges.","evidence":"Billing-provider state and user-visible confirmation.","why":"A hidden or ineffective cancellation path continues unwanted billing.","exceptions":"Immediate and period-end cancellation have different consequences.","sources":["consumer","withdrawal"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"commerce.reconciliation","category":"commerce","title":"Reconcile payments safely","kind":"practice","featuresAny":["payments","subscriptions","ecommerce"],"appliesWhen":"An external provider processes money.","verify":"Use a sandbox to test duplicate/delayed events, declined payment, refund and missing confirmation.","evidence":"Provider event IDs and resulting order state, without card data.","why":"UI success and provider settlement can diverge.","exceptions":"Never run a real charge merely to complete an audit without authorization.","sources":["consumer","withdrawal"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"resilience.states","category":"resilience","title":"Distinguish loading, empty and failure","kind":"practice","featuresAny":[],"appliesWhen":"A screen depends on asynchronous data.","verify":"Simulate loading, no data, partial failure and timeout; confirm truthful messaging and recovery.","evidence":"States exercised and available actions.","why":"An error should not masquerade as an empty success.","exceptions":"Static content may have no asynchronous state.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"resilience.retry","category":"resilience","title":"Retry without duplicating effects","kind":"practice","featuresAny":[],"appliesWhen":"Operations can time out or be retried.","verify":"Interrupt a request and retry; inspect deduplication and user feedback.","evidence":"Controlled failure trace and resulting records.","why":"Uncertain outcomes can lead to duplicate work or charges.","exceptions":"Read-only and mutating operations need different retry policies.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"resilience.unsaved","category":"resilience","title":"Protect work across interruptions","kind":"practice","featuresAny":[],"appliesWhen":"Users compose or edit valuable content.","verify":"Test navigation, refresh, session expiry and conflict with another edit.","evidence":"Recovery/conflict results and saved data.","why":"Silent loss breaks trust.","exceptions":"Do not persist sensitive drafts without a deliberate policy.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"resilience.error-pages","category":"resilience","title":"Provide useful error and permission pages","kind":"practice","featuresAny":[],"appliesWhen":"Routes can be missing or unavailable.","verify":"Test 404, server error and insufficient permission; inspect return/help paths and information leakage.","evidence":"Representative routes and displayed messages.","why":"Users need a safe next step after failure.","exceptions":"Do not expose private resource existence to unauthorized users.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"mobile.small-screen","category":"mobile","title":"Complete core tasks on a small screen","kind":"practice","featuresAny":[],"appliesWhen":"The product supports browser users.","verify":"Test touch targets, scrolling, virtual keyboard, dialogs and sticky elements on narrow viewports.","evidence":"Device/viewport and completed task.","why":"A desktop layout can conceal unusable mobile interactions.","exceptions":"Specialized desktop-only tools should state their supported context.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"mobile.performance","category":"mobile","title":"Measure realistic loading and interaction","kind":"practice","featuresAny":[],"appliesWhen":"Users load substantial content or interactive screens.","verify":"Measure key journeys with constrained CPU/network and representative content; inspect layout shifts and main-thread work.","evidence":"Environment, measurements and identified bottlenecks.","why":"Local fast-network impressions hide user delays.","exceptions":"Targets depend on the journey; avoid invented universal budgets.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"mobile.assets","category":"mobile","title":"Deliver appropriate assets","kind":"practice","featuresAny":[],"appliesWhen":"Pages include images, fonts or video.","verify":"Inspect transfer size, dimensions, loading priority and behavior when assets fail.","evidence":"Network sample and layout observation.","why":"Oversized or unstable assets delay useful content.","exceptions":"Above-the-fold essential content may need eager loading.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"discovery.metadata","category":"discovery","title":"Describe public pages accurately","kind":"practice","featuresAny":["public-site"],"appliesWhen":"Pages should appear in search or shared links.","verify":"Inspect titles, descriptions, canonical choices and social previews on representative routes.","evidence":"Rendered metadata and preview result.","why":"Search and sharing should reflect the actual page.","exceptions":"Private or transactional pages may intentionally avoid indexing.","sources":["seo"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"discovery.indexing","category":"discovery","title":"Manage public indexing and redirects","kind":"practice","featuresAny":["public-site"],"appliesWhen":"The site has indexable content.","verify":"Inspect robots directives, sitemap, canonical URLs, moved routes and broken links.","evidence":"Crawler configuration and tested response codes.","why":"Accidental exclusions or duplicate routes impair discovery.","exceptions":"Robots and noindex are not access controls.","sources":["seo"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"discovery.structured-data","category":"discovery","title":"Use truthful structured data","kind":"practice","featuresAny":["public-site"],"appliesWhen":"A supported rich-result type matches real page content.","verify":"Validate markup and compare every claim with visible content.","evidence":"Validator output and source content.","why":"Misleading metadata creates false expectations.","exceptions":"Do not add schema merely because a template includes it.","sources":["seo"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"security.authorization","category":"security","title":"Enforce permissions on the server","kind":"practice","featuresAny":[],"appliesWhen":"Private data or privileged operations exist.","verify":"Use permitted test identities to exercise direct requests across roles and object owners.","evidence":"Allowed/denied request results.","why":"Hiding a control does not restrict the operation.","exceptions":"A public read-only resource can intentionally allow anonymous access.","sources":["asvs"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"security.secrets","category":"security","title":"Protect credentials and sensitive logs","kind":"practice","featuresAny":[],"appliesWhen":"The app uses credentials or handles sensitive values.","verify":"Inspect delivery bundles and logging paths without printing secrets; verify runtime secret handling.","evidence":"Redacted locations and handling controls.","why":"Client bundles and logs can expose privileged values.","exceptions":"Public client identifiers are not automatically secrets.","sources":["asvs"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"security.abuse","category":"security","title":"Limit automated abuse","kind":"practice","featuresAny":[],"appliesWhen":"Public actions incur cost or send messages.","verify":"Check rate/cost limits, abuse handling and behavior when limits are reached.","evidence":"Configuration plus authorized boundary tests.","why":"A small team needs bounded exposure to automated use.","exceptions":"Avoid disruptive load tests against production.","sources":["asvs"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"security.uploads","category":"security","title":"Control uploaded files","kind":"practice","featuresAny":["uploads"],"appliesWhen":"Users upload content.","verify":"Test allowed type/size, access, storage isolation and any scanning/rendering boundary using benign fixtures.","evidence":"Upload results and storage access checks.","why":"Uploaded content crosses multiple trust boundaries.","exceptions":"Not applicable without uploads; controls depend on file use.","sources":["asvs"],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"communication.support","category":"communication","title":"Provide a working support route","kind":"practice","featuresAny":[],"appliesWhen":"Users need help or incident contact.","verify":"Send an authorized test request or inspect routing and ownership; verify a response path exists.","evidence":"Contact destination and owner-confirmed handling.","why":"An unattended form provides false reassurance.","exceptions":"Internal tools may use an existing company support channel.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"communication.transactional","category":"communication","title":"Test essential transactional messages","kind":"practice","featuresAny":[],"appliesWhen":"The product sends login, purchase or service emails.","verify":"Inspect rendered messages, mobile layout, destination links and expired tokens in a test environment.","evidence":"Message samples with secrets removed and delivery results.","why":"Core journeys may depend on email arriving and working.","exceptions":"Separate test fixtures from production recipients.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"communication.unsubscribe","category":"communication","title":"Honor marketing preferences","kind":"legal","featuresAny":["marketing-email"],"appliesWhen":"Marketing email is sent.","verify":"Check applicable consent/opt-out rules, unsubscribe usability and suppression across providers.","evidence":"Unsubscribe test and subsequent suppression state.","why":"Preference changes must reach the sending system.","exceptions":"Necessary service messages need separate classification and must not disguise marketing.","sources":["email-privacy"],"jurisdiction":"EU/EEA starting point; confirm market, business model, current national law and exceptions","reviewedAt":"2026-09-30"},{"id":"operations.monitoring","category":"operations","title":"Route actionable failures to an owner","kind":"practice","featuresAny":[],"appliesWhen":"The service runs in production.","verify":"Confirm error/uptime monitoring, redaction and alert delivery with a safe test.","evidence":"Alert receipt, owner and runbook.","why":"A dashboard nobody watches does not provide incident response.","exceptions":"Static sites may rely on hosting-provider capabilities.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"operations.restore","category":"operations","title":"Test recovery from backups","kind":"practice","featuresAny":[],"appliesWhen":"The product stores data that cannot be trivially recreated.","verify":"Restore a representative backup into an isolated environment; measure recovery time and retained history.","evidence":"Restore date, result and recovery objectives.","why":"Successful backup creation does not prove recoverability.","exceptions":"Never overwrite production to test restoration.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"operations.rollback","category":"operations","title":"Prepare deployment recovery","kind":"practice","featuresAny":[],"appliesWhen":"Updates can break service or data compatibility.","verify":"Inspect deployment rollback and migration recovery; rehearse in a safe environment.","evidence":"Runbook and rehearsal result.","why":"Application rollback may fail after an incompatible migration.","exceptions":"A forward fix may be safer for irreversible data changes.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"operations.environments","category":"operations","title":"Separate test and production integrations","kind":"practice","featuresAny":[],"appliesWhen":"The app has external services or deployment environments.","verify":"Verify environment-specific endpoints, credentials, sender identities and payment modes without exposing values.","evidence":"Redacted configuration mapping.","why":"Test actions should not affect real users or billing.","exceptions":"Small deployments still need explicit environment boundaries.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"operations.costs","category":"operations","title":"Bound service cost and expiry risks","kind":"practice","featuresAny":[],"appliesWhen":"Vendors, domains, certificates or quotas are required.","verify":"Confirm billing alerts, usage limits, renewals and an accountable owner.","evidence":"Settings and owner-confirmed renewal process.","why":"A forgotten renewal or unbounded API can stop a solo project.","exceptions":"Automatic renewal still needs a valid payment method and alerts.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"store.stock","category":"store","title":"Keep stock and orders consistent","kind":"practice","featuresAny":["ecommerce"],"appliesWhen":"Products have limited availability.","verify":"Test concurrent purchases, inventory changes and failed payments using sandbox orders.","evidence":"Stock/order transitions.","why":"A cart should not promise unavailable goods.","exceptions":"Unlimited digital goods have different constraints.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"store.fulfillment","category":"store","title":"Explain and track delivery","kind":"practice","featuresAny":["ecommerce"],"appliesWhen":"Orders require shipping or delivery.","verify":"Verify destinations, costs, estimates, confirmation and failed fulfillment handling.","evidence":"Checkout and fulfillment test.","why":"Purchase completion is only part of the customer journey.","exceptions":"Instant digital delivery uses a different fulfillment path.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"store.guest","category":"store","title":"Assess guest purchase and order recovery","kind":"practice","featuresAny":["ecommerce"],"appliesWhen":"A storefront sells to occasional customers.","verify":"Review whether an account is necessary; test order lookup and contact without forced enrollment.","evidence":"Guest or justified account-only journey.","why":"Unnecessary registration adds friction.","exceptions":"Regulated or contract-specific services may require verified accounts.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"teams.isolation","category":"teams","title":"Isolate organizations end to end","kind":"practice","featuresAny":["multi-tenant"],"appliesWhen":"Users belong to multiple organizations.","verify":"Test direct URLs, APIs, search, exports and cached results with distinct test tenants.","evidence":"Cross-tenant denial and switching results.","why":"A correct UI filter alone does not isolate data.","exceptions":"Run only with authorized test data.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"teams.membership","category":"teams","title":"Handle invitations and role changes","kind":"practice","featuresAny":["multi-tenant"],"appliesWhen":"Users invite or manage teammates.","verify":"Test expired invites, removed members, role downgrades and stale sessions.","evidence":"Membership and permission transitions.","why":"Access changes must propagate beyond the settings screen.","exceptions":"External identity management may own parts of the flow.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"teams.owner-exit","category":"teams","title":"Resolve last-owner departure","kind":"practice","featuresAny":["multi-tenant"],"appliesWhen":"An organization owns shared data or billing.","verify":"Test transfer of ownership, last-admin removal and account closure effects.","evidence":"Ownership and billing continuity outcome.","why":"Personal account deletion must not orphan a shared workspace.","exceptions":"Single-user projects need no ownership transfer.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"bookings.time","category":"bookings","title":"Display unambiguous appointment times","kind":"practice","featuresAny":["booking"],"appliesWhen":"Appointments cross dates or time zones.","verify":"Test user/business time zones and daylight-saving transitions; inspect confirmations.","evidence":"Stored instant, displayed zone and message comparison.","why":"Ambiguous local times cause missed appointments.","exceptions":"Date-only reservations require date rather than instant semantics.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"bookings.concurrency","category":"bookings","title":"Prevent conflicting reservations","kind":"practice","featuresAny":["booking"],"appliesWhen":"Availability is limited.","verify":"Attempt concurrent sandbox bookings and abandoned holds.","evidence":"Reservation and hold-expiry outcomes.","why":"A visible free slot can become unavailable before confirmation.","exceptions":"Overbooking must be an explicit business policy.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"bookings.changes","category":"bookings","title":"Handle rescheduling and cancellation","kind":"practice","featuresAny":["booking"],"appliesWhen":"Users reserve appointments or resources.","verify":"Test cutoff rules, reminders, refunds and slot release after changes.","evidence":"Reschedule/cancel journey and downstream effects.","why":"Changing a booking affects several systems.","exceptions":"Policies depend on the service and applicable consumer rules.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"community.reporting","category":"community","title":"Let users report problematic content","kind":"practice","featuresAny":["user-content"],"appliesWhen":"Users publish content visible to others.","verify":"Locate reporting and moderation routes; verify owner, acknowledgment and appeal requirements where applicable.","evidence":"Report lifecycle and policy reference.","why":"Publishing tools also need a handling process.","exceptions":"Applicable platform duties require separate market-specific legal review.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"community.controls","category":"community","title":"Explain visibility and removal","kind":"practice","featuresAny":["user-content"],"appliesWhen":"People publish posts, profiles or attachments.","verify":"Test draft/private/public states, removal, blocked users and cached/search copies.","evidence":"Visibility matrix and removal trace.","why":"Users need control over who can access their material.","exceptions":"Required retention or moderation evidence needs a documented exception.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"community.rights","category":"community","title":"Explain content permissions","kind":"practice","featuresAny":["user-content"],"appliesWhen":"The service hosts material created by users.","verify":"Compare upload terms, licences, takedown process and actual reuse of content.","evidence":"Terms and content-use mapping.","why":"Uploading does not automatically grant unlimited reuse.","exceptions":"Special creator contracts may define separate permissions.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"ai.data","category":"ai","title":"Explain AI provider data handling","kind":"practice","featuresAny":["ai"],"appliesWhen":"User content is sent to an AI service.","verify":"Identify transmitted fields, retention/training settings, providers and user disclosures.","evidence":"Provider settings and redacted data flow.","why":"A model call can disclose information outside the product.","exceptions":"Local inference has different transfer risks, but still needs data handling review.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"ai.limits","category":"ai","title":"Communicate uncertainty and failure","kind":"practice","featuresAny":["ai"],"appliesWhen":"Users rely on generated output.","verify":"Test unsupported questions, unavailable providers and misleading outputs; explain important limits and human review routes.","evidence":"Scenario outcomes and user-facing language.","why":"Fluent output can be mistaken for verified information.","exceptions":"Required disclosures depend on use and market; assess applicable AI law separately.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"ai.actions","category":"ai","title":"Constrain AI-triggered actions","kind":"practice","featuresAny":["ai"],"appliesWhen":"AI can call tools or alter external state.","verify":"Test permissions, confirmation for consequential actions, untrusted-input handling and spending limits in a sandbox.","evidence":"Allowed/denied action traces and limits.","why":"Generated instructions must not acquire extra authority.","exceptions":"Read-only assistance has a smaller action surface.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"children.age","category":"children","title":"Verify applicable child consent rules","kind":"legal","featuresAny":["children"],"appliesWhen":"An online service offered directly to children relies on consent within GDPR Article 8.","verify":"Determine national age threshold and a proportionate parental-authorization process; avoid unnecessary identity collection.","evidence":"Dated jurisdiction assessment and tested authorization flow.","why":"A universal age checkbox cannot establish valid consent.","exceptions":"Article 8 is conditional; national thresholds and other legal bases require separate analysis.","sources":["children"],"jurisdiction":"Child-specific laws in actual markets; GDPR Article 8 only where its conditions apply","reviewedAt":"2026-09-30"},{"id":"children.experience","category":"children","title":"Use age-appropriate explanations and defaults","kind":"legal","featuresAny":["children"],"appliesWhen":"Children are intended or realistically foreseeable users.","verify":"Review privacy language, visibility defaults, reporting and persuasive features with the intended age group in mind.","evidence":"Age-specific review and settings.","why":"Children may not understand adult-oriented disclosures.","exceptions":"A stated age limit alone does not resolve foreseeable use.","sources":["children"],"jurisdiction":"Child-specific laws in actual markets; GDPR Article 8 only where its conditions apply","reviewedAt":"2026-09-30"},{"id":"localization.formats","category":"localization","title":"Use correct locale and time conventions","kind":"practice","featuresAny":["localization"],"appliesWhen":"Users see multiple languages, regions or currencies.","verify":"Test dates, numbers, currency, plural forms and address formats in each supported locale.","evidence":"Representative localized journeys.","why":"Translation alone does not localize behavior.","exceptions":"Store stable machine values separately from formatted display.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"},{"id":"localization.completeness","category":"localization","title":"Localize complete journeys","kind":"practice","featuresAny":["localization"],"appliesWhen":"The product promises a supported language.","verify":"Follow entry, forms, errors, emails, policies and support in that language.","evidence":"Missing-string inventory and reviewed translations.","why":"A partially translated critical flow can become unusable.","exceptions":"Clearly declared fallback language may be acceptable for optional content.","sources":[],"jurisdiction":"Project-specific; verify the actual product and deployment","reviewedAt":"2026-09-30"}],"total":90,"starterChecklist":[{"topic":"Privacy policy","checks":["privacy.notice"]},{"topic":"Terms of service","checks":["commerce.terms"]},{"topic":"Refund policy","checks":["commerce.refunds"]},{"topic":"Cookie policy","checks":["cookies.policy"]},{"topic":"Cookie consent banner","checks":["cookies.prior-choice","cookies.withdrawal"]},{"topic":"Form consents","checks":["privacy.basis"]},{"topic":"Unnecessary data","checks":["privacy.minimization"]},{"topic":"Third-party SDKs","checks":["privacy.vendors"]},{"topic":"Dark patterns","checks":["trust.dark-patterns"]},{"topic":"Hidden fees","checks":["commerce.total-price"]},{"topic":"Fake reviews","checks":["trust.reviews"]},{"topic":"Unsupported claims","checks":["trust.claims"]},{"topic":"Alternative text","checks":["accessibility.images"]},{"topic":"Color contrast","checks":["accessibility.contrast"]},{"topic":"Keyboard navigation","checks":["accessibility.keyboard"]},{"topic":"Business details","checks":["footer.identity","commerce.terms"]},{"topic":"Children and consent","checks":["children.age"]},{"topic":"Email unsubscribe","checks":["communication.unsubscribe"]},{"topic":"Font and image licences","checks":["licensing.assets"]},{"topic":"Data deletion requests","checks":["privacy.rights","privacy.retention","accounts.closure"]}],"matched":90}