AI-Enhanced Compliance Report

https://www.theguardian.com · CMP: Sourcepoint 🤖 AI analysis active

After Reject All (post-rejection state)

5 FAIL 31 PASS 2 MANUAL

Consent State Screenshots — assessed by AI for K.1/K.2/K.3

Layer 1 — Initial banner (before interaction)

Layer 2 — After Accept All (consent baseline)

After Reject All (post-rejection state)

AI Executive Summary

Overall Risk: HIGH

The Guardian's website presents significant GDPR and ePrivacy compliance risks through multiple violations including dark pattern rejection buttons, continued tracking post-rejection, and undisclosed cookies. The site appears to operate a consent-or-pay model with 'Reject all and subscribe' messaging, but this implementation creates deceptive UX patterns that violate consent requirements. Post-rejection tracking through 8 non-essential cookies and active Google Tag Manager globals demonstrates clear ePrivacy violations. Incomplete cookie policy disclosures compound transparency failures under GDPR Article 13.

Remediation Roadmap

Eliminate all post-rejection tracking by preventing 8 non-essential cookies and disabling Google Tag Manager globals immediately upon rejection (high) — Resolves fundamental ePrivacy violations and prevents ongoing unlawful processing post-rejection
Redesign consent banner with simple 'Reject all' button text removing subscription messaging to ensure equal prominence (low) — Eliminates dark patterns and ensures CNIL-compliant symmetrical consent interface
Implement clear separation between cookie consent and subscription options through distinct user flows (medium) — Ensures consent-or-pay model complies with Orange România unbundling requirements
Conduct comprehensive cookie audit and update privacy policy to include all 31 undisclosed cookies (medium) — Achieves GDPR Article 13 transparency compliance and eliminates disclosure gaps
Implement automated cookie policy synchronization system to prevent future disclosure mismatches (high) — Ensures ongoing transparency compliance and reduces manual compliance burden

Detailed Findings

🤖 = AI-assessed · 👁 = Vision (screenshot) · HIGH MEDIUM LOW = risk level from legal analysis

B. Pre-Consent State 0 FAIL 5 PASS 0 MANUAL

B.1 No tracking requests before consent banner interaction

✓ PASS

No consent-required domains observed before the consent signal.

B.2 No analytics/marketing cookies in Storage pre-consent

✓ PASS

No advertising cookies found in Storage before consent.

B.3 JS tracker globals return undefined pre-consent

✓ PASS

All probed tracker globals are undefined pre-consent.

B.4 No tracking identifiers in localStorage/sessionStorage pre-consent

✓ PASS

No tracking keys found in web storage pre-consent.

B.5 Non-essential scripts have type=text/plain (CMP-blocked) in DOM

✓ PASS

All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.

C. Baseline Capture 0 FAIL 0 PASS 0 MANUAL

C.2 Inventory of third-party tracking domains active after Accept All

ℹ INFO

41 tracking domains active after consent-all (baseline).

▶ Show all 41 rows

domain	vendor	category	first_seen	example_url
pixel.adsafeprotected.com	IAS Pixel	MEASUREMENT	2026-03-31T19:40:44	https://pixel.adsafeprotected.com/services/pub?anId=10249&slot=%7Bid:dfp-ad--top-above-nav,ss:%5B1.1,2.2,728.90,940.230,
cm.g.doubleclick.net	Google DoubleClick	ADVERTISING	2026-03-31T19:40:44	https://cm.g.doubleclick.net/partnerpixels?gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRAA
ads.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:44	https://ads.pubmatic.com/AdServer/js/google-esp.js
tags.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:44	https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
cdn.id5-sync.com	ID5 (universal ID)	IDENTITY	2026-03-31T19:40:44	https://cdn.id5-sync.com/api/1.0/esp.js
id5-sync.com	ID5 (universal ID)	IDENTITY	2026-03-31T19:40:44	https://id5-sync.com/api/esp/increment?counter=no-config
api.id5-sync.com	ID5	IDENTITY	2026-03-31T19:40:44	https://api.id5-sync.com/analytics/182/id5-api-js
oajs.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:44	https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.theguardian.com%2Feurope&rid=esp
bcp.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:44	https://bcp.crwdcntrl.net/6/map?xcid=16589
ib.adnxs.com	Xandr AppNexus	ADVERTISING	2026-03-31T19:40:44	https://ib.adnxs.com/getuidj?gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRAA4gQABgA
fastlane.rubiconproject.com	Magnite	ADVERTISING	2026-03-31T19:40:45	https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=26644&site_id=549496&zone_id=3426828&size_id=2&alt_si
rtb.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://rtb.openx.net/openrtbb/prebidjs
elb.the-ozone-project.com	Ozone Project	IDENTITY	2026-03-31T19:40:45	https://elb.the-ozone-project.com/openrtb2/auction
htlb.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://htlb.casalemedia.com/openrtb/pbjs?s=208283
pagead2.googlesyndication.com	Google AdSense/GAM	ADVERTISING	2026-03-31T19:40:45	https://pagead2.googlesyndication.com/pagead/ping?e=1
google-bidout-d.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://google-bidout-d.openx.net/w/1.0/pd?plm=5
image6.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:45	https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=5&p=156578&publisherId=156578&src=esp_google&ver=1&coppa=0&gdpr_c
pubads.g.doubleclick.net	Google DoubleClick	ADVERTISING	2026-03-31T19:40:45	https://pubads.g.doubleclick.net/activity;dc_iu=/59666047/DFPAudiencePixel;ord=1;dc_seg=895181798;permutive=23527?
hbopenbid.pubmatic.com	PubMatic OpenBid	ADVERTISING	2026-03-31T19:40:45	https://hbopenbid.pubmatic.com/translator?source=prebid-client&gzip=1
pixel.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:45	https://pixel.rubiconproject.com/exchange/sync.php?p=a9eu&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAK
ssum-sec.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fecm3%3Fex%3Dindex.
ssbsync.smartadserver.com	Smart (Equativ)	ADVERTISING	2026-03-31T19:40:45	https://ssbsync.smartadserver.com/api/sync?callerId=2&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1Y
dsum-sec.casalemedia.com	Index Exchange	ADVERTISING	2026-03-31T19:40:45	https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dca
secure.adnxs.com	Xandr (AppNexus)	ADVERTISING	2026-03-31T19:40:45	https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
us-u.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:45	https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=1&gdpr_consent=CQh7pEAQh7pE
sync.ipredictive.com	iPromote	ADVERTISING	2026-03-31T19:40:45	https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=1&gd
ep1.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-03-31T19:40:45	https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202603250101&st=env&sjk=6411510798165893
securepubads.g.doubleclick.net	Google Publisher Ads	ADVERTISING	2026-03-31T19:40:45	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6411510798165893&correlator=3748217310167902&eid=31097431%2C3109
df2f4d698ae010735b53fbcbb2e00cc1.safeframe.googlesyndication.com	Google SafeFrame (viewability)	MEASUREMENT	2026-03-31T19:40:45	https://df2f4d698ae010735b53fbcbb2e00cc1.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
sync.crwdcntrl.net	Lotame	IDENTITY	2026-03-31T19:40:45	https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=5f51420a-6b1b-4c94-993a-12f84b808716-69cc233d-4e4c&gdpr=1&gdpr_conse
cms.quantserve.com	Quantcast Measure	ANALYTICS	2026-03-31T19:40:45	https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgA
c1.adform.net	Adform	ADVERTISING	2026-03-31T19:40:45	https://c1.adform.net/serving/cookie/match?party=1301&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USC
ep2.adtrafficquality.google	Google SODAR/IVT	ADVERTISING	2026-03-31T19:40:46	https://ep2.adtrafficquality.google/sodar/sodar2.js
secure-assets.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
eus.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://eus.rubiconproject.com/usync.html?p=gumgum
simage2.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:46	https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=1&gdpr_consent=CQh7pEAQh7p
image2.pubmatic.com	PubMatic	ADVERTISING	2026-03-31T19:40:46	https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=1&gdpr_consent=CQh7pEAQh7pE
eu-u.openx.net	OpenX	ADVERTISING	2026-03-31T19:40:46	https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1514120448363740908
track.adform.net	Adform Tracking	ADVERTISING	2026-03-31T19:40:46	https://track.adform.net/serving/cookie/match/?party=1008&gdpr=1&gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C
token.rubiconproject.com	Magnite (Rubicon)	ADVERTISING	2026-03-31T19:40:46	https://token.rubiconproject.com/khaos.json?gdpr_consent=CQh7pEAQh7pEABwABCENCYFgAP_gAEPgABpYKoNB5C4USCFAKCJ1YJsgIAQXwRA
tpc.googlesyndication.com	Google AdSense	ADVERTISING	2026-03-31T19:40:46	https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

C.3 Full cookie inventory (with expiry, HttpOnly, Secure, SameSite) after Accept All

ℹ INFO

34 cookies in storage after Accept All (full metadata).

▶ Show all 34 rows

name	domain	expires_days	http_only	secure	same_site	classification
GU_mvt_id	.theguardian.com	90.0	False	True	Lax	UNKNOWN
gu_client_ab_tests	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
gu_v2_mvt_id	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
GU_geo_country	www.theguardian.com	session	False	True	Lax	UNKNOWN
bwid	.theguardian.com	365.0	False	True	None	UNKNOWN
bwid_withoutSameSiteForIncompatibleClients	.theguardian.com	365.0	True	True	Lax	UNKNOWN
consentUUID	.theguardian.com	365.0	False	True	None	ESSENTIAL
consentDate	.theguardian.com	365.0	False	True	None	ESSENTIAL
_pubcid	.theguardian.com	270.0	False	False	Lax	UNKNOWN
_pubcid_cst	.theguardian.com	365.0	False	False	Lax	UNKNOWN
id5	.id5-sync.com	90.0	False	True	None	UNKNOWN
test_cookie	.doubleclick.net	0.0	False	True	None	UNKNOWN
_scor_uid	.theguardian.com	390.0	False	True	None	UNKNOWN
UID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
XID	.scorecardresearch.com	390.0	False	True	None	UNKNOWN
permutive-id	.theguardian.com	184.0	False	True	None	UNKNOWN
uid	.criteo.com	390.0	False	True	None	UNKNOWN
lotame_domain_check	.theguardian.com	0.0	False	False	Lax	UNKNOWN
A3	.yahoo.com	365.2	True	True	None	UNKNOWN
connectId	.theguardian.com	365.0	False	True	None	UNKNOWN
i	.openx.net	365.0	False	True	None	UNKNOWN
cto_bundle	.criteo.com	390.0	False	True	None	UNKNOWN
_cc_dc	.crwdcntrl.net	270.0	False	True	None	UNKNOWN
_cc_id	.crwdcntrl.net	270.0	False	True	None	UNKNOWN
pxid	.d6691a17-6fdb-4d26-85d6-b3dd27f55f08.prmutv.co	91.0	True	True	None	UNKNOWN
_cc_id	.theguardian.com	270.0	False	False	Lax	UNKNOWN
panoramaId_expiry	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaId	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaIdType	.theguardian.com	7.0	False	False	Lax	UNKNOWN
khaos	.rubiconproject.com	365.0	False	True	None	UNKNOWN
audit	.rubiconproject.com	365.0	False	True	None	UNKNOWN
cto_bundle	.theguardian.com	390.0	False	False	Lax	UNKNOWN
ad-id	.amazon-adsystem.com	184.0	True	True	None	UNKNOWN
receive-cookie-deprecation	.casalemedia.com	365.0	True	True	None	AD

C.4 Tracker JS globals active after Accept All (baseline)

ℹ INFO

Globals defined after consent: []

D. Decline Non-Essential Consent 0 FAIL 1 PASS 0 MANUAL

D.4 Reject requires no more clicks than Accept (EDPB symmetry)

✓ PASS

Accept and Reject both require 1 click(s). Symmetric.

accept_clicks	reject_clicks	extra_clicks_to_reject	reject_required_manage_panel
1	1	0	False

E. Network Request Verification 0 FAIL 4 PASS 0 MANUAL

E.1 No requests to non-essential third-party domains after reject-all

✓ PASS

No tracking domains observed post-reject.

E.2 No tracker JS libraries loaded after reject-all

✓ PASS

No tracker scripts observed post-reject.

E.3 No tracking pixels or beacons fired after reject-all

✓ PASS

No tracking beacons observed post-reject.

E.4 No tracking activity on subpages after reject-all

✓ PASS

No tracker globals or tracking storage observed on 2 subpage(s).

F. Cookie Verification (Third-Party) 0 FAIL 2 PASS 0 MANUAL

F.1 No analytics/marketing cookies present after reject-all

⚠ PARTIAL

No advertising cookies seen in request headers post-reject. Verify Storage tab with Component 2 for full confirmation.

F.2 document.cookie contains only essential cookies post-reject

✓ PASS

No advertising cookies visible in document.cookie post-reject.

doc_cookie_snippet
GU_mvt_id=173575; bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; consentUUID=5fef39e5-de08-4cf3-8c8e-654f8e422ba0; GU_geo_country=NL; GU_country=NL

F.3 No tracking identifiers in web storage post-reject

✓ PASS

No tracking identifiers found in localStorage/sessionStorage post-reject.

G. First-Party Cookie Classification 2 FAIL 6 PASS 0 MANUAL

G.1 Complete first-party cookie inventory with full metadata

ℹ INFO

19 first-party cookies in Storage after Accept All.

▶ Show all 19 rows

name	domain	expires_days	http_only	secure	same_site	classification
GU_mvt_id	.theguardian.com	90.0	False	True	Lax	UNKNOWN
gu_client_ab_tests	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
gu_v2_mvt_id	www.theguardian.com	30.0	False	False	Lax	UNKNOWN
GU_geo_country	www.theguardian.com	session	False	True	Lax	UNKNOWN
bwid	.theguardian.com	365.0	False	True	None	UNKNOWN
bwid_withoutSameSiteForIncompatibleClients	.theguardian.com	365.0	True	True	Lax	UNKNOWN
consentUUID	.theguardian.com	365.0	False	True	None	ESSENTIAL
consentDate	.theguardian.com	365.0	False	True	None	ESSENTIAL
_pubcid	.theguardian.com	270.0	False	False	Lax	UNKNOWN
_pubcid_cst	.theguardian.com	365.0	False	False	Lax	UNKNOWN
_scor_uid	.theguardian.com	390.0	False	True	None	UNKNOWN
permutive-id	.theguardian.com	184.0	False	True	None	UNKNOWN
lotame_domain_check	.theguardian.com	0.0	False	False	Lax	UNKNOWN
connectId	.theguardian.com	365.0	False	True	None	UNKNOWN
_cc_id	.theguardian.com	270.0	False	False	Lax	UNKNOWN
panoramaId_expiry	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaId	.theguardian.com	7.0	False	False	Lax	UNKNOWN
panoramaIdType	.theguardian.com	7.0	False	False	Lax	UNKNOWN
cto_bundle	.theguardian.com	390.0	False	False	Lax	UNKNOWN

G.2 MEDIUM All observed cookies declared in cookie policy

✗ FAIL

31 cookie(s) observed but not found in cookie policy at https://www.theguardian.com/privacy.

▶ Show all 30 rows

cookie_name	status
panoramaIdType	observed but not in cookie policy
receive-cookie-deprecation	observed but not in cookie policy
GU_geo_country	observed but not in cookie policy
_cc_dc	observed but not in cookie policy
khaos	observed but not in cookie policy
gu_client_ab_tests	observed but not in cookie policy
bwid_withoutSameSiteForIncompatibleClients	observed but not in cookie policy
cto_bundle	observed but not in cookie policy
UID	observed but not in cookie policy
i	observed but not in cookie policy
pxid	observed but not in cookie policy
GU_mvt_id	observed but not in cookie policy
_cc_id	observed but not in cookie policy
uid	observed but not in cookie policy
panoramaId_expiry	observed but not in cookie policy
permutive-id	observed but not in cookie policy
_scor_uid	observed but not in cookie policy
_pubcid_cst	observed but not in cookie policy
test_cookie	observed but not in cookie policy
lotame_domain_check	observed but not in cookie policy
XID	observed but not in cookie policy
bwid	observed but not in cookie policy
ad-id	observed but not in cookie policy
_pubcid	observed but not in cookie policy
GU_country	observed but not in cookie policy
gu_v2_mvt_id	observed but not in cookie policy
A3	observed but not in cookie policy
GU_support_csrf	observed but not in cookie policy
connectId	observed but not in cookie policy
audit	observed but not in cookie policy

Regulatory basis: GDPR Art. 13 · GDPR Art. 5(1)(a)
Precedent: GDPR Article 13 requires comprehensive information provision about all processing activities, with EDPB Guidelines 05/2020 confirming that incomplete cookie disclosures violate transparency obligations.

Recommendation: Update cookie policy at https://www.theguardian.com/privacy to include all 31 undisclosed cookies and implement automated policy synchronization with deployed cookies.

G.3 Strictly necessary two-part test (AI-assisted)

✓ PASS

AI analysis: 0 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary:

G.4 Server-side analytics/ad cookies identified in Set-Cookie headers

✓ PASS

No advertising cookies observed in Set-Cookie response headers.

G.5 No CNAME cloaking detected (first-party subdomains resolving to tracker infrastructure)

✓ PASS

No CNAME cloaking detected across 4 subdomain(s).

subdomain	cname_target	is_tracker	vendor	error
ophan.theguardian.com	(no CNAME / A record only)	False	None	None
sourcepoint.theguardian.com	(no CNAME / A record only)	False	None	None
support.theguardian.com	(no CNAME / A record only)	False	None	None
static.theguardian.com	(no CNAME / A record only)	False	None	None

G.6 Non-essential first-party cookies absent after reject-all

✓ PASS

All advertising cookies absent from Storage post-reject.

G.7 HIGH No non-essential Set-Cookie headers after reject-all

✗ FAIL

8 Set-Cookie header(s) for non-essential cookies observed post-reject.

cookie_name	domain	header	classification	timestamp
GU_mvt_id	www.theguardian.com	GU_mvt_id=173575; expires=Mon, 29 Jun 2026 19:41:03 GMT; path=/; domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:03
gu_client_ab_tests	www.theguardian.com	gu_client_ab_tests=growth-auxia-banner:control; path=/; max-age=2592000	UNKNOWN	2026-03-31T19:41:03
gu_v2_mvt_id	www.theguardian.com	gu_v2_mvt_id=348; path=/; max-age=2592000	UNKNOWN	2026-03-31T19:41:03
GU_geo_country	www.theguardian.com	GU_geo_country=NL; path=/; Secure	UNKNOWN	2026-03-31T19:41:03
bwid	ophan.theguardian.com	bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:04 GMT; SameSite=None; Path=/; Domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:04
bwid_withoutSameSiteForIncompatibleClients	ophan.theguardian.com	bwid_withoutSameSiteForIncompatibleClients=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:04 GMT; Path=/; Domain=.t	UNKNOWN	2026-03-31T19:41:04
bwid	ophan.theguardian.com	bwid=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:07 GMT; SameSite=None; Path=/; Domain=.theguardian.com; Secure	UNKNOWN	2026-03-31T19:41:07
bwid_withoutSameSiteForIncompatibleClients	ophan.theguardian.com	bwid_withoutSameSiteForIncompatibleClients=idFromPV_RRRliJR17YwySLr-gCLFaA; Max-Age=31536000; Expires=Wed, 31 Mar 2027 19:41:07 GMT; Path=/; Domain=.t	UNKNOWN	2026-03-31T19:41:07

Regulatory basis: ePrivacy Directive Art. 5(3) · GDPR Art. 7(3)
Precedent: EDPB Guidelines 2/2023 confirm that analytics and advertising cookies require consent regardless of first/third-party status, with no exemptions for post-rejection deployment.

Recommendation: Immediately cease all non-essential cookie deployment upon rejection and implement technical measures to prevent 8 identified post-rejection cookies from being set.

G.8 Cookie lifetime analysis (ITP bypass detection)

✓ PASS

No obvious ITP bypass patterns in Set-Cookie headers.

G.9 No tracking keys in first-party localStorage/sessionStorage post-reject

✓ PASS

No tracking identifiers found in first-party web storage post-reject.

H. JS Global Object Verification 1 FAIL 1 PASS 0 MANUAL

H.1 MEDIUM Tracker JS globals (ga, gtag, fbq, hj, etc.) return undefined post-reject

✗ FAIL

Tracker globals still defined after reject-all: ['google_tag_manager']

global	type
google_tag_manager	__defined_object__

Regulatory basis: ePrivacy Directive Art. 5(3) · GDPR Art. 25
Precedent: GDPR Article 25 mandates data protection by design with non-processing as the default state, requiring active prevention of tracking mechanisms post-rejection.

Recommendation: Disable Google Tag Manager initialization and ensure all tracking globals return undefined post-rejection to comply with data protection by design requirements.

H.2 Tracker globals not merely defined without values

ℹ INFO

See H.1 — same evidence applies.

global	present
google_tag_manager	True

H.3 window.dataLayer absent or contains no tracking events post-reject

✓ PASS

dataLayer not present post-reject.

I. DOM / Source Inspection 0 FAIL 3 PASS 0 MANUAL

I.1 Tracker script tags have type=text/plain (CMP-blocked) in DOM post-reject

✓ PASS

All 0 tracker scripts correctly blocked in DOM post-reject.

I.2 Non-essential scripts blocked (type=text/plain)

✓ PASS

See I.1 — same check.

I.3 No tracker JS files in executed sources post-reject

✓ PASS

Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).

J. Safari-Specific Considerations 0 FAIL 1 PASS 2 MANUAL

J.1 ITP setting

☐ MANUAL

Requires manual browser configuration check.

J.2 ITP-off re-test

☐ MANUAL

Requires manual browser configuration check.

J.3 Server-side cookie-setting identified where ITP would block client-side

✓ PASS

No obvious ITP-bypass server-side cookies detected.

K. Consent Mechanism UX Compliance 1 FAIL 3 PASS 0 MANUAL

K.1 Reject All at same prominence and level as Accept All

✓ PASS

Reject All available at first screen at same level as Accept All.

accept_visible_at_first_screen	reject_visible_at_first_screen	reject_requires_extra_layer	accept_button_text	reject_button_text
True	True	False	Accept all	Reject all and subscribe

K.2 👁 AI Non-essential categories default to OFF

UNCLEAR

Cannot assess default toggle states for non-essential categories as the screenshots only show the initial consent layer and post-decision pages, not the detailed preferences panel

ai_evidence
No privacy manager/manage panel screenshot available showing individual category toggles

K.3 HIGH👁 AI⚖ Alt. model No dark patterns in consent banner (colour, visual hierarchy)

✗ FAIL

This constitutes a dark pattern as it makes rejecting cookies appear to have additional consequences (subscription requirement) compared to the simple 'Accept all' option, potentially steering users toward acceptance

ai_evidence
Reject button labeled 'Reject all and subscribe' creates confusion by bundling rejection with subscription, making the reject path appear more complex and costly

Regulatory basis: GDPR Art. 5(1)(a) · GDPR Art. 6(1)(a)
Precedent: CJEU Orange România (C-61/19) established that consent must be genuinely free with no bundling of services or detriment for refusal.

Recommendation: Implement clear separation between cookie rejection and subscription choices to avoid bundling that undermines consent freedom per Orange România requirements.

K.5 Persistent consent withdrawal mechanism accessible after interaction

✓ PASS

Persistent consent widget found: '(consent widget)'

found	text	in_iframe
True	(consent widget)	False

K.6 Site fully accessible after declining consent (no cookie wall)

✓ PASS

Site content accessible after declining consent.

accessible
True

L. Consent State Persistence 0 FAIL 2 PASS 0 MANUAL

L.2 Consent choice respected on second tab (same session)

✓ PASS

Consent preference correctly persisted to second tab.

consent_cookie_found	ad_cookies_found	tcf_available	tcf_display_status
True	False	True	None

L.3 Declined state maintained after closing and reopening (simulate new session)

✓ PASS

No advertising cookies found on simulated return visit.

ad_cookies_on_return	total_cookies
False	10

Additional Findings 0 FAIL 3 PASS 0 MANUAL

ADD.1 Persistent identifier bridging across consent states

✓ PASS

No persistent cross-phase identifiers detected in POST bodies.

ADD.2 TCF consent string analysis (all phases)

ℹ INFO

No TCF consent strings detected in query parameters.

phase	domain	timestamp	summary	is_reject_all	is_accept_all	cmp	tcf_policy_version	purpose_consents	li_claims	decode_error
post_accept	cm.g.doubleclick.net	2026-03-31T19:40:44	Accept-all (purposes 1–10 consented, CMP: Unknown CMP (ID 112))	False	True	Unknown CMP (ID 112)	5	All 10 core purposes CONSENTED	[2, 7, 8, 9, 10, 11]	None

ADD.3 Session ID bridging across consent and rejection phases

✓ PASS

No session ID bridging detected across consent states.

ADD.4 Persistent vendor userIds transmitted after reject-all

✓ PASS

No persistent vendor userIds detected in post-reject requests.

Test Details 0 FAIL 0 PASS 0 MANUAL

META Site URL, test date, CMP platform

ℹ INFO

CMP identified as: Sourcepoint CMP

url	test_date	test_time_utc	cmp_detected	total_requests	phases_detected	phase_strategy
Latest news, sport and opinion from the Guardian	2026-03-31	2026-03-31T19:40:48	Sourcepoint CMP	379	['pre_consent', 'post_reject']	{'accept': 'not_detected', 'reject': 'timestamp_hint'}

Component 3 — AI analysis via claude-sonnet-4-20250514 · ← Home