# V2 Extended Privacy Compliance This document is the section 94 launch control for privacy-by-design, DPIA, sub-processor transparency, regional minor protections, Quebec, Brazil, loot-box-adjacent disclosures, erasure audit trails, and breach response. It is an engineering and product baseline, not jurisdiction-specific legal advice. Last authority source review: 2026-05-18. ## Release Gate Every release gate must include a privacy review before the build can advance. The release owner must attach the current `Privacy-by-Design` row, DPIA status, sub-processor delta, regional-rule delta, DSR automation evidence, and privacy ops handoff. A release cannot proceed when a feature collects new personal data, changes a lawful basis, changes a retention period, adds a cross-border transfer, or enables a new region without DPO or legal approval. The canonical per-feature register is `V2/docs/legal/privacy-by-design-dpia.md`. Required fields are data collected, lawful basis, retention, subject rights impact, and cross-border transfer mechanism. Any feature touching identifiable or sensitive data requires a DPIA before content lock. ## Sub-Processors The public sub-processor registry is published at: - `V2/legal/sub-processors.md` - `apps/v2/web/legal/sub-processors/` Every row must name the vendor, processing purpose, jurisdiction, contract reference, and data categories accessed. New sub-processors require 30 days' notice to the player base through the announcement channel referenced by section 85.3, plus internal DPO/legal approval before the vendor receives live data. Platform and cloud DPAs are mandatory for Sony, Microsoft, Nintendo, Steam, Epic, AWS, Azure, Google Cloud, and Cloudflare before production traffic or production player data is routed to that processor. ## California AADC Detected California minor accounts use the AADC protection profile: - Collect only data necessary to provide the feature. - Default privacy settings to private. - Disable behavioral profiling and behavioral advertising. - Prohibit dark patterns that pressure additional disclosure, sharing, or purchase. - Enforce the profile from per-account jurisdiction detection, not only from a store-region default. The account-jurisdiction service must combine platform country, verified age band, billing/store country, account self-declared region, and network-risk signals. Ambiguous minor accounts fall back to the more protective minor profile until reviewed or corrected. ## Quebec Quebec accounts receive French-language surfaces that are at least as visible and complete as English launch surfaces. French copy review covers privacy settings, DSR forms, account notices, sub-processor notices, breach notices, store disclosures, and product-placement labels. Quebec Bill 25 controls include privacy officer routing, consent receipts, breach register entries, written response workflows, portability support in a structured commonly used format, and cross-border privacy impact assessment before personal information leaves Quebec. ## Brazil Brazil accounts route DSRs under LGPD where applicable, including confirmation, access, correction, anonymization or elimination, portability where available, sharing information, consent withdrawal, and review of automated decisions when applicable. The DSR router uses `lgpd` as a legal-framework SLA and routes the workflow through `@themis/privacy`, `@oshun/data-residency`, and `@oshun/audit-platform`. Marco Civil controls require privacy-preserving moderation records, court-order or legal-hold routing where required, user-facing moderation notice, appeal availability, and retention rules for Brazil-specific legal process without exposing private content to non-authorized teams. ## Italy, Belgium, And France V2 ships without paid loot boxes, gacha, chance packs, paid random rewards, or real-money cash-out anywhere. Italy and Belgium SKUs carry a no-loot-box compliance disclosure and default to disabling any future surprise mechanic until local counsel approves a SKU adjustment. France product-placement and paid brand partnership disclosures must appear in pre-launch materials and in the relevant in-game event banner. French child account surfaces cannot receive behavioral ad targeting or undisclosed paid placement. ## Quarterly Review The DPO and legal team review privacy impact every quarter. The review covers new sub-processors, new features, new region launches, regulatory changes, minor protections, DSR performance, erasure audit samples, breach readiness, and public notice accuracy. Internal summaries are published to the release readiness archive. Sanitized public summaries are published after removal of security-sensitive, personal, and privileged details. ## Erasure Audit Trail Every erasure request logs request -> action -> confirmation. The retained audit log is anonymized and kept under `v2-dsr-erasure-audit-retention`. The erasure scope is documented per request: - account - profile - replay anonymization - telemetry purge - cosmetic ledger The DSR service exposes this scope in `erasureScope` and includes the `erasureAuditTrail` object in the audit-platform metadata for erasure requests. Non-erasure requests keep the erasure audit object null. ## Privacy Ops On-Call Privacy operations maintains an on-call rotation for breach response. The runbook is `V2/docs/legal/privacy-ops-on-call.md`. The breach clock starts when the privacy incident commander confirms a personal-data breach. The default external-notification target is 72 hours for GDPR-style obligations, with local variants recorded in the incident brief, including ANPD timelines for Brazil and Quebec CAI notification when applicable. ## Authority Sources Snapshot - California AB 2273 bill text: California Legislative Information. - Quebec Law 25 guidance and rights materials: Commission d'acces a l'information du Quebec. - Quebec French-language obligations: Quebec Charter of the French Language on LegisQuebec. - Brazil LGPD and ANPD DSR/incidents guidance: ANPD and gov.br. - Brazil Marco Civil: Planalto Law No. 12.965/2014. - France commercial communication and product-placement guidance: Arcom. - Existing section 80 references remain active for GDPR, DSA, CCPA/CPRA, COPPA, AI Act, cookies, and wagering thresholds.