policy-remediation-plan

Policy Remediation Plan

Step-by-step guide to fix policy violations and achieve compliance. Includes templates, legal references, and procedures for each violation type.

Scope Context

Downstream remediation skill fed by policy-risk-scanner.

Field	Value
Phase	Remediation
Upstream	`policy-risk-scanner`
ARB items addressed	PC01–PC11 (core); PC12–PC13 when flagged as extension
Score mode	Inherited from `policy-risk-scanner` output — this skill does not independently score
Veto priority	PC10 (affiliate disclosure) and any PC fail are veto items — fix these first

Fixes must be re-verified by running policy-risk-scanner again under the same score mode.

Purpose

Fix policy compliance violations from policy-risk-scanner:

Remove/revise prohibited content
Add proper affiliate disclosures
Implement privacy protections
Handle regulated content correctly
Achieve legal compliance (GDPR, CCPA, etc.)

Critical Violations (Fix Immediately)

Illegal Content (PC01) — CRITICAL

Action:

Identify all illegal content pages
Immediately remove or make inaccessible (HTTP 410 Gone)
Don't just hide with robots.txt (still harmful)
Remove from Google Search Console coverage

Process:

Use Google Search Console → Removals → Temporarily hide
Then permanently delete content after 6 months
Or HTTP 410 status code

Example:

# Mark as gone
curl -X DELETE https://example.com/illegal-page
# Server returns 410 Gone status code

Health Misinformation (PC05) — CRITICAL

Identify problematic claims:

Anti-vaccine content
COVID-19 denial
"Miracle cures"
Dangerous medical advice

Fix Options:

Option 1: Remove

Delete page entirely (best)
Return 410 Gone status code

Option 2: Substantially Revise

Add medical disclaimers
Cite peer-reviewed studies
Recommend consulting doctors
Remove absolute health claims

Example Before/After:

BEFORE: "This supplement cures diabetes"
AFTER: "This supplement may support blood sugar levels.
        Always consult your doctor. See study: [link]"

Add Disclaimers:

<div class="medical-disclaimer">
  <strong>Medical Disclaimer:</strong> This information is
  not medical advice. Always consult a healthcare provider.
</div>

Malware Distribution (PC07) — CRITICAL

Action:

Identify malicious downloads
Remove immediately (410 Gone)
Scan server for compromise
Update passwords and security
Use hashed upload verification

Prevention:

<!-- Clear consent before download -->
<p>By clicking download, you accept our terms.</p>
<a href="safe-file.zip" class="btn-download">Download</a>

<!-- Verify file hash -->
SHA256: a3f8e2b9c1d6f4e7a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1

Deceptive Claims (PC04)

Examples:

"Guaranteed weight loss"
"Make $1000/day"
"Cure arthritis"

Fix:

BEFORE: "Guaranteed to work"
AFTER: "May help. Results vary. [Study: 60% users saw improvement]"

BEFORE: "$10,000/month guaranteed"
AFTER: "Average earnings: $500-2000/month. Depends on effort."

BEFORE: "Cure arthritis"
AFTER: "Support joint health. [3rd-party tested]"

Add:

Disclaimers
Realistic expectations
Scientific references
"Results may vary"

High-Priority Fixes

Affiliate Disclosure (PC10) — HIGH

Required: Visible disclosure on any affiliate content

Simple Fix: Add 1 sentence near the top/link

Template:

"As an Amazon Associate, we earn from qualifying purchases."
"We may earn a commission if you purchase through our links."
"Affiliate disclosure: We earn from purchases you make
through our referral links."

Placement:

Option 1: Above content (best visibility)
Option 2: Inline with first affiliate link (acceptable)
Option 3: Bold in footer (minimum requirement)

Code Example:

<div class="affiliate-disclosure">
  <strong>Affiliate Disclosure:</strong> This page contains
  affiliate links. We may earn a commission if you purchase.
</div>

<!-- Content with links -->
<p>We recommend: <a href="amazon-link">Product</a></p>

Compliance:

FTC requirement (USA)
ASA requirement (UK)
DGCCRF requirement (France)
Similar requirements in EU, Canada, Australia

Privacy Policy Update (PC11)

Minimum Required Information:

# Privacy Policy

## 1. Data Collection
- What data we collect (emails, browsing behavior, etc.)
- How we collect it (forms, cookies, analytics)
- Why we collect it (email marketing, analytics, etc.)

## 2. Data Usage
- How we use the data
- Who we share it with (analytics providers, advertisers, etc.)
- Retention period (how long we keep it)

## 3. User Rights
- Right to access their data
- Right to delete their data
- Right to opt-out of marketing
- How to submit data requests

## 4. GDPR Compliance (if applicable)
- Legal basis for processing
- Data Protection Officer contact
- EU data rights

## 5. CCPA Compliance (if California users)
- California resident rights
- Do Not Sell My Personal Information link
- How to submit requests

Implementation:

Use template generator (Termly, Iubenda, etc.)
Add data deletion form
Add unsubscribe mechanism
Make privacy policy easily accessible
Update cookie consent banners

Example Data Deletion Form:

<form method="POST" action="/delete-data">
  <input type="email" placeholder="Your email" required>
  <textarea placeholder="Which data to delete?"></textarea>
  <button type="submit">Request Deletion</button>
  <!-- Response within 30 days (GDPR requirement) -->
</form>

Regulated Content (PC09)

For Gambling Content:

Get explicit gambling license/certification
Use separate AdSense gambling account
Geofence content (illegal in many regions)
Age gate (18+ verification)

For Tobacco Content:

Limited to education/advocacy only
No promotion or sales
Age restriction recommended
Disclaimer required

For Alcohol Content:

Advocacy/education allowed
No direct sales through ads
Age restriction (18-21 depending on country)
Responsible drinking messaging

Medium Priority Fixes

Ad Code Placement (PC13)

Correct Placement:

<head>
  <!-- Option 1: In head (Google recommends) -->
  <script async src="https://pagead2.googlesyndication.com/..."></script>
</head>
<body>
  <!-- or -->
  
  <!-- Option 2: Before closing body -->
  <script async src="https://pagead2.googlesyndication.com/..."></script>
</body>

Incorrect (These cause issues):

<!-- Don't put in comments -->
<!-- <script async src="..."></script> -->

<!-- Don't break the script -->
<script> (broken code) </script async src="...">

<!-- Don't use wrong type -->
<script type="text/html" src="..."></script>

Regulated Content Handling (PC09)

Gambling: Requires special agreement + geofencing Tobacco: Educational content only, no sales Alcohol: Advocacy + age restrictions

Action Plan Template

# Policy Remediation Action Plan

## Critical Issues (Week 1)
- [ ] Remove anti-vaccine content (3 pages)
  - Pages: /health/vaccines, /blog/alternative-medicine
  - Action: 410 Gone status code
  - Timeline: Today
  - Verification: Google Search Console removal request

- [ ] Remove illegal content (1 page)
  - Pages: /downloads/hacking-guide
  - Action: Complete deletion
  - Timeline: Today
  - Verification: Server 404 response

## High Priority Issues (Week 1-2)
- [ ] Add affiliate disclosures (45 posts)
  - Template: "As an Amazon Associate..."
  - Timeline: 4 hours
  - Verification: Manual spot-check

- [ ] Update privacy policy
  - Add data deletion process
  - Add GDPR clauses (if EU visitors)
  - Timeline: 2-3 hours
  - Verification: Privacy policy review

## Medium Priority Issues (Week 2-3)
- [ ] Fix ad code placement
  - Move from footer to head
  - Timeline: 30 min
  - Verification: Code audit

- [ ] Add gambling disclaimer (if applicable)
  - Timeline: 1 hour

Templates & Documents

Affiliate Disclosure Template

"As an Amazon Associate, [Your Company] earns from qualifying purchases."

Privacy Policy Checklist

Data collection explained
Data usage explained
User rights section
Contact information
GDPR/CCPA sections (if applicable)
Cookie consent
Data deletion process

GDPR Compliance (EU Users)

Privacy policy updated with GDPR terms
Lawful basis for processing specified
Data Protection Officer contact (if needed)
Data deletion capability
Consent management system

CCPA Compliance (California Users)

Privacy policy with California rights
"Do Not Sell My Personal Information" link
Data access request capability
Deletion request capability

Success Metrics

No illegal content remaining (verify via crawl)
All affiliate content has visible disclosure
Privacy policy complete and accessible
Data deletion process working
Ad code properly placed
Regulated content properly handled/removed
No policy-related rejections

Verification Checklist

Content Check:

# Search for prohibited keywords
grep -r "anti-vaccine\|miracle cure\|get rich" content/

Affiliate Check:
- Manual spot-check 10 affiliate pages
- Verify disclosure visible and clear
Policy Check:
- Privacy policy accessible from all pages
- Policy is current (updated within 1 year)
- Data deletion process working
Code Check:
- Verify ad code in correct location
- Run HTML validation
- Check console for errors

Related Skills:

Scan results → policy-risk-scanner
Verify fixes → resubmission-readiness-check