application/legal-page — create and edit privacy request and legal pages for compliance apps

[Jonida]

1. What type are you proposing?
application/legal-page, with create and edit actions.

A legal page is a storefront page whose content exists to meet a privacy, consumer-protection or accessibility law. Examples include data subject request forms (access, deletion, correction), "Do Not Sell or Share" opt-out pages, cookie policies, accessibility statements and right-of-withdrawal pages.

2. What do merchants ask Sidekick to do that needs it?
Real requests we see from merchants on our privacy app (Consentmo):

"Create the missing data request pages for my EU and Brazil customers."
"Add a Do Not Sell or Share page for California."
"My compliance check says privacy request pages are missing. Fix that."
"Update my cookie policy so it lists the trackers we found."
"Publish an accessibility statement for my store."
"Edit the withdrawal page for my German customers."
Today the closest supported type is application/faq. Sidekick then matches these requests against FAQ wording, and the jurisdiction ("for California", "for the EU") has no field to go into.

3. What apps would register intents for it?
Privacy and consent management apps (GDPR / CCPA / LGPD request pages, opt-out pages, cookie policies). We would register it in Consentmo.
Legal policy generator apps (terms, cookie policy, withdrawal pages).
Accessibility apps (accessibility statements).
Region-specific compliance apps (for example EU withdrawal-right and consumer-law apps).
4. What fields does it need?
Draft schema (no required, additionalProperties: true like the existing types):

{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://extensions.shopifycdn.com/shopifycloud/schemas/v1/application/legal-page.json",
"title": "Legal Page Schema",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The legal page ID"
},
"page_type": {
"type": "string",
"description": "Kind of legal page",
"enum": [
"privacy_request",
"opt_out",
"privacy_policy",
"cookie_policy",
"terms_of_service",
"accessibility_statement",
"withdrawal"
]
},
"regulations": {
"type": "array",
"description": "Laws the page covers, for example GDPR, UK GDPR, CCPA, LGPD, PIPEDA, APPI, POPIA",
"items": { "type": "string" }
},
"regions": {
"type": "array",
"description": "Regions the page applies to, for example EU, GB, US-CA, BR",
"items": { "type": "string" }
},
"title": {
"type": "string",
"description": "Page title shown on the storefront"
},
"handle": {
"type": "string",
"description": "Storefront URL handle"
},
"locale": {
"type": "string",
"description": "BCP 47 language tag for the page content"
},
"published": {
"type": "boolean",
"description": "Whether the page is visible on the storefront"
}
},
"additionalProperties": true
}
Example invocation:

intents.invoke("create:application/legal-page", {
data: { page_type: "privacy_request", regulations: ["GDPR", "LGPD"] }
});
The app opens a page that lists what will be created. Nothing is written until the merchant confirms in the app.

5. Anything close in the existing list?

• application/faq: questions and answers, with no legal or jurisdiction meaning. We use it today only as a stand-in.
• application/storefront-page (open RFC): about layout and page builders. Legal pages are different. Their content depends on laws and regions, and the merchant asks for a result such as "make me covered for California", not a design. If that RFC lands, application/legal-page could live next to it, or become a page_type-style extension of it. We're happy to go either way.
• Shopify native policies (refund, privacy, terms, shipping, contact): these don't include request forms, opt-out pages, cookie policies, accessibility statements or withdrawal pages, and apps can't attach their own flows to them.

[charlesdobson]

Hey @Jonida 👋🏼

We're making application/legal-page available, with create and edit. Thanks for the RFC and the real merchant requests behind it. We're landing this alongside application/page, the page builder type from #29.

Some notes:

• Separate from application/page: legal and privacy requests need specialist capabilities that a page builder doesn't have
• Smaller shared schema: besides id, it has surface (storefront or customer-account), title, and plain-text sections, the same shape as application/page will have. For now, page_type, regulations, regions, locale, and published aren't standardized, so add the ones Consentmo needs in your own inputSchema.
• value for edit: pass the existing page's ID as the top-level value, not as a field in inputSchema

It will be available soon! I'll update here when it is.