<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cookie-consent-compliance
description: >-
  Audit website cookie consent implementations for compliance with the ePrivacy
  Directive, GDPR, CCPA, and CNIL guidelines by scanning cookie behavior,
  consent banners, and pre-consent tracking.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - cookies
  - consent
  - eprivacy
  - gdpr
  - cnil
  - tcf
  - tracking
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Auditing Cookie Consent Compliance

## Overview

Cookie consent compliance requires that non-essential cookies are only set after
obtaining valid user consent (ePrivacy Directive Art. 5(3), GDPR Art. 6(1)(a)).
This skill audits websites for pre-consent cookie dropping, banner compliance,
consent mechanism validity, and proper categorization of cookies as essential
vs. non-essential. Common violations include setting analytics/advertising cookies
before consent, lacking a reject-all option, and using dark patterns.

Mode: `[MODE: PRIVACY]` — Cookie and tracking compliance audit.

## Prerequisites

- Browser developer tools or headless browser (Playwright/Puppeteer)
- Understanding of ePrivacy Directive Art. 5(3) and GDPR consent requirements
- Knowledge of CNIL cookie guidelines and IAB TCF 2.2
- Python 3.10+ for automated scanning

## Key Concepts

### Cookie Categories

| Category | Consent Required | Examples |
|----------|-----------------|----------|
| Strictly Necessary | No | Session, auth, CSRF, load balancer |
| Analytics | Yes | Google Analytics, Matomo, Hotjar |
| Functional | Yes (usually) | Language preference, A/B testing |
| Advertising | Yes | Google Ads, Meta Pixel, retargeting |
| Social Media | Yes | Facebook Like, Twitter embed |

### Common Violations

```text
1. Pre-consent cookies — Analytics/ad cookies set on page load before consent
2. No reject option — Only "Accept" or "Manage preferences" (no "Reject All")
3. Dark patterns — Reject buried in settings, accept prominently displayed
4. Cookie wall — Access blocked entirely without consent (violates freely given)
5. Implied consent — Treating continued browsing as consent
6. Missing information — No cookie policy or incomplete purpose descriptions
7. No withdrawal — No way to revoke previously given consent
8. TCF violations — Vendor processing without valid TCF consent string
```

### Audit CLI

```bash
# Scan cookies set before consent interaction
node scripts/agent.js --action pre-consent \
  --url "https://example.com" --output /tmp/cookie_audit.json

# Audit consent banner compliance
node scripts/agent.js --action banner-audit \
  --url "https://example.com" --output /tmp/banner_audit.json

# Classify all cookies on a site
node scripts/agent.js --action classify \
  --cookies '[{"name":"_ga","domain":".example.com","expiry":63072000}]' \
  --output /tmp/cookie_classification.json

# Full compliance audit
node scripts/agent.js --action full-audit \
  --url "https://example.com" --output /tmp/full_audit.json
```

## Workflow

### Step 1: Capture Pre-Consent Cookies

```bash
node scripts/agent.js --action pre-consent --url "https://example.com"
```

Visit the URL without interacting with the consent banner. Record all cookies set.

### Step 2: Classify Cookies

```bash
node scripts/agent.js --action classify --cookies /tmp/raw_cookies.json
```

### Step 3: Audit Banner UX

Check for: reject-all button, equal prominence, no dark patterns, clear purposes.

### Step 4: Test Consent Enforcement

Accept specific categories, then verify only those category cookies are set.

### Step 5: Generate Compliance Report

```bash
node scripts/agent.js --action full-audit --url "https://example.com"
```

## Verification

- [ ] No non-essential cookies set before consent
- [ ] Reject-all option present with equal prominence to accept
- [ ] Cookie categories clearly explained with purposes
- [ ] Consent withdrawal mechanism accessible
- [ ] Cookie lifetimes proportionate (CNIL: 13 months max for consent cookie)
- [ ] No dark patterns in consent UI
- [ ] TCF consent string valid if using IAB framework
- [ ] Cookie policy complete and up to date

## References

- [ePrivacy Directive Article 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058)
- [CNIL Cookie Guidelines (2020)](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-amended-guidelines-and-recommendation)
- [EDPB Guidelines 05/2020 on Consent](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
- [IAB TCF 2.2](https://iabeurope.eu/transparency-consent-framework/)
- [NOYB Cookie Banner Reports](https://noyb.eu/en/cookie-banners)
