A privacy compliance audit your coding agent can run.
The two checkers on this site look at one page from the outside. This one drives a real browser through your accept and reject flows, reads the privacy policy, and writes a structured report — inside your own agent, on your own machine.
- SKILL
- privacy-compliance-checker
- RUNS IN
- Claude Code and other agents, via agent-browser
- COVERS
- GDPR, CCPA/CPRA and nine APAC regimes
- DATA
- Everything stays in your agent. Nothing is sent to Katla.
One command, then ask your agent.
The skill installs into your agent's skills directory and loads itself when you ask a question it recognises. It drives the browser through agent-browser, so everything it sees stays on your machine.
npx skills add katla-app/agent-skills
npx skills add katla-app/agent-skills --list
“Check whether example.com is compliant for the EU and Japan, and tell me what a consent platform would fix versus what needs separate work.”
Seven steps, in the order it runs them.
The skill follows a fixed process so two runs of the same site are comparable, and so a report can be read without knowing how it was produced.
Scope the jurisdictions
It asks which markets the site serves before auditing anything, or infers them from the page — language switcher, currency, ccTLD, footer address, payment methods. Auditing all twelve regimes by default produces a report nobody reads.
Audit the first load
Screenshots the page as a first-time visitor sees it, then records cookies, localStorage and sessionStorage set before any interaction, plus every third-party host contacted. That one capture is the evidence for the GDPR, Thailand, Indonesia, Philippines and India checks — and the primary evidence for Japan’s transfer rule.
Test the banner
Drives accept and reject, then re-reads the jar each time. This is where a banner that displays but does not block gives itself away — and it is the part a passive checker cannot do.
Run the CCPA checks
Looks for a Do Not Sell or Share route, checks whether the Global Privacy Control signal is honoured, and reads the notice at collection.
Run the APAC checks
Only the regimes in scope, each with its own rules: Japan’s third-party transfer confirmation, the opt-in consent regimes, and the notice-first ones where the obligation is disclosure rather than a blocking banner.
Read the privacy policy
Finds it, then checks it says what each in-scope regime requires — retention, rights, the grievance or DPO contact, and how to withdraw.
Sweep the technical details
Cookie attributes, security headers, and the tracking technologies the page loads, tied back to the cookies and hosts already captured.
Eleven regimes, grouped by how they audit.
Grouped by the shape of the obligation rather than by geography, because that is what changes the checks. China, South Korea and Vietnam are not covered — their rules turn on separate consent for third-party provision and cross-border transfer, which needs its own audit.
Opt-in, GDPR-shaped
Consent before anything non-essential
Notice-first
Disclosure, not a blocking banner
Transfer-triggered
Consent on third-party provision
Opt-out
Sale and sharing, plus GPC
A verdict per regime, and what to do about it.
The report closes by splitting findings into what a consent platform fixes and what needs separate work — a policy rewrite, a DPO appointment, a transfer agreement. Being told your banner is wrong is useful; being told which half of the problem is yours to solve is more so.
Read the full report format on GitHubCompliance report
example.com · GDPR, CCPA, APPI, DPDP · 7 findings
| Category | Status | Issues |
|---|---|---|
| Cookie consent | Fail | 4 |
| Privacy policy | Partial | 2 |
| GPC / Do Not Sell | Pass | 0 |
| Japan (APPI) | Partial | 1 |
| Security headers | Pass | 0 |
| India (DPDP) | N/A | 0 |
Fixable with a consent platform
Blocking before consent, granular categories, withdrawal, the consent record, Consent Mode signals.
Needs separate work
Policy wording, retention periods, a DPO or grievance contact, transfer agreements.
Illustrative output. Your report reflects your own site.
The same repo ships the implementation skill.
katla-sdk teaches your agent to implement consent with the Katla SDK, so the fixes the audit recommends can be applied in the same session. Katla is also available to agents directly through the MCP server.