{
  "$schema": "../schemas/ruleset.schema.json",
  "id": "fallback-gdpr-most-protective",
  "version": "1.0.0",
  "display_name": "Fallback — Most-Protective (XX / unknown country / VPN)",
  "law_references": [
    "Constitution §Governance — most-protective approach",
    "Reg. UE 2016/679 (GDPR) — referenced as the most-protective baseline"
  ],
  "applies_to": {
    "countries": ["XX"]
  },
  "model": "opt-in",
  "native_lang": "en",
  "official_resources_url": [
    "https://edpb.europa.eu/edpb_en"
  ],
  "signals": {
    "tcf_v22": true,
    "gpp": { "enabled": false, "section": null },
    "gpc_honored": true,
    "gpc_required": false,
    "dnt_honored": true,
    "cmv2": {
      "ad_storage": "denied",
      "analytics_storage": "denied",
      "ad_user_data": "denied",
      "ad_personalization": "denied",
      "personalization_storage": "denied",
      "functionality_storage": "denied",
      "security_storage": "granted"
    }
  },
  "ui": {
    "equal_weight_buttons": true,
    "donotsell_link_required": false,
    "sensitive_separate_optin": true,
    "revisit_widget_required": true,
    "default_categories": {
      "necessary": "granted-locked",
      "functional": "denied",
      "analytics": "denied",
      "marketing": "denied",
      "profiling": "denied"
    }
  },
  "cross_border_notes": null,
  "_meta": {
    "behavior_review_date": "2026-05-20",
    "next_review_due": "2027-05-20",
    "notes": "Triggered by: country=XX (Cloudflare unknown/anonymous), geo lookup failure, VPN/proxy detected via ipinfo.io. Strictest possible defaults — every category denied, functional included. The visitor opts back in explicitly via the banner. Constitution Governance §Conflict resolution most-protective approach."
  }
}