AI Prompts for ChatGPT for Privacy Policies: GDPR / CCPA-Compliant Policies From a Simple Business Description

I am [BUSINESS TYPE: SAAS STARTUP / E-COMMERCE STORE / MOBILE APP / MARKETPLACE / AGENCY / INFO PRODUCT / NEWSLETTER]. Interview me to build the honest data map that a privacy policy must reflect. Walk me through the categories: identifying data (name, email, phone, address), account data (usernames, passwords, profile data), behavioral data (page views, clicks, session recordings, heatmaps), device and technical data (IP, browser, device ID), location data (precise or approximate), financial data (payment card, billing address, invoices), user-generated content (uploads, posts, messages), sensitive data (health, biometric, race, sexual orientation, minors), and derived or inferred data (segments, scores, predictions). For each, ask me whether we collect it, from whom, how, and why.

Continuing my data map, walk me through every third party my business shares data with, because this is what most privacy policies get wrong. Categories: analytics (Google Analytics, Plausible, Mixpanel, PostHog, Amplitude), marketing (Meta Pixel, Google Ads, LinkedIn Insight, TikTok Pixel), email (Mailchimp, ConvertKit, Klaviyo, Postmark, Resend), payments (Stripe, PayPal, Shopify Payments), customer support (Intercom, Zendesk, HelpScout, Crisp), hosting and CDN (AWS, Vercel, Cloudflare, Netlify), storage (S3, GCS, Supabase, Firebase), AI providers (OpenAI, Anthropic, Google, self-hosted), CRM (HubSpot, Salesforce, Pipedrive), and any subprocessor of a subprocessor. Compile the honest list.

For each data collection purpose in my map [PASTE MAP], help me identify the correct GDPR legal basis: consent (unambiguous, freely given, specific, informed), contract necessity (needed to deliver the service the user signed up for), legal obligation (tax records, accounting), vital interests (rare, safety-related), public interest (rare, mostly government), or legitimate interests (must be balanced against user rights and documented). Walk me through each purpose and identify the correct basis, and flag any purpose where I am relying on the wrong basis (most commonly, calling something legitimate interest when it actually requires consent).

For my business [BUSINESS TYPE, REVENUE, USER GEOGRAPHY], diagnose the CCPA and other US state privacy law obligations that apply. Include: whether I hit CCPA thresholds (25M revenue, 100k CA consumer records, or 50 percent revenue from selling data), whether I sell or share data under CCPA (broader than most people think, includes cross-context advertising through Meta and Google Ads), what a Do Not Sell or Share My Personal Information link must include and where, whether I hit thresholds for Colorado, Virginia, Connecticut, Utah, or Texas comprehensive privacy laws, and the state-specific rights language I must include.

For my business collecting data from users in [REGIONS: EU / UK / US / CANADA / GLOBAL], diagnose the international data transfer obligations. Include: whether I am transferring EU or UK data outside the EEA or UK (usually yes, given US-based hosting or subprocessors), which transfer mechanism I need (Standard Contractual Clauses with US subprocessors, adequacy decisions where they exist, EU-US Data Privacy Framework where applicable), the transfer risk assessment expectation, and the specific language my privacy policy must include about international transfers.

Draft the introduction and identity section of my privacy policy. Business details: [LEGAL ENTITY NAME, DBA, ADDRESS, EMAIL, DPO CONTACT IF ONE EXISTS]. Structure: who we are (legal entity, DBA if different, contact address, privacy contact email), what this policy covers (the services, sites, apps), what it does not cover (linked third-party sites, employer processing of employees), the effective date and version history, and the specific language that this policy is written in plain English so users can actually understand it. No boilerplate that references a document the reader will not read.

Draft the data we collect and why section from my data map. My data map: [PASTE MAP]. Structure the section by category (identifying data, account data, behavioral data, device data, location data, financial data, user-generated content, sensitive data, derived data). For each category: what specifically we collect, from whom, how (directly from users, from cookies, from third parties), why (which specific service function it enables), the retention period (specific, not indefinitely), and the legal basis under GDPR. Use plain language readers can actually follow, not the passive voice compliance-theatre style.

Draft the third-party sharing section from my third-party map. My third parties: [PASTE THIRD-PARTY LIST]. Group them into categories: service providers processing on our behalf (hosting, payment, email delivery), analytics and marketing partners (Google Analytics, Meta Pixel, etc.), integration partners the user connects (via OAuth), and legal disclosure recipients (courts, law enforcement under compelled process). For each category name the specific vendors, the specific data shared, the specific purpose, and the location of processing (US, EU, other). This is the section CCPA enforces most aggressively.

Draft the cookies and tracking section. My site uses [COOKIES AND TRACKERS: LIST THEM, OR DESCRIBE IF UNKNOWN]. Structure: what cookies are and how our site uses them, the specific categories (strictly necessary, functional, analytics, advertising), the specific vendors and cookies in each category with retention duration, how users can control cookies (in the cookie banner, in browser settings, in specific third-party opt-outs like Google Ads Settings and Meta Ad Preferences), the specific Do Not Sell or Share My Personal Information language for CCPA, and the Global Privacy Control signal we honor. Compliant with EU e-Privacy Directive and CCPA opt-out requirements.

Draft the user rights section. My user geography is [REGIONS]. Structure by right, covering the union of GDPR, CCPA, and other US state comprehensive privacy law rights: right to know what we hold, right to access a copy, right to correction, right to deletion (with the specific exceptions we retain data under legal obligation), right to portability, right to opt out of sale or share, right to opt out of automated decision making with legal effect, right to limit use of sensitive data (CCPA), and right to withdraw consent where consent is the basis. For each right, explain how to exercise it (specific email or form URL), our response timeline (30 days GDPR, 45 days CCPA with 45-day extension), and the verification steps we require.

For my mobile app on [PLATFORMS: IOS / ANDROID], draft the privacy policy specifics that Apple and Google require and that most policies get wrong. Include: the iOS App Store privacy label details we declare (data types linked to user, data types not linked to user, data used to track), the Google Play Data Safety section details, the specific device permissions we request and why (location, camera, contacts, notifications), the SDK disclosures (analytics SDKs, ad SDKs, crash reporting), the specific advertising ID handling (IDFA on iOS, GAID on Android), and the App Tracking Transparency prompt language.

My business uses AI for [AI USE CASES: LLM-POWERED FEATURES / RECOMMENDATION SYSTEMS / CONTENT MODERATION / FRAUD DETECTION / CUSTOMER SUPPORT ROUTING]. Draft the AI and automated processing section that GDPR Article 22 and emerging state AI laws require. Include: what AI-driven features exist and what data they process, whether we send user data to third-party AI providers (OpenAI, Anthropic, Google) and under what terms (training opt-out, data retention, subprocessor status), whether the AI produces automated decisions with legal or similarly significant effect on the user, the user right to request human review of automated decisions, and the specific transparency about what the AI cannot do.

My business [DOES / DOES NOT] intentionally collect data from children under [AGE THRESHOLD: 13 FOR COPPA IN US / 16 OR LOWER DEPENDING ON MEMBER STATE FOR GDPR]. Draft the childrens data section reflecting my actual practice. If we do not intentionally collect: the age gate mechanism, the deletion protocol if we discover we have collected data from a child, and the parental contact channel. If we do intentionally collect: the parental consent mechanism, the enhanced protections we apply, the specific COPPA compliance for US and the specific GDPR-K compliance for EU member states.

From my international transfer diagnostic [PASTE DIAGNOSTIC], draft the international data transfer section. Include: the specific transfer flows (EU users to US-based hosting or subprocessors), the specific mechanism per flow (SCCs signed with each subprocessor, EU-US Data Privacy Framework certification of the recipient where applicable), the transfer risk assessment summary, the user right to request a copy of the SCCs, and the specific language for UK data transfers under the UK IDTA or UK Addendum to EU SCCs.

Draft the data breach section. Include: our commitment to timelines (72 hours to notify supervisory authority under GDPR, without unreasonable delay to users where the breach poses high risk, US state-specific timelines under state breach notification laws), the specific channel we notify users through (email to registered address, in-product notification, prominent site notice as backup), the information we will include (nature of breach, categories and approximate number of users affected, likely consequences, measures taken or proposed), and our incident response contact.

Draft the cookie consent banner language and behavior for my site. My cookie categories: [CATEGORIES]. Requirements: strictly necessary cookies load without consent, all other categories require prior explicit consent (EU e-Privacy Directive), the banner has an equally prominent Reject All alongside Accept All (EU regulators have enforced against I only accept dark patterns), granular category-level controls in a settings modal, the Global Privacy Control signal is honored server-side, and consent is logged with timestamp, IP, and consented categories. Give me the banner copy, the settings modal copy, and the specific technical implementation notes.

Draft the Data Subject Access Request form and internal workflow. Public-facing form fields: which right the user is exercising (access, correction, deletion, portability, opt-out), the identifying information we need to verify their identity (email, and one additional factor without over-collecting), the specific data or accounts they are asking about. Internal workflow: intake and logging, verification of identity, coordination with subprocessors who hold the data, response drafting, timeline tracking (30 days GDPR, 45 days CCPA), and record-keeping for compliance evidence.

Draft the subprocessor list page my business publishes. From my third-party map [PASTE MAP], structure the table: subprocessor name, service purpose, categories of data processed, location of processing, transfer mechanism if applicable (SCCs, DPF, adequacy). Include: the commitment to notify customers of subprocessor changes, the timeline for notification (typically 30 days), and the objection procedure for customers on Data Processing Agreements. Public page, updated when we add or remove subprocessors.

Draft the internal privacy procedures document my team follows so the privacy policy remains honest. Include: how we onboard a new subprocessor (contract with SCCs, DPA, subprocessor list update, customer notification), how we handle DSAR requests (assigned owner, verification, response), how we handle breaches (incident response, notification timeline, regulator communication), how we handle new data collection (does it require a policy update, does it require new consent), and how we conduct the annual privacy review (policy update, data map refresh, subprocessor audit).

Prep my drafted privacy policy for legal review before publishing. Include: the summary of assumptions I made in each section (specific processing purposes, legal bases, retention periods, jurisdictions covered), the specific questions to ask the reviewing lawyer (novel processing activities, edge cases in my business model, jurisdiction-specific requirements I may have missed), and the specific instruction to the lawyer that the goal is defensibility of the current practice, not template compliance. Save the lawyer time so the review is affordable for a small business.