Test for regulatory compliance: GDPR/CMP consent verification, Google Consent Mode v2, Global Privacy Control (GPC), CCPA/US state opt-out, EU AI Act Article 50 transparency, Better Ads Standards, and cookie-inventory auditing. Covers automated consent-flow testing, third-party script blocking befor

<objective A banner can display a rejected state while tracking continues underneath it. This skill tests consent state, policy based request blocking, storage, GPC, Consent Mode signals, and disclosure behavior against the product's approved requirements. It delivers reproducible technical evidence; passing those checks does not establish legal compliance or CMP certification. </objective Discovery Questions First, check for .agents/qa project context.md in the project root — it carries applicable regulations, CMP details, ad networks, and geographic scope. Skip any question already answered there. If it is missing, suggest creating one with the qa project context skill. Applicable regulations Which privacy and platform regulations apply? This sets the entire test matrix. EU: GDPR, ePrivacy Directive (cookies), Digital Services Act (DSA, applied 17 Feb 2024), EU AI Act (prohibitions + AI literacy live since 2 Feb 2025; GPAI obligations + penalties since 2 Aug 2025; Article 50 transparency from 2 Aug 2026 — high risk obligations postponed, see below). US: CCPA/CPRA and the state laws applicable to the audience. Record the specific opt out and universal signal requirements in the regional policy matrix. UK: UK GDPR/DPA, PECR (cookies), Online Safety Act 2023, Data Use and Access Act (DUAA). Other: LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa). What is the legal basis for processing? Consent (opt in), legitimate interest, or contractual necessity — this decides whether explicit consent must precede processing. Is there a DPO or legal team? They define the legal requirements; this skill only validates the technical implementation against them. Consent management What CMP and advertising products are in use? The CMP sets the storage format, API, and integration. Record the current certification and TCF requirements for the specific products and regions; do not infer them from a CMP API response or a numeric policy version comparison. What consent categories exist? Typically Strictly Necessary (always on), Analytics/Performance, Functional/Preferences, Marketing/Targeting. How is consent signaled to third party scripts? IAB TCF v2 ( tcfapi ), a custom data layer, or direct CMP API? Is Google Consent Mode basic or advanced, and what defaults does the regional policy require? Basic blocks tags until consent; advanced can send permitted measurements without cookies while storage consent is denied. This changes the pre consent network assertion. See [Google's implementation guide](https://developers.google.com/tag platform/security/guides/consent). What proves each consent transition has completed? Identify an application/CMP completion signal that includes scheduled tag work. A visible banner or networkidle cannot establish that no delayed tracking will occur. Advertising and accessibility What ad networks and formats? Google Ads, Meta, programmatic; display, video, interstitial. The Coalition for Better Ads defines which formats trigger Chrome ad filtering. Are there accessibility obligations (ADA, EAA, Section 508)? Those are real compliance, but author them in accessibility testing — this skill only maps the legal landscape, see below. Core Principles 1. Make the approved policy the test oracle Record the expected storage, requests, signals, and UI behavior for each region and consent state. Fail deviations from that matrix. A test proves an observed technical result; legal applicability, permitted processing, and visual dark pattern judgments require their own review. 2. Automate the technical checks, schedule the legal audits Automate: policy prohibited cookies and requests, banner functionality, cookie attributes, consent persistence, GPC, and Consent Mode signals. A human still audits privacy policy language, banner prominence, and cross border transfer documentation. Don't pretend a minimum button size assertion settles those questions. 3. Test the unhappy consent states The compliance boundary lives in the "no interaction," "rejected," and "withdrawn" states — that is where violations hide. The "all accepted" state is the least interesting one to test. 4. Verify behavior, not the CMP CMPs have bugs. Don't trust the CMP UI as proof. Assert the actual outcome: were cookies set, did scripts load, was the GPC opt out registered. The CMP is an implementation detail; compliance is measured by behavior. 5. Defense in depth, config driven Verify at multiple layers — CMP config, network requests, cookie state, client signals. Drive tests from a typed inventory and a tracking domain list so adding a category or threshold is a data edit, not a suite rewrite. Regulations change; the suite must be cheap to update. GDPR / CMP Testing with Playwright Consent flow compliance breaks into distinct, independently failing checks. Full runnable code for each is in references/gdpr cmp tests.md . Consent banner and controls — verify first visit visibility, usable accept/reject controls, and the policy link. Minimum dimensions are a mechanical threshold; assess equal prominence and dark patterns separately. Cookie state before/after consent — enforce the approved optional storage policy at completed initialization, acceptance, and rejection. Maintain exact necessary cookie names and the full inventory; a prefix must not exempt similarly named tracking cookies. Consent persistence and withdrawal — verify the actual persisted state after navigation and the new update after withdrawal, then check storage and network effects. Use fresh contexts with storageState: { cookies: [], origins: [] } for first visits. Third party request blocking — attach page.on('request') before navigation; match configured hostnames and endpoints rather than URL substrings. Basic mode can require zero tracking requests; advanced mode needs assertions for the permitted denied state traffic. Include first party proxies and a real completion milestone. Global Privacy Control — verify the HTTP header path and the DOM preference path separately. extraHTTPHeaders: { 'Sec GPC': '1' } does not create navigator.globalPrivacyControl . Explicitly label DOM emulation, check the recorded opt out and policy prohibited behavior, and use a native GPC enabled browser for browser support verification. See the [GPC specification](https://w3c.github.io/gpc/). TCF v2 consent state — use tcfapi('addEventListener', 2, callback) , wait for the relevant completed event, bound failures, and remove the listener. getTCData is deprecated. Assert configured purpose/vendor consents; a policy number does not prove TC string validity, TCF v2.3 freshness, or certification. See the [IAB CMP API](https://github.com/InteractiveAdvertisingBureau/GDPR Transparency and Consent Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20 %20CMP%20API%20v2.md). Google Consent Mode v2 — validate all four signals ( ad storage , analytics storage , ad user data , ad personalization ) against the regional policy and preserve command ordering. Install the observer in every test and checkpoint before each action. Never seed denied defaults in a test of the app's own defaults. The shared adapter observes gtag argument arrays; object events and GTM consent template APIs need their documented adapters. See ../analytics tracking testing/references/consent mode.md for the shared helper and basic/advanced distinction. EU AI Act Compliance The Act applies in phases, and the timeline shifted in 2026. Note: the Digital Omnibus (Nov 2025 proposal; 7 May 2026 provisional agreement) postponed the high risk obligations — do not test against the old 2 Aug 2026 high risk date. Obligation Applies What to test Prohibitions + AI literacy 2 Feb 2025 (live) No Article 5 prohibited practices (social scoring, real time public biometric ID, manipulative AI). Document AI features in scope; gate prohibited libraries. GPAI obligations + penalties 2 Aug 2025 (live) Model cards, training data summaries, copyright policy and disclosure pages exist. Article 50 transparency 2 Aug 2026 AI generated content marked; deepfake disclosure; user told they are interacting with AI. Test the disclosure label/watermark. Still live on this date. Machine readable marking grace 2 Dec 2026 Systems already on the market before 2 Aug 2026 get until here to add the watermark/marking (Omnibus compressed six months to three). High risk (Annex III, use case) 2 Dec 2027 Risk management, data governance, human oversight, transparency UI. Postponed from 2 Aug 2026 by the Omnibus. High risk (Annex I, product regulated) 2 Aug 2028 As above, embedded in regulated products. Postponed from 2 Aug 2027. Write the Article 50 disclosure test now; defer the high risk UI tests until the Annex III obligations land. See references/eu ai act tests.md for the Article 50 transparency disclosure test and the Article 5 prohibited practice (biometric library) gate. For LLM specific evaluation (hallucination, jailbreak resistance, prompt injection), use the ai system testing skill. Better Ads Standards The Coalition for Better Ads defines ad formats that trigger browser level ad filtering (Chrome filters ads on non compliant sites). Format Desktop Mobile Test approach Pop up ads Yes Yes Check for modal/overlay within 5s of load without user action Auto playing video with sound Yes Yes Read the live video.autoplay / video.muted properties (not the HTML attributes) Prestitial countdown ads Yes Yes Check for a countdown timer blocking content Large sticky ads ( 30% viewport) Yes Yes Measure sticky element dimensions vs viewport Ad density 30% No Yes Calculate total ad area vs content area Flashing animated ads No Yes Monitor animation frame rate ( 3 flashes/second) The muted video check must read the live DOM property ( el.muted ), not getAttribute('muted') — player scripts set video.muted = true in JS without ever adding the content attribute, so an attribute only check reports muted ads as having sound and misses muted then unmuted ads. Note: the CBA added two desktop and two mobile ad experiences on 14 Jan 2025; Chrome assessment of those begins no earlier than 14 May 2026. Re check newer combined formats against the current Better Ads Standards page before that date. See references/better ads tests.md for the auto playing video and mobile ad density checks. Cookie Compliance Maintain a typed cookie inventory as the source of truth, then assert that actual cookies match it on three axes: Inventory — a CookieDefinition[] capturing name, category, purpose, max expiry, and the Secure / HttpOnly / SameSite attributes each cookie must carry. Attribute validation — every observed cookie must match its definition's flags and not exceed its declared max expiry. Normalize an unset SameSite to None before comparing — Playwright omits or varies it when the server doesn't set it, so an un normalized check fails spuriously or passes silently. Drift detection — fail the suite ( throw , don't warn) when a cookie appears that is not in the inventory, forcing the inventory to stay current as scripts are added. See references/cookie compliance.md for the typed inventory and both implementations. Accessibility Compliance — legal map only Accessibility is a legal requirement in many jurisdictions, but author the actual tests in accessibility testing (axe core, keyboard, screen reader). This table is only the legal landscape so you know what the obligation is. Region Law Standard Enforcement EU European Accessibility Act (EAA) EN 301 549 / WCAG 2.1 AA Applied 28 June 2025; member state penalties active. WCAG 2.2 alignment expected in the next EN 301 549 revision. USA ADA WCAG

compliance-testing