ncklrs/skills/cookie-auditor

Cookie Auditor Skill

Audit web pages for GDPR and CCPA cookie consent compliance.

When to Use

• Verifying GDPR compliance before EU launch
• Checking CCPA compliance for California users
• Pre-deployment privacy compliance checks
• Auditing third-party vendors' consent implementation
• CI/CD compliance gates

Audit Approach

Phase 1: Fresh Session Setup

Start with a clean browser state:

// Via browser_run_code
async (page) => {
  // Clear all cookies
  await page.context().clearCookies();

  // Clear local storage
  await page.evaluate(() => {
    localStorage.clear();
    sessionStorage.clear();
  });

  return 'Session cleared';
}

Phase 2: Pre-Consent Cookie Capture

Before any interaction, record what cookies are set:

async (page) => {
  const cookies = await page.context().cookies();
  return cookies.map(c => ({
    name: c.name,
    domain: c.domain,
    path: c.path,
    expires: c.expires,
    httpOnly: c.httpOnly,
    secure: c.secure,
    sameSite: c.sameSite
  }));
}

Phase 3: Cookie Classification

Classify cookies by purpose:

| Pattern | Category | Essential | |---------|----------|-----------| | session, csrf, auth | Necessary | Yes | | _ga, _gid, analytics | Analytics | No | | _fbp, _gcl, ads | Marketing | No | | prefs, theme, lang | Personalization | No |

Phase 4: Banner Detection

Look for cookie consent elements:

// Common selectors for cookie banners
const bannerSelectors = [
  '[class*="cookie"]',
  '[id*="cookie"]',
  '[class*="consent"]',
  '[id*="consent"]',
  '[class*="gdpr"]',
  '[class*="privacy-banner"]',
  '[aria-label*="cookie"]',
  '[role="dialog"][class*="modal"]'
];

Phase 5: Consent Mechanism Analysis

Check consent UI for compliance:

Accept Button Detection:

const acceptSelectors = [
  'button:has-text("Accept")',
  'button:has-text("Allow")',
  'button:has-text("Agree")',
  'button:has-text("OK")',
  '[class*="accept"]'
];

Reject Button Detection:

const rejectSelectors = [
  'button:has-text("Reject")',
  'button:has-text("Decline")',
  'button:has-text("Deny")',
  'a:has-text("Reject")',
  '[class*="reject"]',
  '[class*="decline"]'
];

Preference Detection:

const preferenceSelectors = [
  'button:has-text("Settings")',
  'button:has-text("Preferences")',
  'button:has-text("Manage")',
  'button:has-text("Customize")'
];

GDPR Criteria Reference

Load criteria from criteria.json:

| ID | Criterion | Severity | Check Method | |----|-----------|----------|--------------| | GDPR-1 | Banner before cookies | Critical | Pre-consent cookie check | | GDPR-2 | No pre-checked boxes | Critical | Checkbox state analysis | | GDPR-3 | Reject option prominent | Major | Button comparison | | GDPR-4 | Granular consent | Major | Category options check | | GDPR-5 | Withdrawal mechanism | Major | Settings accessibility | | GDPR-6 | Cookie policy link | Minor | Link presence check |

CCPA Criteria Reference

| ID | Criterion | Severity | Check Method | |----|-----------|----------|--------------| | CCPA-1 | Do Not Sell link | Critical | Footer link search | | CCPA-2 | Opt-out mechanism | Critical | Functional test | | CCPA-3 | Privacy policy | Major | Link presence check | | CCPA-4 | Rights disclosure | Minor | Content analysis |

Detection Methods

Pre-Checked Box Detection

async (page) => {
  const checkboxes = await page.$$('input[type="checkbox"]');
  const preChecked = [];

  for (const checkbox of checkboxes) {
    const isChecked = await checkbox.isChecked();
    const label = await checkbox.evaluate(el => {
      const label = el.closest('label') ||
                    document.querySelector(`label[for="${el.id}"]`);
      return label?.textContent || '';
    });

    if (isChecked && !isNecessary(label)) {
      preChecked.push({ label, checked: true });
    }
  }

  return preChecked;
}

Button Prominence Comparison

async (page) => {
  const accept = await page.$('button:has-text("Accept")');
  const reject = await page.$('button:has-text("Reject")');

  if (!accept || !reject) return { prominent: false, reason: 'Missing button' };

  const acceptBox = await accept.boundingBox();
  const rejectBox = await reject.boundingBox();

  // Compare sizes
  const acceptArea = acceptBox.width * acceptBox.height;
  const rejectArea = rejectBox.width * rejectBox.height;

  // Reject should be at least 50% the size of accept
  return {
    prominent: rejectArea >= acceptArea * 0.5,
    acceptSize: acceptArea,
    rejectSize: rejectArea
  };
}

CCPA Link Detection

async (page) => {
  const ccpaPatterns = [
    'Do Not Sell',
    'Do Not Share',
    'Opt-Out',
    'Your Privacy Choices',
    'Your California Privacy Rights'
  ];

  for (const pattern of ccpaPatterns) {
    const link = await page.$(`a:has-text("${pattern}")`);
    if (link) {
      return { found: true, text: pattern };
    }
  }

  return { found: false };
}

Scoring

function calculateScore(results) {
  const weights = {
    critical: 3,
    major: 2,
    minor: 1
  };

  let maxScore = 0;
  let actualScore = 0;

  for (const result of results) {
    const weight = weights[result.severity];
    maxScore += weight;
    if (result.status === 'pass') {
      actualScore += weight;
    }
  }

  const percentage = Math.round((actualScore / maxScore) * 100);
  const grade =
    percentage >= 90 ? 'A' :
    percentage >= 80 ? 'B' :
    percentage >= 70 ? 'C' :
    percentage >= 60 ? 'D' : 'F';

  return { percentage, grade };
}

Report Generation

Issue Format

### FAIL: [ID] - [Title]
- **Severity**: [Critical/Major/Minor]
- **Finding**: [What was observed]
- **Location**: [Where on the page]
- **Fix**: [Remediation guidance]

Pass Format

### PASS: [ID] - [Title]
- **Finding**: [What was observed that indicates compliance]

Common Violations

1. Analytics Before Consent

Pattern: Google Analytics (_ga, _gid) cookies set on page load Detection: Check cookies before any user interaction Fix: Defer analytics until after consent

2. Pre-Checked Marketing

Pattern: "Marketing cookies" checkbox checked by default Detection: Inspect checkbox state in banner Fix: Default all non-essential to unchecked

3. Hidden Reject Option

Pattern: "Reject" is a small link, "Accept" is a large button Detection: Compare element sizes Fix: Make both options equally prominent

4. Missing CCPA Link

Pattern: No "Do Not Sell" link on California-targeted site Detection: Search footer/privacy areas Fix: Add compliant opt-out link

Best Practices

1. Test Fresh Sessions: Always clear cookies before audit
2. Geo-Simulation: Some banners only show to EU/CA visitors
3. Mobile Check: Banner behavior may differ on mobile
4. Deep Pages: Check if consent persists across navigation
5. Screenshots: Document violations with annotated screenshots

Limitations

1. Geo-Targeting: Banner may not appear without EU/CA IP
2. A/B Tests: Different users may see different consent UIs
3. Dynamic Loading: Some consent tools load asynchronously
4. Third-Party Tools: Complex consent managers may need special handling
5. Legal Interpretation: This tool checks technical compliance, not legal advice