Phase 72.5.1.7 adds @v2/telemetry-privacy-compliance, the batch-level consent
and privacy gate for V2 telemetry. It composes @aphrodite/consent-engine,
@v2/telemetry-ingestion, and the DSR scope used by
@v2/themis-privacy-dsr-routing.
Consent And Regional Controls#
buildTelemetryPrivacyCompliancePlan evaluates the Aphrodite consent surface
for telemetry and behavioral profiling. GDPR-region optional telemetry requires
explicit opt-in consent. CCPA/CPRA Do-Not-Sell/Share opt-out suppresses
behavioral telemetry even when a behavioral profiling receipt exists.
GDPR-region optional telemetry requires explicit opt-in.
The persisted Privacy.TelemetryOptOut setting suppresses optional matchplay
and behavioral telemetry across save reset boundaries. Required operational
telemetry is limited to session, crash/error, purchase, and compliance facts and
uses the contract-or-legal-obligation basis with short retention.
Retention#
The retention policy ID is v2-telemetry-privacy-retention-v1.
| Data class | Retention |
|---|---|
| Operational telemetry | 7 days |
| Optional matchplay data | 30 days |
| Behavioral telemetry | 14 days |
Each accepted event receives a purge timestamp and retention policy ID. Erasure
requests use the telemetry_purge scope already exposed by the Themis privacy
DSR router.
PII Redaction#
redactTelemetryPayload removes V2_TELEMETRY_FORBIDDEN_PAYLOAD_FIELDS plus
telemetry-specific ad ID, name, and phone fields before optional analytics
processing. The redaction mode is drop-forbidden-fields; accepted events keep
hashed account IDs and match/session IDs only when allowed by their consent
decision.
Targeted verification:
pnpm --filter @v2/telemetry-privacy-compliance run typecheck
pnpm --filter @v2/telemetry-privacy-compliance run test
python V2/ue/Tools/check-v2-telemetry-privacy-compliance.py