# Telemetry Privacy Compliance

Phase 72.5.1.7 adds `@v2/telemetry-privacy-compliance`, the batch-level consent
and privacy gate for V2 telemetry. It composes `@aphrodite/consent-engine`,
`@v2/telemetry-ingestion`, and the DSR scope used by
`@v2/themis-privacy-dsr-routing`.

## Consent And Regional Controls

`buildTelemetryPrivacyCompliancePlan` evaluates the Aphrodite consent surface
for telemetry and behavioral profiling. GDPR-region optional telemetry requires
explicit opt-in consent. CCPA/CPRA Do-Not-Sell/Share opt-out suppresses
behavioral telemetry even when a behavioral profiling receipt exists.
GDPR-region optional telemetry requires explicit opt-in.

The persisted `Privacy.TelemetryOptOut` setting suppresses optional matchplay
and behavioral telemetry across save reset boundaries. Required operational
telemetry is limited to session, crash/error, purchase, and compliance facts and
uses the `contract-or-legal-obligation` basis with short retention.

## Retention

The retention policy ID is `v2-telemetry-privacy-retention-v1`.

| Data class              | Retention |
| ----------------------- | --------- |
| Operational telemetry   | 7 days    |
| Optional matchplay data | 30 days   |
| Behavioral telemetry    | 14 days   |

Each accepted event receives a purge timestamp and retention policy ID. Erasure
requests use the `telemetry_purge` scope already exposed by the Themis privacy
DSR router.

## PII Redaction

`redactTelemetryPayload` removes `V2_TELEMETRY_FORBIDDEN_PAYLOAD_FIELDS` plus
telemetry-specific ad ID, name, and phone fields before optional analytics
processing. The redaction mode is `drop-forbidden-fields`; accepted events keep
hashed account IDs and match/session IDs only when allowed by their consent
decision.

Targeted verification:

```bash
pnpm --filter @v2/telemetry-privacy-compliance run typecheck
pnpm --filter @v2/telemetry-privacy-compliance run test
python V2/ue/Tools/check-v2-telemetry-privacy-compliance.py
```