Analyze Privacy Policies and Cookie Notices for GDPR and ePrivacy Compliance

id: ai-gdpr-privacy-policy-analyzer
namespace: company.legal

description: |
  AI agent that crawls a website's privacy policy and cookie notice,
  then analyzes them for GDPR and ePrivacy Directive compliance.

inputs:
  - id: privacy_policy_url
    type: STRING
    displayName: URL of the privacy policy page
    defaults: https://example.com/privacy-policy

  - id: cookie_policy_url
    type: STRING
    displayName: URL of the cookie/consent notice (optional)
    defaults: https://example.com/cookie-policy

  - id: analysis_scope
    type: SELECT
    displayName: Analysis scope
    defaults: Full compliance review
    values:
      - Full compliance review
      - Transparency obligations only (Articles 13-14)
      - Cookie and consent focus (ePrivacy)
      - Data subject rights coverage (Articles 15-22)
      - International transfers focus (Chapter V)

tasks:
  # Step 1, Fetch the privacy policy and cookie notice from the web.
  # The agent uses the filesystem MCP tool to save its analysis report.
  - id: analyze_policy
    type: io.kestra.plugin.ai.agent.AIAgent
    description: Fetch and analyze privacy policy for GDPR compliance
    # Mistral Large, European AI model by Mistral AI (Paris, France).
    # Privacy policy URLs and their content are generally public, but
    # using an EU-based model demonstrates best practice for legal workflows.
    #
    # For local deployment without external API calls:
    #   type: io.kestra.plugin.ai.provider.Ollama
    #   endpoint: http://ollama:11434
    #   modelName: mistral-large
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
    configuration:
      temperature: 0.1
      maxToken: 6144
    contentRetrievers:
      - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
        maxResults: 5
    systemMessage: |
      You are a GDPR and ePrivacy compliance specialist analyzing
      privacy policies and cookie notices for legal compliance.

      Your analysis must be thorough and reference specific legal
      requirements:

      GDPR TRANSPARENCY REQUIREMENTS:
      - Article 13: Information to be provided when data is collected
        from the data subject
      - Article 14: Information when data is not obtained from the subject
      - Article 12: Transparent, intelligible, and easily accessible form
      - Recital 58: Principle of transparency

      ePRIVACY DIRECTIVE (2002/58/EC) & NATIONAL IMPLEMENTATIONS:
      - Article 5(3): Prior informed consent for cookies and similar
        technologies (except strictly necessary)
      - CJEU Planet49 ruling (C-673/17): Pre-ticked boxes are NOT valid consent
      - EDPB Guidelines 05/2020 on consent

      READABILITY:
      - Assess Flesch Reading Ease score or equivalent
      - Flag legal jargon that a typical user would not understand
      - Check if layered notices are used for complex processing

      Output structured Markdown with compliance ratings.
    prompt: |
      Analyze the following privacy policy and cookie notice for GDPR
      and ePrivacy compliance:

      PRIVACY POLICY URL: {{ inputs.privacy_policy_url }}
      COOKIE POLICY URL: {{ inputs.cookie_policy_url }}
      ANALYSIS SCOPE: {{ inputs.analysis_scope }}

      Use web search to fetch and read both URLs. Then perform the following
      analysis:

      ## 1. Article 13 Compliance Checklist
      For each required element, mark PRESENT / ABSENT / INSUFFICIENT:
      - [ ] Identity and contact details of the controller
      - [ ] DPO contact details (if applicable)
      - [ ] Purposes and legal basis for each processing activity
      - [ ] Legitimate interests pursued (if Art. 6(1)(f) is relied upon)
      - [ ] Recipients or categories of recipients
      - [ ] International transfers and safeguards (Chapter V)
      - [ ] Retention periods or criteria for determining them
      - [ ] Data subject rights (access, rectification, erasure, restriction,
            portability, objection)
      - [ ] Right to withdraw consent (if consent is the legal basis)
      - [ ] Right to lodge a complaint with a supervisory authority
      - [ ] Whether provision of data is statutory/contractual requirement
      - [ ] Automated decision-making including profiling (Article 22)

      ## 2. Cookie and Consent Compliance
      - Are cookies categorised (strictly necessary, functional, analytics,
        marketing)?
      - Is prior consent obtained BEFORE setting non-essential cookies?
      - Can users refuse non-essential cookies as easily as accepting them?
      - Are specific cookie purposes and durations disclosed?
      - Is a cookie consent management platform (CMP) mentioned?
      - Does the CMP implementation align with EDPB guidelines?

      ## 3. Readability Assessment
      - Is the language clear and plain (Article 12(1))?
      - Are layered notices or summaries provided?
      - Estimated reading level and comprehensibility score

      ## 4. Red Flags
      List any statements that are:
      - Contradictory or internally inconsistent
      - Overly broad ("we may share data with partners")
      - Relying on blanket consent for multiple purposes
      - Missing required information entirely
      - Using dark patterns in consent mechanisms

      ## 5. Compliance Score & Remediation Priority
      Provide an overall compliance rating (A-F) and a prioritised
      list of changes needed, starting with the most critical gaps.

  - id: log_analysis
    type: io.kestra.plugin.core.log.Log
    message: "{{ outputs.analyze_policy.textOutput }}"

pluginDefaults:
  - type: io.kestra.plugin.ai.provider.MistralAI
    values:
      apiKey: "{{ secret('MISTRAL_API_KEY') }}"
      modelName: mistral-large-2512
  - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
    values:
      apiKey: "{{ secret('TAVILY_API_KEY') }}"