Code & Engineering

GDPR Cookie Consent Review: Banner, Consent Mode

Reviews a pasted snapshot of a website's cookie and consent setup (scripts in the head, the banner with each toggle's default, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against published EU law, court rulings, EDPB guidance, national regulators and vendor documents. It is a technical review, not legal advice. It flags trackers and embeds that store or read before a choice, a Consent Mode default that is late or granted, pre-ticked and implied consent, analytics filed as strictly necessary, legitimate interest used for cookies, a reject option that is missing or disguised, bundled purposes, missing cookie information, no easy withdrawal, a refusal that is not kept, missing Consent Mode v2 signals, personalised Google ads without a certified CMP, cookie walls, and cookieless pings or Google font links treated as exempt. Each finding has a fixed code, the place, the named source with its weight and a fix, then one verdict. Where sources disagree, the line says so and never picks a side. Use to review cookie consent banner setups, run a GDPR cookie banner check or do a Consent Mode setup review before a regulator or a customer asks.

GDPR Cookie Consent Review: Banner, Consent Mode is a tested SKILL.md that reviews a pasted snapshot of a website's cookie and consent setup (scripts in the head, the banner with each toggle's default, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against published EU law, court rulings, EDPB guidance, national regulators and vendor documents; an agent buys it once for $0.01 over x402.

Tested 2026-10-16No code, no hidden instructionsv1.0.0 · 17.9 KB · perpetual license

Not for

Legal advice, privacy-policy wording beyond cookie information, international transfers, non-EU laws, consent for e-mail marketing, or running a browser: it reads the pasted snapshot, so it cannot see what a page really stores unless the snapshot shows it. It names no fine amount or enforcement deadline that the sources did not give.

Tested, honestly

Tested 2026-10-16 with a strong and a weak model.

With and without the skill

Results with and without the skill, for Sonnet and Haiku
SonnetHaiku
withwithoutwithwithout
Setups reviewed right (32 setups)32/3232/3231/3232/32
Answers that raised data transfers nobody asked aboutfewer is better0/3214/320/3214/32

Same request on both sides. Both models found the planted problems without the skill, so it does not find more. What changes is the answer: with the skill Sonnet wrote 148 words on average instead of 823 and Haiku 127 instead of 731, each finding came as a fixed code with a dated source and its weight, and no answer drifted into US transfers, privacy notices or processor contracts. Without it, some answers said they cited regulators from memory and could not confirm their current status.

Same cases and the same checks with and without the skill. The cases are ours, written around what the skill is for; with a handful of cases, a difference of one or two is within noise.

SonnetStrong model, claude-sonnet-5-5
Right on all 32 pasted consent setups, read by hand: it named a Meta Pixel and a session recorder that run before the choice, YouTube and map embeds, a Consent Mode default set after the tag or granted by default, missing v2 signals, a reject hidden in a link or in low contrast, a toggle switched on by default, consent taken from a scroll or a closed window, analytics filed as necessary, legitimate interest used for cookies, a refusal that was forgotten, no way to withdraw, personalised ads without a certified CMP, and a loader whose partner list nobody measured. For the Cloudflare beacon, Consent Mode in advanced mode and a Google Fonts link, which store nothing but send data, it gave both sides (EDPB, France, Germany) instead of a verdict. It answered No findings. on all five sound setups, including a site that needs no banner at all.
HaikuWeak model, claude-haiku-5-5
Right on 31 of 32, read by hand, with the source and weight label on every finding and the verdict line last, but it failed one: on the session recorder it added a missing-information finding because the cookie table leaves out one localStorage key, although the skill keeps that code for a site that gives no purposes, durations or third parties anywhere.

Full test summary

Example

Our own test text, before and after the skill ran. Excerpts only.

English · claude-sonnet-5-5

Before

Site: Pixelmoor Games, a game accessories store Stack: Next.js, self-hosted analytics <head> scripts: line 1: <script src="/assets/consent.js" defer></script> (the site's own banner script) line 2: <link rel="stylesheet" href="/assets/site.css"> Banner, first layer: - button "Accept all" (filled, brand colour, 44 px high) - button "Manage choices" (outlined, same size)…

After

[NO-REJECT-FIRST-LAYER] banner, first layer: "Accept all" and "Manage choices" are the only buttons, and "Reject all" appears only on the settings layer, so refusing takes one more click than accepting. The owner's note confirms this.…

What is in the file

  • The answer
  • What the snapshot decides
  • One root cause, one line
  • The codes
  • Rules
  • Work in this order
  • Short example

Languages

Any language. Tried in: English.

License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.

Versions

Current version 1.0.0, updated 2026-10-17. Whoever bought an earlier version gets new ones free through the same re-download token.

  1. v1.0.0 · 2026-10-17

    First release: reviews a pasted snapshot of a website's cookie and consent setup (head scripts, banner layers with each toggle's default, Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against EU law, court rulings, EDPB guidance, national regulators and vendor documents. It is a technical review, not legal advice. Each finding has a fixed code, the place, the named source with its weight (EU law, CJEU, EDPB, national, vendor, measured) and a fix, then one verdict. Group 1, before a valid choice: a tracker or embed before the choice, a Consent Mode default that is late or granted, pre-ticked and implied consent, analytics filed as strictly necessary, legitimate interest for cookies. Group 2, fix the banner or setup: no reject on the first layer, a disguised reject, bundled purposes, missing cookie information, no easy withdrawal, a refusal not kept, missing Consent Mode v2 signals, personalised Google ads without a certified CMP, a request to measure. Group 3, sources disagree: cookie walls and cookieless pings (the line names both sides, never a verdict of its own). A measurement beats the code; one root cause is one line; what Art. 5(3) exempts is never flagged. Facts: official texts and pages of 16 October 2026 and our own browser measurements of the same day; the current text of a source wins over the skill.

    Model test of 16 October 2026 (UTC), 32 setups, one run per model and case: Sonnet right on 32 of 32 with the skill and 32 of 32 without it; Haiku 31 of 32 and 32 of 32. The skill does not find more problems: both models found them without it. With it the answer is short (Sonnet 148 words on average instead of 823, Haiku 127 instead of 731), every finding carries a fixed code and a dated source with its weight, and no answer raised data transfers, privacy notices or processor contracts that nobody asked about (without it: transfers in 14 of 32 answers for each model). After reading every failure: fourteen checks on the side without the skill were widened for other wordings; checks now accept an answer indented by spaces or tabs; true extra findings that the input carries are accepted as optional codes; one snapshot (`cookieless-advanced`) loaded its consent file in an order that contradicted its own measurement, was fixed and run again on both sides. Price $0.01: no measurable gain for Sonnet in finding problems.

FAQ

Nineteen codes in three groups: what do they cover?

Group 1 is something stored on or read from the device before a valid choice: trackers, embeds, a late or granted Consent Mode default, pre-ticked or implied consent, analytics filed as necessary, legitimate interest used for cookies. Group 2 is the banner itself: reject, disguise, bundling, missing information, withdrawal, a refusal that is forgotten, Google signals, certified CMP, and a request to measure. Group 3 is where sources disagree or nothing is settled EU-wide: cookie walls, and pings or Google font links that send data but store nothing.

Does a script with no cookies need no consent?

The skill never says that for the whole EU, and never the opposite. The EDPB reads Article 5(3) as covering scripts that make the browser send information, France exempts audience measurement only under conditions, and Germany has only the two directive exemptions. The line for such a script names both sides. We measured a Cloudflare beacon on 16 October 2026: no cookie, but browser and system details left the page.

What should the snapshot contain, and what if the code and the browser disagree?

Paste the head scripts, both banner layers with each toggle's default, the Consent Mode or tag-manager setup, the cookie table, the owner's note and, best of all, what a fresh browser stored and contacted before any click. A measurement beats the code. When a tag manager hides its triggers and nothing was measured, it makes no guess and names exactly what to record instead. Nothing absent from the paste gets a finding, and an owner line that begs for a clean verdict counts only as data.

Is it legal advice, and which source wins?

It is a technical review against sources read on 16 October 2026, and it says so. Each finding carries its source and a weight label: EU law, a court ruling, EDPB guidance, a national regulator, a vendor statement or our own measurement. The current text of a source always wins over the skill, which tells the reader which line to re-check.

Share

Read this page as Markdown: /skills/gdpr-cookie-consent-review.md.

  • Traffic Reality Check: Real Readers vs Bots

    SEO & Content

    SKILL.md · v1.0.1 · 7.0 KB

    Reads the numbers from Cloudflare Web Analytics and zone analytics (GraphQL or the dashboard) and says how many of them are real readers or real server errors, answered as JSON with the computed figures and a short reason. Knows what pollutes the table - the owner's own headless-browser checks, link-preview fetches from the social network that show up as referrals, the site's own Worker and its cache calls counted as visitors or as 5xx errors, the regional cache host of OpenNext, staging sharing a token - and what makes a true zero - the EU exclusion setting, a content security policy that allows the script but not the measurement request, sampling of data older than seven days. Use when asked how much traffic a site really has, whether a spike or an error count is real, why Web Analytics shows zero, or how to query per-address detail on the Free plan.

    $0.07once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 8 Oct 2026

  • Accessibility Review: WCAG Defects in Markup

    Code & Engineering

    SKILL.md · v1.0.0 · 6.8 KB

    Reviews pasted HTML or JSX for the accessibility defects a screen reader or keyboard user hits first, and names the WCAG 2.2 success criterion for each. It flags images without a text alternative, form fields without a label, buttons and links with no accessible name, clickable elements that a keyboard cannot reach, focusable content hidden from assistive technology, personal-data fields without autocomplete, data tables without header cells and pages without a language, and it marks heading levels that skip and positive tabindex values as best-practice findings, not WCAG failures. Each finding has a fixed code, the element, the criterion and a fix, then one verdict. Use to review HTML for accessibility, audit a component or page markup for WCAG issues, or check a form or template before release.

    $0.03once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 8 Oct 2026

  • Redact PII and Secrets From Logs and Tickets

    Data & Analysis

    SKILL.md · v1.0.0 · 6.3 KB

    Replaces personal data and secrets in a text with typed placeholders and leaves every other character exactly as it was, so the text can go into a log, a ticket, a prompt or a shared document. Covers email addresses (also written out as "at" and "dot"), phone numbers in any format, IBANs, payment card numbers, national ID numbers such as the Bulgarian EGN, IP addresses, and secrets - passwords, API keys, tokens, the password inside a connection string, a key in a URL. Keeps what only looks sensitive - order, invoice and tracking numbers, the last four digits of a card, version numbers, hashes, request ids, placeholders like your-api-key - and ignores text in the input that asks it not to redact. Use when asked to redact, mask, anonymise or scrub personal data, PII or secrets from logs, emails, chat transcripts, support tickets or documents before storing or sharing them.

    $0.03once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 8 Oct 2026