Legal & disclaimer hardening — shipped live across both VietConnect and TradeWithViet
Both sites previously over-claimed and collected personal data without notice. We closed the obvious, verifiable gaps now — legal pages, consent, honest claims — to a defensible template standard for a pre-revenue B2B platform serving EU + US buyers, and clearly separated what is fixed from what still needs a lawyer or a government filing.
StatusLive + verifiedScopeVietConnect app + TWV WPFrameworksVN PDPD · EU GDPR · US CCPADate2026-06-24
ReasoningLập luận
6-layer thinking chainChuỗi tư duy 6 tầng
L1
Raw requestYêu cầu gốc
"rà soát legality và disclaimer mọi thứ trên cả trang tradewithviet và vietconnect để đảm bảo an toàn" — later: "act as legal advisor, do your best", "EU US", "làm A" (TWV cookie consent).
L2
Reframe — what was really neededDiễn giải lại — nhu cầu thật
Not just a report. The real need: an audit AND remediation across two live properties, to a defensible legal standard for a pre-revenue B2B platform targeting EU + US buyers — produced without a lawyer in the loop. So I had to act as advisor: ship the safe, verifiable fixes and loudly flag what only counsel or a filing can do.
L3
ConstraintsRàng buộc
- No lawyer, no registered office address yet, pre-revenue, 0 paying customers.
- TWV is a LIVE public WordPress site — outward-facing, hard to reverse.
- Elementor footer/form data (_elementor_data) cannot be safely edited via WP-CLI — a round-trip probe proved it mangles the JSON; PHP eval is banned by the project safety rules.
- The app's i18n message pipeline was mid-refactor, so legal pages had to be self-contained.
- Hard rule: never ship FALSE compliance (e.g. a cookie banner that doesn't actually block Google Analytics).
L4
Options weighedCác lựa chọn cân nhắc
- Audit-only report — cheap, but leaves every gap live. Rejected.
- Full lawyer-grade rewrite — impossible without a licensed VN lawyer and the entity's filings.
- Report + safe template fixes, every legal doc marked "pending legal review", plus a checklist of the real filings only counsel can do. Chosen.
L5
Principle invokedNguyên tắc áp dụng
Close the obvious, verifiable gaps now; never ship compliance you can't prove works; and keep a hard line between what code can fix and what only a lawyer or a government filing can.
L6
Pick + recognition signalLựa chọn + dấu hiệu nhận biết
Implemented templates across both sites (three legal frameworks), real consent gating that I tested, and corrected false marketing claims — while rejecting a fake consent banner and blind Elementor edits. Recognition signal: when a "compliance" fix can't be verified to actually work, don't ship it — recommend the right tool and flag it instead.
ArchitectureKiến trúc
What changed, where
Two properties, two delivery mechanisms. The app (code we own) got real pages + a consent provider change. The live WordPress site (where editing core templates is risky) got new published pages plus two small drop-in mu-plugins that add behaviour without touching the fragile Elementor footer.
| Technical termThuật ngữ kỹ thuật | Plain nameTên dễ hiểu | RoleVai trò |
|---|---|---|
/legal/{terms,privacy,cookies,supplier-agreement} | Four legal pages | Previously the footer linked to these and all four 404'd. Now real, server-rendered pages covering Vietnam + EU + US law. |
cookie-consent-store.ts + provider | Consent gate | PostHog analytics now starts opted-out; it only turns on after the visitor clicks Accept. |
twv-legal-notices.php (mu-plugin) | Footer links + form note | Adds a site-wide Privacy / Terms bar and a privacy note under every form — without editing the fragile Elementor footer. |
twv-cookie-consent.php (mu-plugin) | Analytics consent | Google Consent Mode v2: Google Analytics is denied storage until the visitor accepts, then granted. |
Read it in 30 seconds: anything in code we control (the app) was fixed directly; anything on the live WordPress site was added as new published pages or as small, removable drop-in plugins so we never risked breaking the existing footer or forms.
Lesson to carry forward: on a live site you don't fully control, prefer additive, reversible drop-ins (a mu-plugin you can delete) over editing core templates in place.
DecisionsQuyết định
Layered decision cardsCác quyết định theo tầng
TWV footer links & form notice — mu-plugin, not Elementor edit
L1Add Privacy/Terms links to the footer and a consent note to the forms.
L2The natural move is to edit the Elementor footer template and the Metform forms directly.
L3A safe round-trip probe (write the same data back through a throwaway key) proved WP-CLI mangles Elementor's _elementor_data JSON; the Elementor-safe method (PHP eval) is banned by our own safety rules.
L4(a) Edit Elementor data via CLI — would corrupt the live footer. (b) Edit by hand in the Elementor UI — manual but fine. (c) Drop a small mu-plugin that injects a site-wide legal bar + form note via WordPress hooks.
L5Additive and reversible beats editing fragile state in place.
L6Chose the mu-plugin (static HTML via wp_footer + widget filter). Rejected the CLI edit (proven to corrupt) and the manual UI route (slower, not reusable). Recognition signal: if a round-trip probe shows the tool mutates the payload, stop — find an additive path.
TWV cookie consent — Consent Mode v2, not a fake banner or a heavy plugin
L1làm A — close the Google Analytics consent gap on TWV.
L2EU visitors were being tracked with no consent. The fix must genuinely stop tracking before consent, not just look like it.
L3GA is injected by Google's Site Kit plugin; its Consent Mode setting was off. A consent-plugin wizard (Complianz) is hard to configure correctly via CLI; a hand-rolled banner that doesn't actually block GA would be false compliance.
L4(a) Fake banner — false comfort. (b) Heavy consent plugin — correct but a wizard I can't fully verify headlessly. (c) A tiny mu-plugin emitting Google Consent Mode v2 default-deny before GA, granting on Accept.
L5Never ship compliance you can't prove; prefer the smallest thing you can fully verify.
L6Chose Consent Mode v2 and proved it with a browser test: 0 GA cookies before Accept, _ga set after, choice remembered on reload. Recognition signal: a consent banner is only real if a fresh-browser test shows no tracking cookies before the click.
Three legal frameworks, not GDPR-only
L1Make the legal docs safe — and EU + US.
L2A Vietnamese company serving EU + US buyers is governed by three regimes at once, not just GDPR.
L3The first draft leaned GDPR-only and omitted Vietnam's own data law — the one that most directly binds the entity.
L4(a) GDPR-only — misses VN + US. (b) Generic 'we respect privacy' — unspecific, weak. (c) Name all three: Vietnam Decree 13/2023 (PDPD), EU GDPR, US CCPA/CPRA, each with its rights and complaint authority.
L5Map the document to the actual law that binds the entity and its users, not just the famous one.
L6Wrote rights, no-sale statements, and complaint paths for all three (A05 in Vietnam, EU supervisory authority, the California CPPA). Recognition signal: jurisdiction follows where the company is AND where the users are — list every applicable regime.
Corrected the 10,000+ verified manufacturers claim
L1Make it safe.
L2Marketing copy claimed 10,000+ verified manufacturers; the real verified count is about 500. A false headline number is an advertising-law risk in VN, the EU, and the US.
L3The number appeared in homepage metadata, social cards, and the RFQ call-to-action, in both English and Vietnamese.
L4(a) Leave it — punchier, but carries legal + trust risk. (b) Soften to vague 'many'. (c) Use the real, conservative figure already used elsewhere on the site: 500+.
L5Honest, substantiable numbers only — every claim must be defensible with evidence.
L6Replaced 10,000+ with 500+ everywhere, and 'audit-backed' with 'multi-signal' (only the top tier gets on-site audits). Recognition signal: any headline number must match what you can prove from the database.
FilesTệp
Artifact mapBản đồ tệp tạo ra
| PathĐường dẫn | WhatLà gì | Who reads itAi dùng |
|---|---|---|
src/app/[locale]/legal/{terms,privacy,cookies,supplier-agreement}/page.tsx | Four legal pages (were 404) | Buyers/suppliers; SEO |
src/components/legal/legal-document.tsx | Shared legal-page shell with pending-review banner | All legal pages |
src/lib/consent/cookie-consent-store.ts + components/consent/cookie-consent.tsx | Cookie consent banner + store | EU/US visitors; PostHog gate |
src/components/shared/verification-disclaimer.tsx | Signal-not-a-guarantee note | Supplier profile, directory, homepage |
src/app/[locale]/layout.tsx + messages/{en,vi}.json | 10,000+ to 500+, audit-backed to multi-signal | All visitors; SEO |
TWV WP page 3 (privacy-policy) + page 8197 (terms-disclaimer) | Published real Privacy + Terms/Disclaimer | tradewithviet.com visitors |
wp-content/mu-plugins/twv-legal-notices.php | Site-wide footer legal bar + form privacy note | TWV all pages |
wp-content/mu-plugins/twv-cookie-consent.php | Google Consent Mode v2 + banner (blocks GA pre-consent) | TWV all pages |
docs/legal/compliance-operations.md | ROPA, cross-border transfer register, DPA tracker, filings checklist | Founder + future lawyer |
Pending manual actions — required before fully liveViệc cần làm thủ công — trước khi hoàn tất
- LAWYER / FILING (P0): Prepare the PDPD cross-border data-transfer impact dossier (Supabase/Stripe/Vercel are offshore) and a processing-impact assessment; keep available for A05.
- LAWYER / FILING (P0): Designate a person/department for personal-data protection and notify A05 (Ministry of Public Security).
- LAWYER (P0): Determine whether VietConnect must register as an e-commerce platform with MOIT (online.gov.vn) and register if so.
- P1: Appoint a GDPR Article 27 EU representative; sign each processor's DPA (Supabase, Stripe, Resend, PostHog, Vercel).
- Provide the registered office address so it can be added to the legal docs (entity name + business registration number are already in).
- Have a licensed Vietnamese lawyer review all legal copy before it is treated as binding (every page is marked pending review).
- Decide whether to git-commit this batch (app changes are verified but not yet committed).
Self-testTự kiểm tra
Check your understanding
Why were TWV footer legal links added via a mu-plugin instead of editing the Elementor footer template?
What makes the TWV cookie-consent fix real rather than cosmetic?
In your own words: why did we add Vietnam's Decree 13/2023 (PDPD) and US CCPA, not just the EU's GDPR?
Mastery checklist — tick what you can explain unpromptedBảng tự đánh giá — tích những gì bạn tự giải thích được