This tool checks your site’s compliance with the ePrivacy Directive’s cookie consent requirements — but GDPR places many additional obligations on organisations that collect personal data. Lawful basis assessments, privacy notices, data subject rights procedures, and data processor agreements are just a few of the areas this tool cannot evaluate.
If you’d like a fuller picture of your compliance position, Waivern combines automated scanning tools like this one with experienced privacy and legal professionals who can assess your entire data protection programme. Our ongoing compliance support starts from just £200/month (ex. VAT) — straightforward, predictable pricing with no surprises.
SF Chronicle operates with significant GDPR/ePrivacy violations that would similarly violate EU data protection standards applicable to EU visitors. The site deploys non-essential tracking cookies without proper consent mechanisms, lacks transparent cookie documentation, provides no withdrawal mechanism, and potentially implements a cookie wall blocking content access. Multiple FullStory analytics cookies are set without meeting strictly necessary exemptions, creating substantial compliance risks for EU data subjects.
🤖 = AI-assessed · 👁 = Vision (screenshot) · HIGH MEDIUM LOW = risk level from legal analysis
No consent-required domains observed before the consent signal.
No advertising cookies found in Storage before consent.
All probed tracker globals are undefined pre-consent.
No tracking keys found in web storage pre-consent.
All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.
No post-accept phase detected. Was 'Accept All' clicked during recording?
6 cookies in storage after Accept All (full metadata).
| name | domain | expires_days | http_only | secure | same_site | classification |
|---|---|---|---|---|---|---|
| location_data | www.sfchronicle.com | session | False | True | Strict | UNKNOWN |
| hnpdiudpf1 | .sfchronicle.com | 365.0 | True | True | Lax | UNKNOWN |
| hnpdiudpf2 | .sfchronicle.com | session | False | True | Lax | UNKNOWN |
| ab_bucket | www.sfchronicle.com | 365.0 | False | True | None | UNKNOWN |
| _fs_ch_cp_79UUvfpJ5mWYtLQv | www.sfchronicle.com | 0.0 | True | False | Lax | UNKNOWN |
| _fs_ch_st_FSBmUei20MqUiJb9 | www.sfchronicle.com | 0.0 | True | False | Lax | UNKNOWN |
Globals defined after consent: []
Accept and Reject both require 1 click(s). Symmetric.
| accept_clicks | reject_clicks | extra_clicks_to_reject | reject_required_manage_panel |
|---|---|---|---|
| 1 | 1 | 0 | True |
No post-reject phase detected in this HAR.
No post-reject phase detected in this HAR.
No post-reject phase detected in this HAR.
No subpages captured.
No post-reject phase detected.
No advertising cookies visible in document.cookie post-reject.
| doc_cookie_snippet |
|---|
| location_data={"is_eu":true,"country_code":"NL","postal_code":"1"}; hnpdiudpf2=fiqe0KH5kJz7AFEcZYKNIZKfrXjTadVxpt9zGg4FgPo=; ab_bucket=48 |
No tracking identifiers found in localStorage/sessionStorage post-reject.
6 first-party cookies in Storage after Accept All.
| name | domain | expires_days | http_only | secure | same_site | classification |
|---|---|---|---|---|---|---|
| location_data | www.sfchronicle.com | session | False | True | Strict | UNKNOWN |
| hnpdiudpf1 | .sfchronicle.com | 365.0 | True | True | Lax | UNKNOWN |
| hnpdiudpf2 | .sfchronicle.com | session | False | True | Lax | UNKNOWN |
| ab_bucket | www.sfchronicle.com | 365.0 | False | True | None | UNKNOWN |
| _fs_ch_cp_79UUvfpJ5mWYtLQv | www.sfchronicle.com | 0.0 | True | False | Lax | UNKNOWN |
| _fs_ch_st_FSBmUei20MqUiJb9 | www.sfchronicle.com | 0.0 | True | False | Lax | UNKNOWN |
6 cookie(s) observed but not found in cookie policy at https://sfchronicle.com/cookies.
| cookie_name | status |
|---|---|
| hnpdiudpf1 | observed but not in cookie policy |
| ab_bucket | observed but not in cookie policy |
| hnpdiudpf2 | observed but not in cookie policy |
| _fs_ch_cp_79UUvfpJ5mWYtLQv | observed but not in cookie policy |
| location_data | observed but not in cookie policy |
| _fs_ch_st_FSBmUei20MqUiJb9 | observed but not in cookie policy |
AI analysis: 3 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary: Major GDPR compliance issues identified: All 6 observed cookies are not declared in the cookie policy, which only mentions 'event' and 'script' cookies. Multiple FullStory analytics cookies are present without declaration. The cookie policy appears incomplete or the provided text doesn't contain the actual policy content. All cookies should be absent if user rejected consent, as none appear to be strictly necessary for basic website functionality.
| cookie_name | declared | category | strictly_necessary_test | should_be_absent_post_reject | notes |
|---|---|---|---|---|---|
| hnpdiudpf1 | False | unknown | unclear | True | Cookie not declared in policy. Name suggests it could be a session identifier or tracking cookie, but purpose is unclear without declaration. |
| ab_bucket | False | analytics | not_exempt | True | Appears to be an A/B testing bucket assignment cookie. Not declared in policy. A/B testing is not essential for basic service functionality. |
| hnpdiudpf2 | False | unknown | unclear | True | Cookie not declared in policy. Similar naming pattern to hnpdiudpf1, purpose unclear without declaration. |
| _fs_ch_cp_79UUvfpJ5mWYtLQv | False | analytics | not_exempt | True | Appears to be a FullStory (fs) analytics/session recording cookie. Not declared in policy. Analytics cookies are not strictly necessary. |
| location_data | False | functional | unclear | True | Appears to store location information. Not declared in policy. Could be functional if location is essential for the service, but typically requires consent. |
| _fs_ch_st_FSBmUei20MqUiJb9 | False | analytics | not_exempt | True | Another FullStory analytics/session recording cookie. Not declared in policy. Analytics cookies are not strictly necessary. |
No advertising cookies observed in Set-Cookie response headers.
Found 0 first-party subdomains. Run 'dig CNAME
All advertising cookies absent from Storage post-reject.
No tracking identifiers found in first-party web storage post-reject.
All tracker globals return undefined post-reject.
See H.1 — same evidence applies.
dataLayer not present post-reject.
All 0 tracker scripts correctly blocked in DOM post-reject.
See I.1 — same check.
Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).
Requires manual browser configuration check.
Requires manual browser configuration check.
No obvious ITP-bypass server-side cookies detected.
Could not determine button prominence.
| accept_visible_at_first_screen | reject_visible_at_first_screen | reject_requires_extra_layer | accept_button_text | reject_button_text |
|---|---|---|---|---|
| False | False | True |
Cannot determine default toggle states as no consent management interface is displayed
| ai_evidence |
|---|
| No privacy manager or preferences panel visible in any screenshot |
Cannot identify dark patterns as the screenshots appear to show blank pages without any consent banners, buttons, or UI elements
| ai_evidence |
|---|
| No consent interface elements visible to analyze for dark patterns |
No persistent consent widget found. Users cannot easily withdraw consent.
| found | text | in_iframe |
|---|---|---|
| False | False |
Site content may be blocked after declining — possible cookie wall.
| accessible |
|---|
| False |
Consent preference correctly persisted to second tab.
| consent_cookie_found | ad_cookies_found | tcf_available | tcf_display_status |
|---|---|---|---|
| False | False | False | None |
No advertising cookies found on simulated return visit.
| ad_cookies_on_return | total_cookies |
|---|---|
| False | 6 |
No persistent cross-phase identifiers detected in POST bodies.
No TCF consent strings detected in query parameters.
No session ID bridging detected across consent states.
No post-reject phase detected.
CMP identified as: Unknown / Not detected
| url | test_date | test_time_utc | cmp_detected | total_requests | phases_detected | phase_strategy |
|---|---|---|---|---|---|---|
| Client Challenge | 2026-03-31 | 2026-03-31T16:48:26 | Unknown / Not detected | 960 | ['pre_consent'] | {'accept': 'not_detected', 'reject': 'not_detected'} |
This tool checks your site’s compliance with the ePrivacy Directive’s cookie consent requirements — but GDPR places many additional obligations on organisations that collect personal data. Lawful basis assessments, privacy notices, data subject rights procedures, and data processor agreements are just a few of the areas this tool cannot evaluate.
If you’d like a fuller picture of your compliance position, Waivern combines automated scanning tools like this one with experienced privacy and legal professionals who can assess your entire data protection programme. Our ongoing compliance support starts from just £200/month (ex. VAT) — straightforward, predictable pricing with no surprises.
