GDPR Cookie Consent Review: Banner, Consent Mode: test results

Verdicts

Date

2026-10-16

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 32 pasted consent setups, read by hand: it named a Meta Pixel and a session recorder that run before the choice, YouTube and map embeds, a Consent Mode default set after the tag or granted by default, missing v2 signals, a reject hidden in a link or in low contrast, a toggle switched on by default, consent taken from a scroll or a closed window, analytics filed as necessary, legitimate interest used for cookies, a refusal that was forgotten, no way to withdraw, personalised ads without a certified CMP, and a loader whose partner list nobody measured. For the Cloudflare beacon, Consent Mode in advanced mode and a Google Fonts link, which store nothing but send data, it gave both sides (EDPB, France, Germany) instead of a verdict. It answered No findings. on all five sound setups, including a site that needs no banner at all.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on 31 of 32, read by hand, with the source and weight label on every finding and the verdict line last, but it failed one: on the session recorder it added a missing-information finding because the cookie table leaves out one localStorage key, although the skill keeps that code for a site that gives no purposes, durations or third parties anywhere.

With and without the skill

Tested 2026-10-16.

Same request on both sides. Both models found the planted problems without the skill, so it does not find more. What changes is the answer: with the skill Sonnet wrote 148 words on average instead of 823 and Haiku 127 instead of 731, each finding came as a fixed code with a dated source and its weight, and no answer drifted into US transfers, privacy notices or processor contracts. Without it, some answers said they cited regulators from memory and could not confirm their current status.

Same cases and the same checks with and without the skill. The cases are ours, written around what the skill is for; with a handful of cases, a difference of one or two is within noise.

Note

Thirty-two snapshots of a website's consent setup written by us (27 with a planted problem, 5 sound): head scripts, both banner layers, the Consent Mode or tag-manager setup, what a fresh browser stored and contacted before any click, the cookie table and the owner's note. With the skill each answer is scored by code: the exact set of codes, a source with its weight label on every finding, one verdict line, no fence; a true extra finding that the input carries (a map that only sends data, one toggle for analytics and advertising) is accepted. Without the skill the same request asks for problems, sources and a verdict in any words, scored on the same points with phrase checks. One run per model and case. After reading every failure, fourteen checks on the side without the skill were widened for other wordings, Haiku's indented answers were accepted, and one snapshot whose script order contradicted its own measurement was fixed and run again on both sides. Facts: EU law, CJEU rulings, EDPB guidelines, CNIL and German rules, and Google and Cloudflare pages read on 16 October 2026, and our own browser measurements of the same day.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.