<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cookie-consent-compliance
description: >-
  Audit and enforce cookie consent compliance across web properties by
  scanning for cookies set before consent, validating cookie categorization,
  checking banner behavior, and verifying ePrivacy Directive Art. 5(3)
  and GDPR requirements.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - cookies
  - consent
  - eprivacy
  - gdpr
  - cookie-banner
  - audit
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Performing Cookie Consent Compliance

## Overview

Cookie consent compliance requires that non-essential cookies are not set before
user consent (ePrivacy Art. 5(3)), categories are accurately declared, and
rejection is as easy as acceptance. This skill scans web properties for
pre-consent cookies, validates cookie declarations against actual behavior,
and produces compliance audit reports.

Mode: `[MODE: PRIVACY]` — Cookie compliance auditing and enforcement.

## Prerequisites

- Python 3.10+ with `json`, `http.cookiejar` modules
- Target web property URLs for scanning
- Cookie declaration/policy document
- Browser automation capability for consent flow testing

## Key Concepts

### Cookie Categories

| Category | Consent Required | Examples |
|----------|-----------------|----------|
| Strictly Necessary | No | Session ID, CSRF token, load balancer |
| Functional | Yes (EU) | Language preference, UI settings |
| Analytics | Yes | Google Analytics, Hotjar, Mixpanel |
| Advertising | Yes | Facebook Pixel, Google Ads, retargeting |
| Social Media | Yes | Share buttons, embedded content |
| Unclassified | Yes (default) | Unknown or undeclared cookies |

### Common Compliance Violations

```python
COOKIE_VIOLATIONS = {
    "pre_consent_cookie": "Non-essential cookie set before consent obtained",
    "missing_declaration": "Cookie active but not declared in policy",
    "wrong_category": "Cookie in wrong category (analytics as necessary)",
    "no_reject_option": "No equally prominent reject/decline option",
    "pre_checked_boxes": "Cookie category pre-selected (Recital 32 violation)",
    "cookie_wall": "Access denied without cookie consent",
}
```

### Scanning CLI

```bash
# Scan for pre-consent cookies on a URL
node scripts/agent.js --action scan-preconsent \
  --url https://example.com --output /tmp/preconsent.json

# Audit cookie declarations against actual cookies
node scripts/agent.js --action audit-declarations \
  --url https://example.com --declarations /tmp/cookie_policy.json

# Check cookie banner compliance
node scripts/agent.js --action check-banner \
  --url https://example.com --output /tmp/banner_audit.json

# Generate cookie compliance report
node scripts/agent.js --action report \
  --audit /tmp/declaration_audit.json --output /tmp/report.json
```

## Workflow

### Step 1: Scan Pre-Consent Cookies

```bash
node scripts/agent.js --action scan-preconsent --url https://example.com
```

### Step 2: Audit Cookie Declarations

```bash
node scripts/agent.js --action audit-declarations \
  --url https://example.com --declarations /tmp/cookie_policy.json
```

### Step 3: Check Banner Compliance

```bash
node scripts/agent.js --action check-banner --url https://example.com
```

### Step 4: Generate Report

```bash
node scripts/agent.js --action report --audit /tmp/declaration_audit.json
```

## Verification

- [ ] No non-essential cookies set before consent obtained
- [ ] All active cookies declared in cookie policy
- [ ] Cookie categories accurately classified
- [ ] Reject option equally prominent as accept
- [ ] No pre-checked consent boxes
- [ ] Cookie lifetimes match declared retention periods
- [ ] Cookie wall not blocking access to content

## References

- [ePrivacy Directive Art. 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058)
- [Planet49 CJEU Ruling (C-673/17)](https://curia.europa.eu/juris/liste.jsf?num=C-673/17)
- [ICO Cookie Guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/)
- [CNIL Cookie Guidelines](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-amended-guidelines-and-its-recommendation)
