GDPR Privacy Policy Analyzer AI Agent with Kestra

id: ai-gdpr-privacy-policy-analyzer
namespace: company.legal

description: |
  AI agent that crawls a website's privacy policy and cookie notice,
  then analyzes them for GDPR and ePrivacy Directive compliance.

inputs:
  - id: privacy_policy_url
    type: STRING
    displayName: URL of the privacy policy page
    defaults: https://example.com/privacy-policy

  - id: cookie_policy_url
    type: STRING
    displayName: URL of the cookie/consent notice (optional)
    defaults: https://example.com/cookie-policy

  - id: analysis_scope
    type: SELECT
    displayName: Analysis scope
    defaults: Full compliance review
    values:
      - Full compliance review
      - Transparency obligations only (Articles 13-14)
      - Cookie and consent focus (ePrivacy)
      - Data subject rights coverage (Articles 15-22)
      - International transfers focus (Chapter V)

tasks:
  # Step 1, Fetch the privacy policy and cookie notice from the web.
  # The agent uses the filesystem MCP tool to save its analysis report.
  - id: analyze_policy
    type: io.kestra.plugin.ai.agent.AIAgent
    description: Fetch and analyze privacy policy for GDPR compliance
    # Mistral Large, European AI model by Mistral AI (Paris, France).
    # Privacy policy URLs and their content are generally public, but
    # using an EU-based model demonstrates best practice for legal workflows.
    #
    # For local deployment without external API calls:
    #   type: io.kestra.plugin.ai.provider.Ollama
    #   endpoint: http://ollama:11434
    #   modelName: mistral-large
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
      apiKey: "{{ secret('MISTRAL_API_KEY') }}"
      modelName: mistral-large-2512
    configuration:
      temperature: 0.1
      maxToken: 6144
    contentRetrievers:
      - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
        apiKey: "{{ secret('TAVILY_API_KEY') }}"
        maxResults: 5
    systemMessage: |
      You are a GDPR and ePrivacy compliance specialist analyzing
      privacy policies and cookie notices for legal compliance.

      Your analysis must be thorough and reference specific legal
      requirements:

      GDPR TRANSPARENCY REQUIREMENTS:
      - Article 13: Information to be provided when data is collected
        from the data subject
      - Article 14: Information when data is not obtained from the subject
      - Article 12: Transparent, intelligible, and easily accessible form
      - Recital 58: Principle of transparency

      ePRIVACY DIRECTIVE (2002/58/EC) & NATIONAL IMPLEMENTATIONS:
      - Article 5(3): Prior informed consent for cookies and similar
        technologies (except strictly necessary)
      - CJEU Planet49 ruling (C-673/17): Pre-ticked boxes are NOT valid consent
      - EDPB Guidelines 05/2020 on consent

      READABILITY:
      - Assess Flesch Reading Ease score or equivalent
      - Flag legal jargon that a typical user would not understand
      - Check if layered notices are used for complex processing

      Output structured Markdown with compliance ratings.
    prompt: |
      Analyze the following privacy policy and cookie notice for GDPR
      and ePrivacy compliance:

      PRIVACY POLICY URL: {{ inputs.privacy_policy_url }}
      COOKIE POLICY URL: {{ inputs.cookie_policy_url }}
      ANALYSIS SCOPE: {{ inputs.analysis_scope }}

      Use web search to fetch and read both URLs. Then perform the following
      analysis:

      ## 1. Article 13 Compliance Checklist
      For each required element, mark PRESENT / ABSENT / INSUFFICIENT:
      - [ ] Identity and contact details of the controller
      - [ ] DPO contact details (if applicable)
      - [ ] Purposes and legal basis for each processing activity
      - [ ] Legitimate interests pursued (if Art. 6(1)(f) is relied upon)
      - [ ] Recipients or categories of recipients
      - [ ] International transfers and safeguards (Chapter V)
      - [ ] Retention periods or criteria for determining them
      - [ ] Data subject rights (access, rectification, erasure, restriction,
            portability, objection)
      - [ ] Right to withdraw consent (if consent is the legal basis)
      - [ ] Right to lodge a complaint with a supervisory authority
      - [ ] Whether provision of data is statutory/contractual requirement
      - [ ] Automated decision-making including profiling (Article 22)

      ## 2. Cookie and Consent Compliance
      - Are cookies categorised (strictly necessary, functional, analytics,
        marketing)?
      - Is prior consent obtained BEFORE setting non-essential cookies?
      - Can users refuse non-essential cookies as easily as accepting them?
      - Are specific cookie purposes and durations disclosed?
      - Is a cookie consent management platform (CMP) mentioned?
      - Does the CMP implementation align with EDPB guidelines?

      ## 3. Readability Assessment
      - Is the language clear and plain (Article 12(1))?
      - Are layered notices or summaries provided?
      - Estimated reading level and comprehensibility score

      ## 4. Red Flags
      List any statements that are:
      - Contradictory or internally inconsistent
      - Overly broad ("we may share data with partners")
      - Relying on blanket consent for multiple purposes
      - Missing required information entirely
      - Using dark patterns in consent mechanisms

      ## 5. Compliance Score & Remediation Priority
      Provide an overall compliance rating (A-F) and a prioritised
      list of changes needed, starting with the most critical gaps.

  - id: log_analysis
    type: io.kestra.plugin.core.log.Log
    message: "{{ outputs.analyze_policy.textOutput }}"

Manually auditing a privacy policy against GDPR and the ePrivacy Directive is slow, inconsistent, and easy to let drift between releases. This blueprint runs an AI agent that fetches a website's privacy policy and cookie notice from live URLs, then grades them element by element against GDPR transparency obligations (Articles 12, 13, 14), data subject rights (Articles 15-22), international transfer safeguards (Chapter V), and ePrivacy cookie consent rules, returning a structured Markdown report with a compliance score and a prioritized remediation list.

How it works

The analyze_policy task (io.kestra.plugin.ai.agent.AIAgent) takes the policy URL, cookie notice URL, and analysis scope as inputs, then runs a GDPR specialist systemMessage with a low temperature (0.1) for consistent, auditable output.
A io.kestra.plugin.ai.retriever.TavilyWebSearch content retriever lets the agent crawl and read both live URLs (maxResults: 5) instead of relying on stale training data.
The model is io.kestra.plugin.ai.provider.MistralAI (Mistral Large), an EU-based model that suits a data sovereignty posture for legal workflows; YAML comments show how to switch to io.kestra.plugin.ai.provider.Ollama for fully local, no-API-call operation.
The log_analysis task (io.kestra.plugin.core.log.Log) prints the agent's textOutput, so the full report is visible in the execution logs.

What you get

An Article 13 disclosure checklist marking each required element PRESENT, ABSENT, or INSUFFICIENT.
A cookie and consent assessment against EDPB guidelines and the CJEU Planet49 ruling (no pre-ticked boxes).
A readability assessment against the Article 12 plain-language standard.
A red-flag list covering dark patterns, overly broad data sharing, and blanket consent.
An overall A-F compliance rating with a prioritized fix list.

Who it's for

Legal and privacy teams auditing their own notices.
DPOs running periodic compliance reviews.
Privacy consultants benchmarking client websites.
Compliance and risk teams screening policies at scale.

Why orchestrate this with Kestra

A standalone LLM script cannot schedule itself, retry a flaky web crawl, or keep an audit trail. With Kestra you get event and schedule triggers (re-run on every policy change or on a quarterly cadence), automatic retries on transient API or search failures, full execution lineage and logs for every audit, and a declarative YAML definition you can version in Git. The AI provider and Tavily retriever have no built-in scheduler, retry policy, or run history of their own: Kestra supplies all of that around them.

Prerequisites

A running Kestra instance and accounts for Mistral AI and Tavily.

Secrets

MISTRAL_API_KEY: API key from the Mistral AI console.
TAVILY_API_KEY: API key from Tavily for web crawling and search.

Quick start

Add MISTRAL_API_KEY and TAVILY_API_KEY as secrets in your Kestra instance.
Import this blueprint into a namespace.
Execute it, supplying the privacy_policy_url, optional cookie_policy_url, and an analysis_scope.
Read the compliance report in the log_analysis task output.

How to extend

Narrow analysis_scope to transparency only, cookie focus, data subject rights, or international transfers.
Add a notification task to post failing scores to Slack or email.
Add a Schedule trigger to re-audit policies on a recurring cadence.
Swap the provider to io.kestra.plugin.ai.provider.Ollama for an air-gapped, local-only run.
Loop the agent over a list of client URLs to benchmark a portfolio.

Analyze Privacy Policies and Cookie Notices for GDPR and ePrivacy Compliance

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

New to Kestra?

Analyze Privacy Policies and Cookie Notices for GDPR and ePrivacy Compliance

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

More AI Blueprints

App Store Review Triage that Classifies Reviews in Any Language with AI and Files Confirmed Bugs as GitHub Issues

Azure ML Data Asset Version Sprawl Sentinel

AssemblyAI Transcription Error Sentinel

Automated Customer Feedback Sentiment Analysis and Reporting

Azure AI Foundry Evaluation Failure Gate

Turn an Apify web crawl into a fresh RAG vector index

New to Kestra?