Disclosure & Consent Pack

Two bodies of law, converging on the same question: when a machine decides about someone, or a machine made the thing they are looking at, what are you obliged to tell them — and what did they agree to?

CCPA Cybersecurity Audit & Privacy Risk Assessment Kit — the automated-decision side. The applicability and phase-in calculator, per-activity privacy risk assessments and their register, the 18-component audit workplan with its auditor-independence checklist, the §7124 certification cover, and the ADMT addendum: the applicability test, the logic and output description, the §7220 pre-use notice, the §7221 opt-out and the §7222 access rights. Assessments for processing already under way are due 31 December 2027.

Synthetic Media & Deepfake Defense Kit — the synthetic side. Disclosure built once — a visible caption, the platform's native label, C2PA content credentials and a register row — satisfying EU Article 50, the Chinese, Korean and Indian labelling rules, the YouTube, TikTok and Meta policies, New York's synthetic-performer advertising rule and the state election statements together. Plus the consent pack the digital-replica statutes now require: a likeness and voice release, an employee addendum, a talent rider, and documentation for a synthetic persona built from no one. And the Defend half — because the organisations producing synthetic media are the ones being impersonated with it.

Why the pair, and why California in particular. The CCPA kit tells you when an automated decision needs a pre-use notice and an opt-out. The synthetic-media kit tells you when generated content needs a label, a credential and a signed release. California asks for both — ADMT under the CPPA regulations, and latent disclosure duties on covered providers under the AI Transparency Act (SB 942) — and the same is arriving state by state. The notice you write, the register you keep and the person you have to be able to answer to are the same in both cases; only the trigger differs.

Run them separately and you end up with two notice regimes, two registers and two sets of wording that a regulator can read side by side. Run them together and the disclosure practice is one practice.

Offered at Individual Practitioner and vCISO / MSSP, the two tiers the CCPA kit sells.