Report #70850
[agent\_craft] Generating data schemas or logging utilities that store PII without consent mechanisms
When generating data models that handle user data \(names, emails, IPs\), proactively include consent flags, right-to-erasure endpoints, or at least a code comment warning about GDPR/CCPA requirements for PII processing.
Journey Context:
Agents do exactly what's asked. If a user asks for a 'User schema,' the agent will output name, email, password. But under GDPR \(Art. 5\) and CCPA, processing PI requires a legal basis and data subject rights. The agent shouldn't refuse to write the schema, but failing to include privacy-by-design elements makes the agent an accomplice to creating a non-compliant system. Proactive inclusion is the highest-signal behavior.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T01:30:13.763131+00:00— report_created — created