Configure Privacy Request Options

The list of available privacy request functions is controlled by the Actions section of the configuration file. Each action references a policy_key that determines the request type. For a full list of available request types, their seeded policy keys, and configuration examples, see Privacy Request Types.

Within the actions section, privacy functions may be defined using the following fields:

Field	Description
`title`	Title for the tile displayed on the site that describes the function being performed.
`description`	A user-friendly description for each privacy request option.
`icon_path`	Specify a URL to a public icon to override the default icon displayed.
`policy_key`	A key that refers to the policy that will be used.
`identity_inputs`	The list of personally identifiable information gathered to perform an action and whether or not it is required.
`custom_privacy_request_fields`	A list of additional metadata that can be provided by the user that is included in the request. Supports text, textarea, single- and multi-select, checkbox, checkbox group, and file upload field types. (See: Custom request fields)
`document_request`	Settings for asking the data subject for documents after they submit a request of this type. See Example: Ask for documents.
`locations`	(API-only) A list of locations where this action should be available. Use "fallback" as a special value to define an action that should be shown when no location-specific actions match.

Example: Access request

This is an example of an Access function that requires the Data Subject to enter their email address and executes the default_access_policy when submitted returning the access package to the specified email address.

"actions": [
    {
    "title": "Access your data",
    "description": "We will email you a report of the data related to your account.",
    "icon_path": "/download.svg",
    "policy_key": "default_access_policy",
    "identity_inputs": {
        "name": "optional",
        "email": "required",
        "phone": "optional"
      }
    }
]

Example: Ask for documents

This access action sends the data subject a secure upload link when the request is received. The upload page accepts up to five PDF, JPG, or PNG files of up to 10 MB each, and offers an authorization form for agents acting for someone else.

"actions": [
    {
    "title": "Access your data",
    "description": "We will email you a report of the data related to your account.",
    "policy_key": "default_access_policy",
    "identity_inputs": {
        "email": "required"
      },
    "document_request": {
        "enabled": true,
        "send_at": "receipt",
        "allowed_file_types": ["pdf", "jpg", "png"],
        "max_size_bytes": 10485760,
        "max_file_count": 5,
        "instructions": "Upload a photo ID. If someone is acting for you, add their signed authorization letter.",
        "form_url": "https://example.com/forms/authorized-agent.pdf",
        "form_label": "Download the authorized agent form"
      }
    }
]

Field	Description
`enabled`	Set to `true` to ask for documents. Defaults to `false`.
`send_at`	When the upload link is sent: `receipt` (the default), `identity_verified`, or `manual`, which leaves sending to your team.
`allowed_file_types`	File extensions the upload page accepts. Defaults to `["jpg", "pdf", "png"]`.
`max_size_bytes`	The largest file the upload page accepts, in bytes. Defaults to `10485760` (10 MB).
`max_file_count`	How many files one upload link accepts, from `1` to `20`. Defaults to `5`.
`instructions`	Text shown on the upload page, up to 2,000 characters.
`form_url`	An `https` link to a form the data subject downloads, fills in, and uploads.
`form_label`	The text of the form link, up to 100 characters. Defaults to "Download the form".

To change the same settings in the Admin UI, see Collect documents.

Location-Based Actions (API-only)

When using API-based configuration, you can specify which actions should be available in different locations. This is useful for providing region-specific privacy request options or complying with different privacy regulations across jurisdictions.

Example: Location-Specific Actions

"actions": [
    {
        "locations": ["us_ca"],
        "policy_key": "default_access_policy",
        "title": "California access policy",
        // other fields...
    },
    {
        "locations": ["us"],
        "policy_key": "default_access_policy",
        "title": "US National access policy",
        // other fields...
    },
    {
        "locations": ["eea"],
        "policy_key": "default_access_policy",
        "title": "Access policy for EEA",
        // other fields...
    },
    {
        "locations": "fallback",
        "policy_key": "default_access_policy",
        "title": "Default access policy",
        // other fields...
    }
]

The location matching is case-insensitive and follows this priority:

Most specific location (e.g., "us_ca" for California)
Country-level location (e.g., "us" for United States)
Regional location (e.g., "eea" for European Economic Area)
Fallback actions for all other locations

For example:

A user in California (us_ca) sees the California access policy because there's a specific action for that state
A user in Utah (us_ut) sees the US National access policy because country-level actions apply when no state-specific action exists
A user in Spain (es) sees the EEA access policy because regional actions apply to countries within that region
A user in Mexico (mx) sees the default access policy because fallback actions apply when no specific location matches

Note: Location-based actions are only available when using API-based configuration. This feature is not supported in file-based configuration.

Note for self-hosted customers: To use location-based actions, your privacy center must be behind Cloudfront to enable geolocation of users. This is required because Cloudfront provides the geolocation information needed to determine which location-specific actions to show to users.

Configuration Consent Options