Waivern Consent Analyser ← Home Log

ePrivacy / GDPR Compliance Report · ePrivacy/GDPR (EU)

Consent Compliance Report

2026-03-31 16:53:55 UTC · https://sfchronicle.com · CMP: Unknown / Not detected 🤖 AI on

📍 Analysis ran from: 🇳🇱 Amsterdam, North Holland, The Netherlands · IP: 208.77.244.106 · Railway · Results reflect how this site presents to this location.

Post Reject All — compliance state

5 FAIL 21 PASS 12 MANUAL · 16 warn 0 err

CMP Interaction

Banner detected	False
Accept button
Reject button
Clicks to accept / reject	0 / 0
Reject buried in manage panel	True

Screenshots

Pre-Consent — initial page load

Post Accept All — consent baseline

Post Reject All — compliance state

Section M — Summary

Category	Result
Pre Consent Clean	✓ PASS
No Tracking Cookies Pre Consent	✓ PASS
Tracker Globals Undefined	✓ PASS
No Tracking Storage Pre Consent	✓ PASS
Network Blocked After Decline	☐ MANUAL
Third Party Cookies Absent	☐ MANUAL
Doc Cookie Clean Post Reject	✓ PASS
Web Storage Clean Post Reject	✓ PASS
First Party Cookies Classified	ℹ INFO
Server Side Cookies Gated	— N/A
No Cname Cloaking	☐ MANUAL
Tracker Globals Absent	✓ PASS
Dom Scripts Blocked	✓ PASS
Reject Equals Accept Clicks	✓ PASS
No Preticked Boxes	☐ MANUAL
Persistent Withdrawal Widget	✗ FAIL
No Cookie Wall	✗ FAIL
Consent Persists	✓ PASS

Run Log 78 entries · ⚠ 16 warning(s) · raw JSON

elapsed	level	session	message
0.0s	▶ STEP	MAIN	Run 2e517903 started {"url": "https://sfchronicle.com"}
0.0s	· INFO	MAIN	Detecting probe server location
0.3s	· INFO	MAIN	Probe location {"ip": "208.77.244.106", "city": "Amsterdam", "region": "North Holland", "country": "The Netherlands", "country_code": "NL", "org": "Railway", "latitude": 52.37403, "longitude": 4.88969}
0.3s	▶ STEP	MAIN	Starting analysis of https://sfchronicle.com {"mode": "GDPR"}
1.2s	· INFO	MAIN	Chromium launched {"headless": true}
1.2s	· INFO	PREFLIGHT	Navigating to https://sfchronicle.com
9.7s	⚠ WARN	PREFLIGHT	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
9.7s	▶ STEP	A	Session A start (accept path)
9.9s	· INFO	A	Navigating to https://sfchronicle.com
18.4s	⚠ WARN	A	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
20.4s	· INFO	A	Capturing pre-consent state
20.6s	· INFO	A	Pre-consent state captured {"pre_consent_cookies": 6, "pre_consent_ad_cookies": 0, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": [], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null}
90.8s	· INFO	A	Banner: NOT FOUND
90.8s	⚠ WARN	A	No consent banner detected before Accept All — CMP may not have loaded, or banner was auto-dismissed by a prior cookie.
92.3s	· INFO	A	Accept All interaction {"cmp": "Unknown", "button_text": "", "clicked": false, "in_iframe": false, "error": "Accept All button not found"}
92.3s	⚠ WARN	A	Accept interaction issue: Accept All button not found
94.3s	· INFO	A	Capturing post-accept baseline state
94.5s	· INFO	A	Baseline captured {"baseline_cookies": 6, "baseline_ad_cookies": 0, "baseline_tracking_storage": 0, "baseline_tracker_globals": [], "baseline_unblocked_scripts": 0, "baseline_capture_error": null}
95.6s	· INFO	A	Context closed, HAR saved
95.7s	▶ STEP	A	Session A complete {"pre_consent_cookies": 6, "pre_consent_ad_cookies": 0, "pre_consent_tracking_storage": 0, "pre_consent_tracker_globals": [], "pre_consent_unblocked_scripts": 0, "pre_consent_capture_error": null, "baseline_cookies": 6, "baseline_ad_cookies": 0, "baseline_tracking_storage": 0, "baseline_tracker_globals": [], "baseline_unblocked_scripts": 0, "baseline_capture_error": null}
95.7s	▶ STEP	B	Session B start (reject path)
95.8s	· INFO	B	Navigating to https://sfchronicle.com
104.2s	⚠ WARN	B	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
106.2s	· INFO	B	Capturing pre-consent state
106.4s	· INFO	B	Pre-consent B captured {"pre_consent_B_cookies": 6, "pre_consent_B_ad_cookies": 0, "pre_consent_B_tracking_storage": 0, "pre_consent_B_tracker_globals": [], "pre_consent_B_unblocked_scripts": 0, "pre_consent_B_capture_error": null}
176.7s	· INFO	B	Banner: NOT FOUND
176.7s	⚠ WARN	B	No consent banner detected in Session B — Reject All will likely fail. Post-reject checks will be unreliable.
190.2s	· INFO	B	Click symmetry measured {"accept_clicks": 0, "reject_clicks": 0}
192.2s	· INFO	B	Reject All interaction {"cmp": "Unknown", "button_text": "", "clicked": false, "clicks_required": 0, "required_manage_panel": true, "panel_navigated": false, "panel_new_frames": 0, "panel_wait_s": 0.0, "error": "No reject button and no manage/preferences button found on layer 1. CMP may not have loaded, or uses an unrecognised button label."}
192.2s	⚠ WARN	B	Reject interaction issue: No reject button and no manage/preferences button found on layer 1. CMP may not have loaded, or uses an unrecognised button label.
192.2s	⚠ WARN	B	Reject All was NOT successfully clicked — post-reject state captures an unmodified consent state, not a rejection.
194.3s	· INFO	B	Site accessible after reject: False
194.3s	· INFO	B	Capturing post-reject state
194.5s	· INFO	B	Post-reject captured {"post_reject_cookies": 6, "post_reject_ad_cookies": 0, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": [], "post_reject_unblocked_scripts": 0, "post_reject_capture_error": null}
199.9s	· INFO	B	Persistent widget check {"found": false, "text": "", "in_iframe": false}
199.9s	· INFO	B	Capturing subpages
199.9s	· INFO	B	0 subpage(s) captured {"urls": [], "errors": []}
201.2s	· INFO	B	Context closed, HAR saved
201.2s	· INFO	B	Checking pre-ticked toggles (separate session)
201.2s	· INFO	B	Navigating to https://sfchronicle.com
209.8s	⚠ WARN	B	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
294.4s	⚠ WARN	B	Manage/preferences button not visible after 5s wait — toggle check may return 0 results
295.9s	· INFO	B	Pre-ticked toggles: 0 found {"toggles": {}}
295.9s	⚠ WARN	B	Toggle check returned 0 results — diagnostics: {"manage_button_found": false, "manage_button_text": null, "frames_scanned": [], "total_elements_found": 0, "note": "Manage/preferences button not found on page"}
295.9s	▶ STEP	B	Session B complete {"post_reject_cookies": 6, "post_reject_ad_cookies": 0, "post_reject_tracking_storage": 0, "post_reject_tracker_globals": [], "post_reject_unblocked_scripts": 0, "post_reject_capture_error": null, "accept_clicks": 0, "reject_clicks": 0, "reject_at_first_screen": false, "subpages_captured": 0}
295.9s	▶ STEP	C	Session C start (persistence check)
296.1s	· INFO	C	Navigating to https://sfchronicle.com
304.5s	⚠ WARN	C	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
378.3s	· INFO	C	Reject for persistence test {"clicked": false, "error": "No reject button and no manage/preferences button found on layer 1. CMP may not have loaded, or uses an unrecognised button label."}
378.3s	⚠ WARN	C	Reject All failed in Session C — persistence check results will be unreliable.
380.3s	· INFO	C	Opening second tab (same-session test)
380.4s	· INFO	C	Navigating to https://sfchronicle.com
388.7s	⚠ WARN	C	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
390.8s	· INFO	C	Same-session state captured {"persistence_1_cookies": 6, "persistence_1_ad_cookies": 0, "persistence_1_tracking_storage": 0, "persistence_1_tracker_globals": [], "persistence_1_unblocked_scripts": 0, "persistence_1_capture_error": null}
390.9s	· INFO	C	Storage state saved, opening new context
390.9s	· INFO	C	Navigating to https://sfchronicle.com
399.4s	⚠ WARN	C	Network did not reach idle state — proceeding after load event. Normal for sites with persistent connections (websockets, polling).
401.5s	· INFO	C	New-session state captured {"persistence_2_cookies": 6, "persistence_2_ad_cookies": 0, "persistence_2_tracking_storage": 0, "persistence_2_tracker_globals": [], "persistence_2_unblocked_scripts": 0, "persistence_2_capture_error": null}
401.6s	▶ STEP	C	Session C complete {"persistence_1_captured": true, "persistence_2_captured": true}
401.6s	▶ STEP	POLICY_RENDER	Rendering cookie policy page in browser
402.1s	· INFO	POLICY_RENDER	Navigating to policy: https://sfchronicle.com/cookies
412.7s	· INFO	POLICY_RENDER	Extracted 2051 chars from policy page
412.7s	· INFO	POLICY_RENDER	Policy page rendered (2073 chars)
412.8s	· INFO	MAIN	Browser closed
412.9s	▶ STEP	DNS	Running CNAME cloaking checks
412.9s	· INFO	DNS	Apex domain: sfchronicle.com (from hostname: sfchronicle.com)
413.1s	· INFO	DNS	Checking 0 subdomain(s) {"subdomains": []}
413.1s	· INFO	DNS	No first-party subdomains to check
413.1s	▶ STEP	POLICY	Fetching cookie policy
413.1s	· INFO	POLICY	Policy found at https://sfchronicle.com/cookies
413.1s	· INFO	POLICY	Fetching policy, cross-referencing 6 cookie(s)
424.3s	· INFO	POLICY	Policy fetch OK {"declared": 2, "undeclared_observed": 6, "ai_used": true}
424.3s	⚠ WARN	POLICY	6 cookie(s) not in policy {"cookies": ["hnpdiudpf1", "ab_bucket", "hnpdiudpf2", "_fs_ch_cp_79UUvfpJ5mWYtLQv", "location_data", "_fs_ch_st_FSBmUei20MqUiJb9"]}
424.3s	▶ STEP	MAIN	Analysis complete {"error_count": 0}
424.3s	▶ STEP	C1	Running Component 1 HAR analysis
424.7s	· INFO	C1	HAR analysis complete — 0 FAIL item(s) {"total_requests": 960, "phases": ["pre_consent"], "phase_strategy": {"accept": "not_detected", "reject": "not_detected"}, "fail_items": []}
424.9s	▶ STEP	CHECKS	Running browser-state checks
424.9s	· INFO	CHECKS	Browser checks complete — 5 FAIL item(s) {"fail_items": ["G.2", "G.3", "K.5", "K.6", "L.2"], "mode": "gdpr"}

Detailed Findings

B. Pre-Consent State 5 PASS 0 MANUAL

B.1 No tracking requests before consent banner interaction

✓ PASS

No consent-required domains observed before the consent signal.

B.2 No analytics/marketing cookies in Storage pre-consent

✓ PASS

No advertising cookies found in Storage before consent.

B.3 JS tracker globals return undefined pre-consent

✓ PASS

All probed tracker globals are undefined pre-consent.

B.4 No tracking identifiers in localStorage/sessionStorage pre-consent

✓ PASS

No tracking keys found in web storage pre-consent.

B.5 Non-essential scripts have type=text/plain (CMP-blocked) in DOM

✓ PASS

All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.

C. Baseline Capture 0 PASS 1 MANUAL

C.2 Third-party domains active after Accept All

☐ MANUAL

No post-accept phase detected. Was 'Accept All' clicked during recording?

C.3 Full cookie inventory (with expiry, HttpOnly, Secure, SameSite) after Accept All

ℹ INFO

6 cookies in storage after Accept All (full metadata).

name	domain	expires_days	http_only	secure	same_site	classification
location_data	www.sfchronicle.com	session	False	True	Strict	UNKNOWN
hnpdiudpf1	.sfchronicle.com	365.0	True	True	Lax	UNKNOWN
hnpdiudpf2	.sfchronicle.com	session	False	True	Lax	UNKNOWN
ab_bucket	www.sfchronicle.com	365.0	False	True	None	UNKNOWN
_fs_ch_cp_79UUvfpJ5mWYtLQv	www.sfchronicle.com	0.0	True	False	Lax	UNKNOWN
_fs_ch_st_FSBmUei20MqUiJb9	www.sfchronicle.com	0.0	True	False	Lax	UNKNOWN

C.4 Tracker JS globals active after Accept All (baseline)

ℹ INFO

Globals defined after consent: []

D. Decline Non-Essential Consent 1 PASS 0 MANUAL

D.4 Reject requires no more clicks than Accept (EDPB symmetry)

✓ PASS

Accept and Reject both require 1 click(s). Symmetric.

accept clicks: 1 · reject clicks: 1 · extra clicks to reject: 0 · reject required manage panel: True

E. Network Request Verification 0 PASS 4 MANUAL

E.1 Network requests after reject-all

☐ MANUAL

No post-reject phase detected in this HAR.

E.2 Network requests after reject-all

☐ MANUAL

No post-reject phase detected in this HAR.

E.3 Network requests after reject-all

☐ MANUAL

No post-reject phase detected in this HAR.

E.4 No tracking on subsequent pages after reject

☐ MANUAL

No subpages captured.

F. Cookie Verification (Third-Party) 2 PASS 1 MANUAL

F.1 No non-essential cookies after reject-all

☐ MANUAL

No post-reject phase detected.

F.2 document.cookie contains only essential cookies post-reject

✓ PASS

No advertising cookies visible in document.cookie post-reject.

doc cookie snippet: location_data={"is_eu":true,"country_code":"NL","postal_code":"1"}; hnpdiudpf2=fiqe0KH5kJz7AFEcZYKNIZKfrXjTadVxpt9zGg4FgPo=; ab_bucket=48

F.3 No tracking identifiers in web storage post-reject

✓ PASS

No tracking identifiers found in localStorage/sessionStorage post-reject.

G. First-Party Cookie Classification 2 FAIL 3 PASS 1 MANUAL

G.1 Complete first-party cookie inventory with full metadata

ℹ INFO

6 first-party cookies in Storage after Accept All.

name	domain	expires_days	http_only	secure	same_site	classification
location_data	www.sfchronicle.com	session	False	True	Strict	UNKNOWN
hnpdiudpf1	.sfchronicle.com	365.0	True	True	Lax	UNKNOWN
hnpdiudpf2	.sfchronicle.com	session	False	True	Lax	UNKNOWN
ab_bucket	www.sfchronicle.com	365.0	False	True	None	UNKNOWN
_fs_ch_cp_79UUvfpJ5mWYtLQv	www.sfchronicle.com	0.0	True	False	Lax	UNKNOWN
_fs_ch_st_FSBmUei20MqUiJb9	www.sfchronicle.com	0.0	True	False	Lax	UNKNOWN

G.2 All observed cookies declared in cookie policy

✗ FAIL

6 cookie(s) observed but not found in cookie policy at https://sfchronicle.com/cookies.

cookie_name	status
hnpdiudpf1	observed but not in cookie policy
ab_bucket	observed but not in cookie policy
hnpdiudpf2	observed but not in cookie policy
_fs_ch_cp_79UUvfpJ5mWYtLQv	observed but not in cookie policy
location_data	observed but not in cookie policy
_fs_ch_st_FSBmUei20MqUiJb9	observed but not in cookie policy

G.3 Strictly necessary two-part test (AI-assisted)

✗ FAIL

AI analysis: 3 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary: Major GDPR compliance issues identified: All 6 observed cookies are not declared in the cookie policy, which only mentions 'event' and 'script' cookies. Multiple FullStory analytics cookies are present without declaration. The cookie policy appears incomplete or the provided text doesn't contain the actual policy content. All cookies should be absent if user rejected consent, as none appear to be strictly necessary for basic website functionality.

cookie_name	declared	category	strictly_necessary_test	should_be_absent_post_reject	notes
hnpdiudpf1	False	unknown	unclear	True	Cookie not declared in policy. Name suggests it could be a session identifier or tracking cookie, but purpose is unclear without declaration.
ab_bucket	False	analytics	not_exempt	True	Appears to be an A/B testing bucket assignment cookie. Not declared in policy. A/B testing is not essential for basic service functionality.
hnpdiudpf2	False	unknown	unclear	True	Cookie not declared in policy. Similar naming pattern to hnpdiudpf1, purpose unclear without declaration.
_fs_ch_cp_79UUvfpJ5mWYtLQv	False	analytics	not_exempt	True	Appears to be a FullStory (fs) analytics/session recording cookie. Not declared in policy. Analytics cookies are not strictly necessary.
location_data	False	functional	unclear	True	Appears to store location information. Not declared in policy. Could be functional if location is essential for the service, but typically requires consent.
_fs_ch_st_FSBmUei20MqUiJb9	False	analytics	not_exempt	True	Another FullStory analytics/session recording cookie. Not declared in policy. Analytics cookies are not strictly necessary.

Recommendation: Cookies that fail the strictly necessary two-part test (ePrivacy Art. 5(3)) must be gated behind consent and absent after a reject-all signal.

G.4 Server-side analytics/ad cookies identified in Set-Cookie headers

✓ PASS

No advertising cookies observed in Set-Cookie response headers.

G.5 CNAME cloaking check (subdomains observed — DNS resolution requires Component 2)

☐ MANUAL

Found 0 first-party subdomains. Run 'dig CNAME ' against each to check for third-party infrastructure. Full automation available in Component 2.

G.6 Non-essential first-party cookies absent after reject-all

✓ PASS

All advertising cookies absent from Storage post-reject.

G.9 No tracking keys in first-party localStorage/sessionStorage post-reject

✓ PASS

No tracking identifiers found in first-party web storage post-reject.

H. JS Global Object Verification 2 PASS 0 MANUAL

H.1 Tracker JS globals (ga, gtag, fbq, hj, etc.) return undefined post-reject

✓ PASS

All tracker globals return undefined post-reject.

H.2 Tracker globals not merely defined without values

ℹ INFO

See H.1 — same evidence applies.

H.3 window.dataLayer absent or contains no tracking events post-reject

✓ PASS

dataLayer not present post-reject.

I. DOM / Source Inspection 3 PASS 0 MANUAL

I.1 Tracker script tags have type=text/plain (CMP-blocked) in DOM post-reject

✓ PASS

All 0 tracker scripts correctly blocked in DOM post-reject.

I.2 Non-essential scripts blocked (type=text/plain)

✓ PASS

See I.1 — same check.

I.3 No tracker JS files in executed sources post-reject

✓ PASS

Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).

J. Safari-Specific Considerations 1 PASS 2 MANUAL

J.1 ITP setting

☐ MANUAL

Requires manual browser configuration check.

J.2 ITP-off re-test

☐ MANUAL

Requires manual browser configuration check.

J.3 Server-side cookie-setting identified where ITP would block client-side

✓ PASS

No obvious ITP-bypass server-side cookies detected.

K. Consent Mechanism UX Compliance 2 FAIL 1 PASS 2 MANUAL

K.1 Reject All at same prominence and level as Accept All

✓ PASS

Could not determine button prominence.

accept visible at first screen: False · reject visible at first screen: False · reject requires extra layer: True · accept button text: · reject button text:

K.2 Non-essential categories default to OFF

☐ MANUAL

Could not open preferences panel to check toggles.

K.3 No dark patterns in consent banner (colour, visual hierarchy)

☐ MANUAL

DOM-level button detection completed. Full visual assessment of colour contrast, typography prominence, and deceptive visual hierarchy requires screenshot review. See screenshots in report.

K.5 Persistent consent withdrawal mechanism accessible after interaction

✗ FAIL

No persistent consent widget found. Users cannot easily withdraw consent.

found: False · text: · in iframe: False

Recommendation: Provide a persistent mechanism for users to re-open consent preferences (floating privacy icon, footer link, or settings page). GDPR Art. 7(3) requires withdrawal to be as easy as giving consent.

K.6 Site fully accessible after declining consent (no cookie wall)

✗ FAIL

Site content may be blocked after declining — possible cookie wall.

accessible: False

Recommendation: Conditioning access to content on consent acceptance (cookie walls) is incompatible with freely given consent under GDPR Art. 7 and EDPB Guidelines 05/2020 §3.1.1.

L. Consent State Persistence 1 FAIL 1 PASS 0 MANUAL

L.2 Consent choice respected on second tab (same session)

✗ FAIL

Consent preference correctly persisted to second tab.

consent cookie found: False · ad cookies found: False · tcf available: False · tcf display status: None

L.3 Declined state maintained after closing and reopening (simulate new session)

✓ PASS

No advertising cookies found on simulated return visit.

ad cookies on return: False · total cookies: 6

Additional Findings 2 PASS 1 MANUAL

ADD.1 Persistent identifier bridging across consent states

✓ PASS

No persistent cross-phase identifiers detected in POST bodies.

ADD.2 TCF consent string analysis (all phases)

ℹ INFO

No TCF consent strings detected in query parameters.

ADD.3 Session ID bridging across consent and rejection phases

✓ PASS

No session ID bridging detected across consent states.

ADD.4 Vendor userId transmission post-reject

☐ MANUAL

No post-reject phase detected.

Test Details 0 PASS 0 MANUAL

META Site URL, test date, CMP platform

ℹ INFO

CMP identified as: Unknown / Not detected

url	Client Challenge
test date	2026-03-31
test time utc	2026-03-31T16:48:26
cmp detected	Unknown / Not detected
total requests	960
phases detected	pre_consent
phase strategy	{'accept': 'not_detected', 'reject': 'not_detected'}

run_id: 2e517903 · raw log · ⬇ report JSON · all runs · ← Home

🤖 AI-Enhanced Analysis

Add regulatory citations, risk ratings, enforcement precedents, and a remediation roadmap using Claude AI. Results are cached — generation only runs once per report.

🤖 View AI Report