Privacy + data residency, GDPR + CCPA for camera footage

Camera footage is personal data under GDPR even if it’s the customer’s own footage. Same for CCPA + CPRA in California. Three layers to wire:

• Cookie + tracker consent banner, Panth_Cookies module or OneTrust / Cookiebot. EU shoppers see GDPR banner; California shoppers see "Do Not Sell My Personal Information" link.
• Retention-period disclosure at PDP, custom product attribute (24h / 7d / 30d / 60d / unlimited cloud retention) rendered as a compliance badge near the price. Required by GDPR Article 13 (right to know how long data is stored).
• Article 30 register exports, admin grid that exports a Records of Processing Activities CSV for the DPO. Includes processor list (cloud-recording vendor, payment processor, email ESP), data categories, retention periods, lawful bases. EU regulators ask for this in audits.

Magento mechanics: store-view-level config handles the EU vs US split. Same Magento instance, same SKU pool; EU store view shows GDPR banner + retention badge + DPO contact; US store view shows CCPA opt-out + simpler footer. No code fork.

Camera SKUs in EU need additional disclosure: where the cloud-recording servers are located (EU vs US). Ring is US-East; Nest is global; Lorex offers EU regions for enterprise. EU shoppers will not buy a US-hosted cam if they read the terms carefully, flag the data-residency answer as a custom product attribute.