CCPA & Multi-Region Privacy Compliance (CPRA, LGPD, APPI)

Paid pluginsize Mplanned, not built

Indicative price, not an offer: $29-59/mo for 3+ regions

Generated from docs/plan/paid/ccpa-multi-region-privacy-compliance/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Paid module (EUR 29–59/mo for 3+ regions) that provides region-aware privacy consent flows for CCPA (USA), CPRA (California), LGPD (Brazil), APPI (Japan). Each region has different disclosure rules, opt-out mechanics, and data subject request (DSR) workflows. Merchants selling internationally face compliance failures in each jurisdiction if they use a one-size-fits-all banner.

The problem

US/Brazil/Japan privacy laws require different disclosures and consent flows. I cannot use one banner for all regions; each country has unique data-sale, retention, and request-to-delete rules. Non-compliance results in fines up to USD 7,500/violation (CCPA), BRL 50M+ (LGPD), or JPY 1B+ (APPI).

What it does

• Region detection: GeoIP to identify visitor’s region; show region-specific privacy flow (California, Brazil, Japan, or rest-of-world default)
• CCPA flow: ‘Do Not Sell My Personal Information’ link (for consumers); ‘Sale’ checkbox (for collection); DSR workflow (verify identity, fulfill access/delete/opt-out requests within 45 days)
• CPRA flow: additional ‘Correct’, ‘Port’, and ‘Limit Use’ rights; higher identity verification threshold (certified provider required)
• LGPD flow: ‘Data Subject’ consent model (opt-in, not opt-out); consent for each use case separately (marketing, analytics, etc.); ANPD (Brazil’s DPA) notice; 60-day DSR window
• APPI flow: personal information is ‘sensitive’ if health/race/religion; requires separate explicit consent; transfer to third countries forbidden; 30-day DSR window
• Central DSR handler: merchant receives automated request (email + admin dashboard), verifies requester identity, and fulfills within the region’s deadline
• Audit trail: every consent, denial, DSR, and fulfillment is logged with timestamp, region, and compliance deadline

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• No legal template translation — merchant must translate privacy policy and disclosures per region (reason: legal translation is a separate service; AstroBaaS provides the structure only)
• No automated DSR fulfillment (e.g., ‘delete all data’ button) — merchant must manually verify identity and approve deletion (reason: identity verification is complex and region-specific; a wrong deletion is catastrophic)
• No regional data residency enforcement — module is advisory; if a merchant must store data in Brazil only, they must configure their database separately (reason: data residency is an infrastructure problem, not an API problem)

Data model

Settings: privacy_regions (array: [‘CCPA’, ‘CPRA’, ‘LGPD’, ‘APPI’]), privacy_region_mode (‘strict’ | ‘permissive’), geoip_enabled (boolean). New ConsentLog entity: {visitor_id, region, law_code (CCPA|CPRA|LGPD|APPI), consents, timestamp}. New DataSubjectRequest entity: {customer_id, region, request_type (access|delete|portability|correct|opt_out), status (received|verified|fulfilled|denied), created_date, deadline_date}.

API

• GET /api/privacy/region-settings?visitor_region=CA → { law_code, disclosures, required_consents, dsr_deadline_days }
• POST /api/privacy/consent { region, consents: {…} } → { recorded, region, deadline }
• POST /api/privacy/dsr/request { type, customer_email, verification_method } → { request_id, deadline_date, status: ‘received’ }
• POST /api/privacy/dsr/:id/verify { proof: file|code } → { status: ‘verified’ | ‘denied’ }
• POST /api/privacy/dsr/:id/fulfill → { status: ‘fulfilled’, download_url|delete_date }
• GET /api/privacy/audit-log (admin only)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Settings → Privacy → Multi-Region Compliance: select regions (checkboxes: CCPA, CPRA, LGPD, APPI), customize privacy text per region, set DSR verification method (email code, SMS code, certified verifier). Dashboard → DSR Requests: shows requests in progress with deadline, allows admin to verify and fulfill. Audit log shows all consent, DSR, and fulfillment events.

The seam — why this is paid

Paid module owns region detection, privacy flow logic, DSR handling, and audit trails. Core owns customer record and data storage (module only provides a request interface; core holds the data). Merchant owns verifying identity and approving deletions.

Paid module owns per-region legal templates, consent flow logic, and data subject request (DSR) automation; compliance liability per jurisdiction

Dependencies

• Customer entity (core)
• Settings (core)
• GeoIP service (third-party: MaxMind, IP2Location, or similar)
• Email sending (for DSR notifications)
• Data export/delete functions (core must support)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Visitor from California sees CCPA banner with ‘Do Not Sell My Personal Information’ link; visitor from Brazil sees LGPD banner with ‘Consent’ toggle
• CCPA visitor clicks ‘Do Not Sell’ and receives a verification email (code); on verification, status is ‘Opt-Out’
• Merchant receives DSR request (email + admin dashboard); deadline is 45 days (CCPA)
• LGPD visitor receives a DSR request deadline of 60 days; APPI visitor receives 30 days
• Merchant clicks ‘Verify’ on a DSR request, uploads ID photo/verification, and system marks as ‘verified’
• Merchant clicks ‘Fulfill’, system exports customer data as CSV, and DSR status becomes ‘fulfilled’ with export date

Risks

GeoIP is not 100% accurate; California resident may be misdetected as rest-of-world (need manual override). Merchant does not translate privacy policy; non-English speakers cannot consent properly. Merchant misses DSR deadline; AstroBaaS sends reminders but cannot enforce (legal liability stays with merchant). Identity verification via email code is not certified; some regions (CPRA) require certified verifiers (merchant must hire separately).

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.