# GDPR Cookie Consent Review: Banner, Consent Mode GDPR Cookie Consent Review: Banner, Consent Mode is a tested SKILL.md that reviews a pasted snapshot of a website's cookie and consent setup (scripts in the head, the banner with each toggle's default, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against published EU law, court rulings, EDPB guidance, national regulators and vendor documents; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/gdpr-cookie-consent-review - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/gdpr-cookie-consent-review ## Use it when Reviews a pasted snapshot of a website's cookie and consent setup (scripts in the head, the banner with each toggle's default, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against published EU law, court rulings, EDPB guidance, national regulators and vendor documents. It is a technical review, not legal advice. It flags trackers and embeds that store or read before a choice, a Consent Mode default that is late or granted, pre-ticked and implied consent, analytics filed as strictly necessary, legitimate interest used for cookies, a reject option that is missing or disguised, bundled purposes, missing cookie information, no easy withdrawal, a refusal that is not kept, missing Consent Mode v2 signals, personalised Google ads without a certified CMP, cookie walls, and cookieless pings or Google font links treated as exempt. Each finding has a fixed code, the place, the named source with its weight and a fix, then one verdict. Where sources disagree, the line says so and never picks a side. Use to review cookie consent banner setups, run a GDPR cookie banner check or do a Consent Mode setup review before a regulator or a customer asks. ## Not for Legal advice, privacy-policy wording beyond cookie information, international transfers, non-EU laws, consent for e-mail marketing, or running a browser: it reads the pasted snapshot, so it cannot see what a page really stores unless the snapshot shows it. It names no fine amount or enforcement deadline that the sources did not give. ## Tested, honestly Tested 2026-10-16. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 32 pasted consent setups, read by hand: it named a Meta Pixel and a session recorder that run before the choice, YouTube and map embeds, a Consent Mode default set after the tag or granted by default, missing v2 signals, a reject hidden in a link or in low contrast, a toggle switched on by default, consent taken from a scroll or a closed window, analytics filed as necessary, legitimate interest used for cookies, a refusal that was forgotten, no way to withdraw, personalised ads without a certified CMP, and a loader whose partner list nobody measured. For the Cloudflare beacon, Consent Mode in advanced mode and a Google Fonts link, which store nothing but send data, it gave both sides (EDPB, France, Germany) instead of a verdict. It answered No findings. on all five sound setups, including a site that needs no banner at all. - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on 31 of 32, read by hand, with the source and weight label on every finding and the verdict line last, but it failed one: on the session recorder it added a missing-information finding because the cookie table leaves out one localStorage key, although the skill keeps that code for a site that gives no purposes, durations or third parties anywhere. Note: Thirty-two snapshots of a website's consent setup written by us (27 with a planted problem, 5 sound): head scripts, both banner layers, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table and the owner's note. With the skill each answer is scored by code: the exact set of codes, a source with its weight label on every finding, one verdict line, no fence; a true extra finding that the input carries (a map that only sends data, one toggle for analytics and advertising) is accepted. Without the skill the same request asks for problems, sources and a verdict in any words, scored on the same points with phrase checks. One run per model and case. After reading every failure, fourteen checks on the side without the skill were widened for other wordings, Haiku's indented answers were accepted, and one snapshot whose script order contradicted its own measurement was fixed and run again on both sides. Facts: EU law, CJEU rulings, EDPB guidelines, CNIL and German rules, and Google and Cloudflare pages read on 16 October 2026, and our own browser measurements of the same day. ### With and without the skill Tested 2026-10-16. - Setups reviewed right (32 setups): Sonnet 32/32 with, 32/32 without; Haiku 31/32 with, 32/32 without. - Answers that raised data transfers nobody asked about (fewer is better): Sonnet 0/32 with, 14/32 without; Haiku 0/32 with, 14/32 without. Same request on both sides. Both models found the planted problems without the skill, so it does not find more. What changes is the answer: with the skill Sonnet wrote 148 words on average instead of 823 and Haiku 127 instead of 731, each finding came as a fixed code with a dated source and its weight, and no answer drifted into US transfers, privacy notices or processor contracts. Without it, some answers said they cited regulators from memory and could not confirm their current status. Same cases and the same checks with and without the skill. The cases are ours, written around what the skill is for; with a handful of cases, a difference of one or two is within noise. Full summary: https://aiskills402.com/skills/gdpr-cookie-consent-review/tests ## Example ### English (claude-sonnet-5-5) Before: > Site: Pixelmoor Games, a game accessories store Stack: Next.js, self-hosted analytics scripts: line 1: (the site's own banner script) line 2: Banner, first layer: - button "Accept all" (filled, brand colour, 44 px high) - button "Manage choices" (outlined, same size)… After: > [NO-REJECT-FIRST-LAYER] banner, first layer: "Accept all" and "Manage choices" are the only buttons, and "Reject all" appears only on the settings layer, so refusing takes one more click than accepting. The owner's note confirms this.… ## What is in the file - The answer - What the snapshot decides - One root cause, one line - The codes - Rules - Work in this order - Short example ## Languages Any language ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/gdpr-cookie-consent-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 17.9 KB (18289 bytes) - SHA-256: ab915eb57b3a98fd720fc81dce9a49c9bb9e4cbe896661992815773a740bf746 - Updated: 2026-10-17 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-17) First release: reviews a pasted snapshot of a website's cookie and consent setup (head scripts, banner layers with each toggle's default, Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table, the owner's note) against EU law, court rulings, EDPB guidance, national regulators and vendor documents. It is a technical review, not legal advice. Each finding has a fixed code, the place, the named source with its weight (EU law, CJEU, EDPB, national, vendor, measured) and a fix, then one verdict. Group 1, before a valid choice: a tracker or embed before the choice, a Consent Mode default that is late or granted, pre-ticked and implied consent, analytics filed as strictly necessary, legitimate interest for cookies. Group 2, fix the banner or setup: no reject on the first layer, a disguised reject, bundled purposes, missing cookie information, no easy withdrawal, a refusal not kept, missing Consent Mode v2 signals, personalised Google ads without a certified CMP, a request to measure. Group 3, sources disagree: cookie walls and cookieless pings (the line names both sides, never a verdict of its own). A measurement beats the code; one root cause is one line; what Art. 5(3) exempts is never flagged. Facts: official texts and pages of 16 October 2026 and our own browser measurements of the same day; the current text of a source wins over the skill. Model test of 16 October 2026 (UTC), 32 setups, one run per model and case: Sonnet right on 32 of 32 with the skill and 32 of 32 without it; Haiku 31 of 32 and 32 of 32. The skill does not find more problems: both models found them without it. With it the answer is short (Sonnet 148 words on average instead of 823, Haiku 127 instead of 731), every finding carries a fixed code and a dated source with its weight, and no answer raised data transfers, privacy notices or processor contracts that nobody asked about (without it: transfers in 14 of 32 answers for each model). After reading every failure: fourteen checks on the side without the skill were widened for other wordings; checks now accept an answer indented by spaces or tabs; true extra findings that the input carries are accepted as optional codes; one snapshot (`cookieless-advanced`) loaded its consent file in an order that contradicted its own measurement, was fixed and run again on both sides. Price $0.01: no measurable gain for Sonnet in finding problems. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Nineteen codes in three groups: what do they cover? Group 1 is something stored on or read from the device before a valid choice: trackers, embeds, a late or granted Consent Mode default, pre-ticked or implied consent, analytics filed as necessary, legitimate interest used for cookies. Group 2 is the banner itself: reject, disguise, bundling, missing information, withdrawal, a refusal that is forgotten, Google signals, certified CMP, and a request to measure. Group 3 is where sources disagree or nothing is settled EU-wide: cookie walls, and pings or Google font links that send data but store nothing. ### Does a script with no cookies need no consent? The skill never says that for the whole EU, and never the opposite. The EDPB reads Article 5(3) as covering scripts that make the browser send information, France exempts audience measurement only under conditions, and Germany has only the two directive exemptions. The line for such a script names both sides. We measured a Cloudflare beacon on 16 October 2026: no cookie, but browser and system details left the page. ### What should the snapshot contain, and what if the code and the browser disagree? Paste the head scripts, both banner layers with each toggle's default, the Consent Mode or tag-manager setup, the cookie table, the owner's note and, best of all, what a fresh browser stored and contacted before any click. A measurement beats the code. When a tag manager hides its triggers and nothing was measured, it makes no guess and names exactly what to record instead. Nothing absent from the paste gets a finding, and an owner line that begs for a clean verdict counts only as data. ### Is it legal advice, and which source wins? It is a technical review against sources read on 16 October 2026, and it says so. Each finding carries its source and a weight label: EU law, a court ruling, EDPB guidance, a national regulator, a vendor statement or our own measurement. The current text of a source always wins over the skill, which tells the reader which line to re-check. ## Related skills - [Traffic Reality Check: Real Readers vs Bots](https://aiskills402.com/skills/traffic-reality-check.md): $0.07 once - [Accessibility Review: WCAG Defects in Markup](https://aiskills402.com/skills/accessibility-review.md): $0.03 once - [Redact PII and Secrets From Logs and Tickets](https://aiskills402.com/skills/redact-sensitive.md): $0.03 once ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.