Back to Details

compliance-testing

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese
<objective> Compliance is binary: a single analytics cookie that fires before consent, or a "Reject all" rendered as a tiny grey link, is a violation no matter how polished the rest of the flow looks. Manual quarterly audits miss the regression a developer shipped on a Tuesday. This skill automates the technical checks — consent state, script blocking, cookie attributes, GPC, Consent Mode v2, AI Act disclosure — so configuration drift fails CI instead of a regulator's inbox. </objective>
<objective> 合规性是二元判定：哪怕其余流程再完善，只要有一个分析类Cookie在获得同意前触发，或是「全部拒绝」被设为极小的灰色链接，就构成违规。人工季度审计无法发现开发者在某个周二上线的回归问题。本技能可自动执行技术检查——同意状态、脚本拦截、Cookie属性、GPC、Consent Mode v2、AI法案披露——让配置漂移在CI阶段就被拦截，而非等到监管机构的邮件找上门。 </objective>

Discovery Questions

调研问题

First, check for 
.agents/qa-project-context.md
in the project root — it carries applicable regulations, CMP details, ad networks, and geographic scope. Skip any question already answered there. If it is missing, suggest creating one with the 
qa-project-context
skill.
首先检查项目根目录下是否存在
.agents/qa-project-context.md
文件——其中包含适用法规、CMP详情、广告网络和地域范围信息。跳过已在该文件中回答的问题。若文件缺失，建议使用
qa-project-context
技能创建该文件。

Applicable regulations

适用法规

  • Which privacy and platform regulations apply? This sets the entire test matrix.
    • EU: GDPR, ePrivacy Directive (cookies), Digital Services Act (DSA, applied 17 Feb 2024), EU AI Act (prohibitions + AI literacy live since 2 Feb 2025; GPAI obligations + penalties since 2 Aug 2025; Article 50 transparency from 2 Aug 2026 — high-risk obligations postponed, see below).
    • US: CCPA/CPRA plus comprehensive state laws now active in ~20 states (Texas TDPSA, Indiana CDPA eff. 1 Jan 2026, Delaware DPDPA, Nebraska NDPA, Minnesota CDPA, Rhode Island DTPPA, …). Most require honoring Global Privacy Control (
      Sec-GPC: 1
      ).
    • UK: UK GDPR/DPA, PECR (cookies), Online Safety Act 2023, Data Use and Access Act (DUAA).
    • Other: LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa).
  • What is the legal basis for processing? Consent (opt-in), legitimate interest, or contractual necessity — this decides whether explicit consent must precede processing.
  • Is there a DPO or legal team? They define the legal requirements; this skill only validates the technical implementation against them.
  • 适用哪些隐私与平台法规？ 这将决定整个测试矩阵。
    • 欧盟： GDPR、电子隐私指令（Cookie相关）、数字服务法案（DSA，2024年2月17日生效）、EU AI Act（禁止性条款+AI素养要求自2025年2月2日起生效；GPAI义务+处罚规则自2025年8月2日起生效；第50条透明度要求自2026年8月2日起生效——高风险义务已推迟，详见下文）。
    • 美国： CCPA/CPRA，加上目前约20个州已生效的全面州级法律（得克萨斯州TDPSA、印第安纳州CDPA将于2026年1月1日生效、特拉华州DPDPA、内布拉斯加州NDPA、明尼苏达州CDPA、罗德岛州DTPPA等）。多数法律要求遵守Global Privacy Control（
      Sec-GPC: 1
      ）。
    • 英国： UK GDPR/DPA、PECR（Cookie相关）、2023年在线安全法案、数据使用与访问法案（DUAA）。
    • 其他地区： LGPD（巴西）、PIPEDA（加拿大）、POPIA（南非）。
  • 数据处理的法律依据是什么？ 同意（ opt-in）、合法利益或合同必要性——这将决定是否必须在处理前获得明确同意。
  • 是否设有数据保护官（DPO）或法务团队？ 他们定义法律要求；本技能仅针对这些要求验证技术实现。

Consent management

同意管理

  • What CMP is in use? OneTrust, Cookiebot, Didomi, Usercentrics, Iubenda, Sourcepoint, or Axeptio — or custom? The CMP sets the consent storage format, API, and integration. If you serve ads in the EEA or UK, you must use a Google-certified CMP and Consent Mode v2 — uncertified CMPs block Google ad serving. As of 28 Feb 2026, new TC strings must be TCF v2.3 or Google demand treats traffic as unconsented and drops to Limited Ads.
  • What consent categories exist? Typically Strictly Necessary (always on), Analytics/Performance, Functional/Preferences, Marketing/Targeting.
  • How is consent signaled to third-party scripts? IAB TCF v2 (
    __tcfapi
    ), a custom data layer, or direct CMP API?
  • 使用的CMP是什么？ OneTrust、Cookiebot、Didomi、Usercentrics、Iubenda、Sourcepoint或Axeptio——还是自定义CMP？CMP决定了同意存储格式、API和集成方式。如果您在EEA或英国投放广告，必须使用Google认证的CMP和Consent Mode v2——未认证的CMP会阻止Google广告投放。截至2026年2月28日，新的TC字符串必须为TCF v2.3，否则Google需求方会将流量视为未获得同意，并降至有限广告模式。
  • 存在哪些同意类别？ 通常包括严格必要（始终启用）、分析/性能、功能/偏好、营销/定向。
  • 如何向第三方脚本传递同意信号？ IAB TCF v2（
    __tcfapi
    ）、自定义数据层还是直接CMP API？

Advertising and accessibility

广告与无障碍

  • What ad networks and formats? Google Ads, Meta, programmatic; display, video, interstitial. The Coalition for Better Ads defines which formats trigger Chrome ad-filtering.
  • Are there accessibility obligations (ADA, EAA, Section 508)? Those are real compliance, but author them in 
    accessibility-testing
    — this skill only maps the legal landscape, see below.
  • 使用哪些广告网络和格式？ Google Ads、Meta、程序化广告；展示、视频、插屏广告。Better Ads联盟定义了哪些格式会触发Chrome广告过滤。
  • 是否有无障碍义务（ADA、EAA、Section 508）？ 这些属于合规要求，但请在
    accessibility-testing
    技能中编写相关测试——本技能仅梳理法律框架，详见下文。

Core Principles

核心原则

1. Compliance is binary

1. 合规性是二元判定

There is no "mostly compliant." A cookie that fires before consent is a violation. A banner you cannot dismiss without accepting is a violation. Test for exact compliance, not "good enough."
不存在「基本合规」的说法。获得同意前触发Cookie即构成违规。无法在不接受的情况下关闭横幅也构成违规。测试需严格符合合规要求，而非追求「足够好」。

2. Automate the technical checks, schedule the legal audits

2. 自动化技术检查，定期安排法务审计

Automate: cookies before consent, scripts loading without consent, banner functionality, cookie attributes, consent persistence, GPC, Consent Mode signals. A human still audits privacy-policy language and cross-border transfer documentation. Don't pretend a test settles a legal-language question.
自动化检查内容：同意前的Cookie、未获同意即加载的脚本、横幅功能、Cookie属性、同意持久性、GPC、Consent Mode信号。隐私政策的措辞和跨境传输文档仍需人工审计。不要试图用测试解决法律措辞问题。

3. Test the unhappy consent states

3. 测试非合意的同意状态

The compliance boundary lives in the "no interaction," "rejected," and "withdrawn" states — that is where violations hide. The "all accepted" state is the least interesting one to test.
合规边界存在于「无交互」「拒绝」和「撤回」状态——违规行为往往隐藏于此。「全部接受」状态是最无需关注的测试场景。

4. Verify behavior, not the CMP

4. 验证行为，而非依赖CMP

CMPs have bugs. Don't trust the CMP UI as proof. Assert the actual outcome: were cookies set, did scripts load, was the GPC opt-out registered. The CMP is an implementation detail; compliance is measured by behavior.
CMP可能存在漏洞。不要将CMP UI作为合规证明。需验证实际结果：是否设置了Cookie、是否加载了脚本、GPC退出请求是否已记录。CMP只是实现细节；合规性需通过行为来衡量。

5. Defense in depth, config-driven

5. 纵深防御，配置驱动

Verify at multiple layers — CMP config, network requests, cookie state, client signals. Drive tests from a typed inventory and a tracking-domain list so adding a category or threshold is a data edit, not a suite rewrite. Regulations change; the suite must be cheap to update.
在多个层面进行验证——CMP配置、网络请求、Cookie状态、客户端信号。通过类型化清单和跟踪域名列表驱动测试，这样添加类别或阈值只需编辑数据，无需重写测试套件。法规会变化，测试套件必须易于更新。

GDPR / CMP Testing with Playwright

使用Playwright进行GDPR/CMP测试

Consent-flow compliance breaks into distinct, independently failing checks. Full runnable code for each is in 
references/gdpr-cmp-tests.md
.
  • Consent banner and dark patterns — banner appears on first visit; accept and reject have equal prominence (reject is not a tiny link); a privacy-policy link is present.
  • Cookie state before/after consent — the critical test: no non-essential cookies before consent; analytics cookies only after accepting; nothing non-essential after rejecting. Maintain 
    isStrictlyNecessary
    / 
    isAnalyticsCookie
    classifiers against your inventory.
  • Consent persistence and withdrawal — consent survives navigation; the user can withdraw via privacy settings, which must then clear the relevant cookies.
  • Third-party script blocking — tracking scripts (
    google-analytics.com
    , 
    googletagmanager.com
    , 
    facebook.net
    , 
    analytics.tiktok.com
    , 
    bat.bing.com
    , …) must not load before consent and should load after acceptance. This is the most critical check — monitor with 
    page.on('request')
    .
  • Global Privacy Control (
    Sec-GPC: 1
    )     — a required honored signal under CCPA/CPRA and most active US state laws. With the header set, assert 
    navigator.globalPrivacyControl === true
    (the real browser signal) and that marketing cookies are absent. Do not assert an invented 
    window.__cmp.gpcStatus
    global — it does not exist; TCF v1's 
    __cmp
    is legacy and TCF v2 uses 
    __tcfapi
    .
  • TCF v2 consent state — every TCF-certified CMP exposes 
    window.__tcfapi('getTCData', 2, cb)
    . Read purpose/vendor consent through it directly instead of guessing at CMP-private globals; the same call exposes 
    tcfPolicyVersion
    , which doubles as a TCF-v2.3 freshness guard.
  • Google Consent Mode v2 — required since March 2024 for Google ads in the EEA/UK. Default state must be 
    denied
    for 
    ad_storage
    / 
    analytics_storage
    / 
    ad_user_data
    / 
    ad_personalization
    ; an 
    update
    signal must fire 
    granted
    after acceptance. The interception assumes the gtag 
    arguments
    -array shape — note the object-form fallback in the reference.
同意流程合规性可拆分为多个独立的检查项，每项的完整可运行代码均位于
references/gdpr-cmp-tests.md
中。
  • 同意横幅与暗模式——首次访问时显示横幅；接受和拒绝按钮同等显眼（拒绝按钮不是极小的链接）；包含隐私政策链接。
  • 同意前后的Cookie状态——关键测试：获得同意前无非必要Cookie；仅在接受后设置分析类Cookie；拒绝后无任何非必要Cookie。需针对您的Cookie清单维护
    isStrictlyNecessary
    /
    isAnalyticsCookie
    分类器。
  • 同意持久性与撤回——同意状态在页面导航后保持有效；用户可通过隐私设置撤回同意，且撤回后需清除相关Cookie。
  • 第三方脚本拦截——跟踪脚本（
    google-analytics.com
    、
    googletagmanager.com
    、
    facebook.net
    、
    analytics.tiktok.com
    、
    bat.bing.com
    等）不得在获得同意前加载，且应在接受后加载。这是最关键的检查项——通过
    page.on('request')
    进行监控。
  • Global Privacy Control（
    Sec-GPC: 1
    ）    ——CCPA/CPRA及多数美国生效州级法律要求必须遵守该信号。设置该标头后，需断言
    navigator.globalPrivacyControl === true
    （真实浏览器信号）且不存在营销类Cookie。请勿断言虚构的
    window.__cmp.gpcStatus
    全局变量——该变量不存在；TCF v1的
    __cmp
    已过时，TCF v2使用
    __tcfapi
    。
  • TCF v2同意状态——所有TCF认证的CMP都会暴露
    window.__tcfapi('getTCData', 2, cb)
    。直接通过该接口读取用途/供应商同意状态，而非猜测CMP私有全局变量；该调用同时会返回
    tcfPolicyVersion
    ，可作为TCF-v2.3的新鲜度验证依据。
  • Google Consent Mode v2——自2024年3月起，在EEA/英国投放Google广告的网站必须使用该模式。默认状态下
    ad_storage
    /
    analytics_storage
    /
    ad_user_data
    /
    ad_personalization
    必须为
    denied
    ；接受后需触发
    update
    信号并设为
    granted
    。拦截逻辑基于gtag的
    arguments
    数组格式——参考文档中包含对象格式的回退方案。

EU AI Act Compliance

EU AI Act合规性

The Act applies in phases, and the timeline shifted in 2026. Note: the Digital Omnibus (Nov 2025 proposal; 7 May 2026 provisional agreement) postponed the high-risk obligations — do not test against the old 2 Aug 2026 high-risk date.
ObligationAppliesWhat to test
Prohibitions + AI literacy2 Feb 2025 (live)No Article 5 prohibited practices (social scoring, real-time public biometric ID, manipulative AI). Document AI features in scope; gate prohibited libraries.
GPAI obligations + penalties2 Aug 2025 (live)Model cards, training-data summaries, copyright-policy and disclosure pages exist.
Article 50 transparency2 Aug 2026AI-generated content marked; deepfake disclosure; user told they are interacting with AI. Test the disclosure label/watermark. Still live on this date.
Machine-readable marking grace2 Dec 2026Systems already on the market before 2 Aug 2026 get until here to add the watermark/marking (Omnibus compressed six months to three).
High-risk (Annex III, use-case)2 Dec 2027Risk management, data governance, human oversight, transparency UI. Postponed from 2 Aug 2026 by the Omnibus.
High-risk (Annex I, product-regulated)2 Aug 2028As above, embedded in regulated products. Postponed from 2 Aug 2027.
Write the Article 50 disclosure test now; defer the high-risk UI tests until the Annex III obligations land. See 
references/eu-ai-act-tests.md
for the Article 50 transparency-disclosure test and the Article 5 prohibited-practice (biometric library) gate. For LLM-specific evaluation (hallucination, jailbreak resistance, prompt-injection), use the 
ai-system-testing
skill.
该法案分阶段生效，2026年调整了时间线。注意：数字综合法案（2025年11月提案；2026年5月7日临时协议）推迟了高风险义务的生效时间——请勿按照旧的2026年8月2日高风险日期进行测试。
义务生效时间测试内容
禁止性条款 + AI素养要求2025年2月2日（已生效）不存在第5条禁止的行为（社交评分、实时公共生物识别ID、操纵性AI）。记录适用范围内的AI功能；阻止禁用库的使用。
GPAI义务 + 处罚规则2025年8月2日（已生效）存在模型卡片、训练数据摘要、版权政策及披露页面。
第50条透明度要求2026年8月2日AI生成内容需标记；深度伪造需披露；需告知用户正在与AI交互。测试披露标签/水印。该日期仍有效。
机器可读标记宽限期2026年12月2日2026年8月2日前已上市的系统可在此日期前添加水印/标记（综合法案将6个月宽限期压缩至3个月）。
高风险（附件III，使用场景）2027年12月2日风险管理、数据治理、人工监督、透明度UI。已被综合法案从2026年8月2日推迟至此。
高风险（附件I，产品监管类）2028年8月2日同上，嵌入受监管产品中。已从2027年8月2日推迟至此。
现在即可编写第50条披露测试；高风险UI测试可推迟至附件III义务生效后进行。
references/eu-ai-act-tests.md
中包含第50条透明度披露测试及第5条禁止行为（生物识别库）拦截逻辑。针对LLM的特定评估（幻觉、越狱抵抗、提示注入），请使用
ai-system-testing
技能。

Better Ads Standards

Better Ads Standards

The Coalition for Better Ads defines ad formats that trigger browser-level ad filtering (Chrome filters ads on non-compliant sites).
FormatDesktopMobileTest approach
Pop-up adsYesYesCheck for modal/overlay within 5s of load without user action
Auto-playing video with soundYesYesRead the live 
video.autoplay
/ 
video.muted
properties (not the HTML attributes)
Prestitial countdown adsYesYesCheck for a countdown timer blocking content
Large sticky ads (>30% viewport)YesYesMeasure sticky element dimensions vs viewport
Ad density >30%NoYesCalculate total ad area vs content area
Flashing animated adsNoYesMonitor animation frame rate (>3 flashes/second)
The muted-video check must read the live DOM property (
el.muted
), not 
getAttribute('muted')
— player scripts set 
video.muted = true
in JS without ever adding the content attribute, so an attribute-only check reports muted ads as having sound and misses muted-then-unmuted ads.
Note: the CBA added two desktop and two mobile ad experiences on 14 Jan 2025; Chrome assessment of those begins no earlier than 14 May 2026. Re-check newer combined formats against the current Better Ads Standards page before that date. See 
references/better-ads-tests.md
for the auto-playing-video and mobile ad-density checks.
Better Ads联盟定义了会触发浏览器级广告过滤的广告格式（Chrome会对不合规网站过滤广告）。
格式桌面端移动端测试方法
弹窗广告是是检查加载后5秒内是否在无用户操作的情况下出现模态框/浮层
自动播放带声音的视频是是读取实时
video.autoplay
/
video.muted
属性（而非HTML属性）
插屏倒计时广告是是检查是否有倒计时计时器阻止内容显示
大型固定广告（占视口>30%）是是测量固定元素尺寸与视口的比例
广告密度>30%否是计算总广告面积与内容面积的比例
闪烁动画广告否是监控动画帧率（>3次/秒）
静音视频检查必须读取实时DOM属性（
el.muted
），而非
getAttribute('muted')
——播放器脚本通常会通过JS设置
video.muted = true
，而不会添加内容属性，因此仅检查属性会将静音广告误判为带声音的广告，且无法检测到先静音后取消静音的广告。
**注意：CBA于2025年1月14日新增了2种桌面端和2种移动端广告形式；Chrome将从2026年5月14日起开始评估这些形式。**在此日期前，请对照最新的Better Ads Standards页面重新检查新增的组合格式。
references/better-ads-tests.md
中包含自动播放视频和移动端广告密度检查的代码。

Cookie Compliance

Cookie合规性

Maintain a typed cookie inventory as the source of truth, then assert that actual cookies match it on three axes:
  • Inventory — a 
    CookieDefinition[]
    capturing name, category, purpose, max expiry, and the 
    Secure
    / 
    HttpOnly
    / 
    SameSite
    attributes each cookie must carry.
  • Attribute validation — every observed cookie must match its definition's flags and not exceed its declared max expiry. Normalize an unset 
    SameSite
    to 
    None
    before comparing — Playwright omits or varies it when the server doesn't set it, so an un-normalized check fails spuriously or passes silently.
  • Drift detection — fail the suite (
    throw
    , don't warn) when a cookie appears that is not in the inventory, forcing the inventory to stay current as scripts are added.
See 
references/cookie-compliance.md
for the typed inventory and both implementations.
维护类型化的Cookie清单作为唯一可信来源，然后从三个维度断言实际Cookie与清单匹配：
  • 清单——
    CookieDefinition[]
    数组，记录每个Cookie的名称、类别、用途、最长有效期，以及必须具备的
    Secure
    /
    HttpOnly
    /
    SameSite
    属性。
  • 属性验证——每个检测到的Cookie必须与其定义中的标志匹配，且不得超过声明的最长有效期。比较前需将未设置的
    SameSite
    属性标准化为
    None
    ——Playwright在服务器未设置该属性时会省略或返回不同值，未标准化的检查会导致误判或漏判。
  • 漂移检测——当出现清单中未收录的Cookie时，测试套件需失败（抛出错误，而非仅警告），迫使清单随脚本添加保持更新。
references/cookie-compliance.md
中包含类型化清单及两种实现方式。

Accessibility Compliance — legal map only

无障碍合规性——仅法律框架梳理

Accessibility is a legal requirement in many jurisdictions, but author the actual tests in 
accessibility-testing
(axe-core, keyboard, screen reader). This table is only the legal landscape so you know what the obligation is.
RegionLawStandardEnforcement
EUEuropean Accessibility Act (EAA)EN 301 549 / WCAG 2.1 AAApplied 28 June 2025; member-state penalties active. WCAG 2.2 alignment expected in the next EN 301 549 revision.
USAADAWCAG 2.1 AA (court precedent)Private lawsuits
USA (federal)Section 508WCAG 2.0 AAFederal procurement requirement
Canada (Ontario)AODAWCAG 2.0 AAFines up to $100K/day
UKEquality Act 2010WCAG 2.1 AA (guidance)Lawsuits
无障碍在许多司法管辖区是法律要求，但实际测试需在
accessibility-testing
技能中编写（axe-core、键盘、屏幕阅读器测试）。下表仅梳理法律框架，让您了解相关义务。
地区法律标准执行方式
欧盟欧洲无障碍法案（EAA）EN 301 549 / WCAG 2.1 AA2025年6月28日生效；成员国处罚规则已启用。预计下一次EN 301 549修订将对齐WCAG 2.2。
美国ADAWCAG 2.1 AA（法院判例）私人诉讼
美国（联邦）Section 508WCAG 2.0 AA联邦采购要求
加拿大（安大略省）AODAWCAG 2.0 AA最高每日10万美元罚款
英国2010年平等法案WCAG 2.1 AA（指导标准）诉讼

Scheduled Compliance Audits

定期合规审计

Run compliance tests weekly (not just on PR) to catch configuration drift, and retain results as long-lived CI artifacts for the audit trail. See 
references/ci-automation.md
for the scheduled GitHub Actions workflow with 90-day artifact retention.
每周运行合规测试（不仅在PR时），以发现配置漂移，并将测试结果作为长期CI工件保留，用于审计追踪。
references/ci-automation.md
中包含每周定时运行的GitHub Actions工作流配置，工件保留期限为90天。

Anti-Patterns

反模式

Testing only with consent accepted

仅测试同意接受状态

Running compliance tests only in the "all accepted" state. The compliance boundary is the "no interaction" and "rejected" states — that is where violations hide. Test every state: no interaction, accepted, rejected, partially accepted, withdrawn.
仅在「全部接受」状态下运行合规测试。合规边界存在于「无交互」和「拒绝」状态——违规行为往往隐藏于此。需测试所有状态：无交互、接受、拒绝、部分接受、撤回。

Asserting an invented CMP global

断言虚构的CMP全局变量

Checking 
window.__cmp.gpcStatus
or similar fabricated globals to "prove" a GPC opt-out. That global does not exist. Assert 
navigator.globalPrivacyControl === true
and verify marketing cookies are absent; read real consent state via 
__tcfapi
.
通过检查
window.__cmp.gpcStatus
或类似虚构全局变量来「证明」GPC退出请求已处理。该全局变量不存在。需断言
navigator.globalPrivacyControl === true
并验证营销类Cookie不存在；通过
__tcfapi
读取真实同意状态。

Attribute-only video checks

仅检查属性的视频测试

Treating 
getAttribute('muted') === null
as "has sound." The content attribute is frequently absent on programmatically-muted videos. Read 
el.muted
/ 
el.autoplay
live properties instead.
将
getAttribute('muted') === null
视为「带声音」。程序化静音的视频通常不会设置内容属性。应读取
el.muted
/
el.autoplay
实时属性。

Hardcoded cookie lists that drift

硬编码且易漂移的Cookie列表

A cookie inventory nobody updates. Use the drift-detection test that 
throw
s on any unknown cookie — reality and inventory stay in sync automatically.
无人更新的Cookie清单。使用会对未知Cookie抛出错误的漂移检测测试——自动保持实际情况与清单同步。

CMP-only testing

仅测试CMP

Trusting the CMP and only exercising its UI. CMPs have bugs. Test the outcome: cookies set, scripts loaded, data transmitted.
信任CMP且仅测试其UI。CMP可能存在漏洞。需测试结果：是否设置了Cookie、是否加载了脚本、是否传输了数据。

Manual-only quarterly audits

仅依赖人工季度审计

Auditing by hand once a quarter. Between audits a developer adds an analytics script that fires before consent and nobody notices for three months. Automated tests catch it on the next CI run.
每季度手动审计一次。审计间隔期间，开发者可能添加了在获得同意前触发的分析脚本，三个月内无人发现。自动化测试可在下次CI运行时立即发现问题。

Ignoring regional differences

忽略地区差异

One global consent model. GDPR requires opt-in; CCPA allows opt-out via GPC. Serving both regions means testing both experiences.
采用单一的全球同意模型。GDPR要求opt-in；CCPA允许通过GPC opt-out。服务两个地区需要测试两种场景。

Treating compliance as one-time

将合规视为一次性工作

Building the suite once and freezing it. Regulations evolve (ePrivacy Regulation, TCF version bumps, AI Act phases, updated CBA standards). Review quarterly.
编写一次测试套件后就不再更新。法规会演变（电子隐私条例、TCF版本升级、AI法案阶段更新、CBA标准修订）。需每季度进行回顾。

Verification

验证

Smallest check first — confirm the compliance suite runs and gates before trusting it:
bash
npx playwright test --project=chromium --grep @compliance
A correct run shows the unhappy-path tests as the gate: "no non-essential cookies before consent" and "no tracking scripts load before consent" must pass on a fresh context (
storageState: undefined
). To prove the suite actually catches violations, temporarily point it at a page that loads GA before consent — the script-blocking test must go red. A suite that stays green against a known-bad page is asserting nothing. Then confirm the GPC test sees 
navigator.globalPrivacyControl === true
with the 
Sec-GPC: 1
header set, and that the Consent Mode default-state test reports 
denied
for all four signals.
先进行最小化检查——确认合规测试套件可运行并能拦截问题后再信任它：
bash
npx playwright test --project=chromium --grep @compliance
正确运行时，非合意路径测试应作为拦截项：「获得同意前无非必要Cookie」和「获得同意前无跟踪脚本加载」必须在全新上下文（
storageState: undefined
）下通过。为证明测试套件确实能发现违规，可临时将其指向一个在获得同意前加载GA的页面——脚本拦截测试必须失败。若测试套件在已知违规的页面上仍显示通过，则说明其未起到任何验证作用。然后确认设置
Sec-GPC: 1
标头后，GPC测试能检测到
navigator.globalPrivacyControl === true
，且Consent Mode默认状态测试显示四个信号均为
denied
。

Done When

完成标准

  • Applicable regulations identified for the product and geographic audience (GDPR, ePrivacy, DSA, EU AI Act, the relevant US state-law subset, UK OSA/DUAA) and documented in 
    .agents/qa-project-context.md
    .
  • Consent flow tested for every entry point: first visit, accept, reject, withdrawal, and cross-navigation persistence — each as a distinct passing test.
  • Global Privacy Control honored: with 
    Sec-GPC: 1
    , 
    navigator.globalPrivacyControl === true
    and marketing cookies absent.
  • Google Consent Mode v2 verified: default 
    denied
    for 
    ad_storage
    / 
    analytics_storage
    / 
    ad_user_data
    / 
    ad_personalization
    ; 
    update
    fires 
    granted
    after accept (only required for sites serving Google ads in EEA/UK).
  • EU AI Act applicability assessed: prohibited-practice gate, GPAI documentation review (if applicable), and Article 50 transparency disclosure tested for any AI-generated content.
  • Cookie audit complete: all cookies categorized in the typed inventory; drift-detection test passes with zero unknown cookies.
  • No undeclared tracking domains or cookies fire that the privacy policy does not disclose (the automatable half — legal-language review is a separate manual/legal sign-off, not a test).
  • Compliance suite runs green in the weekly CI job with results stored as artifacts at 90-day retention.
  • 已针对产品和目标地域受众确定适用法规（GDPR、电子隐私指令、DSA、EU AI Act、相关美国州级法律子集、英国OSA/DUAA），并记录在
    .agents/qa-project-context.md
    中。
  • 已针对所有入口点测试同意流程：首次访问、接受、拒绝、撤回、跨导航持久性——每个场景均为独立的通过测试。
  • 已遵守Global Privacy Control：设置
    Sec-GPC: 1
    后，
    navigator.globalPrivacyControl === true
    且无营销类Cookie。
  • 已验证Google Consent Mode v2：默认状态下
    ad_storage
    /
    analytics_storage
    /
    ad_user_data
    /
    ad_personalization
    为
    denied
    ；接受后触发
    update
    信号并设为
    granted
    （仅在EEA/英国投放Google广告的网站需要）。
  • 已评估EU AI Act适用性：已设置禁止行为拦截逻辑、已审查GPAI文档（如适用）、已针对AI生成内容测试第50条透明度披露。
  • 已完成Cookie审计：所有Cookie均已在类型化清单中分类；漂移检测测试通过，无未知Cookie。
  • 未出现隐私政策未披露的未声明跟踪域名或Cookie（自动化部分——法律措辞审查为单独的人工/法务签字流程，不属于测试范畴）。
  • 合规测试套件在每周CI任务中运行通过，测试结果作为工件保留90天。

Related Skills

相关技能

  • accessibility-testing — Author the actual WCAG/axe-core/keyboard/screen-reader tests there. This skill only maps the accessibility legal landscape; it does not write a11y assertions.
  • security-testing — Security compliance (OWASP Top 10:2025, dependency and supply-chain scanning) complements privacy compliance; different threat model, different tools.
  • ai-system-testing — Defines the eval layer (hallucination, jailbreak, prompt-injection) for AI features. This skill only tests the Article 50 disclosure; that skill tests whether the AI itself behaves.
  • ci-cd-integration — Pipeline configuration for the scheduled weekly audit and compliance quality gates.
  • release-readiness — A failing compliance gate (consent firing before opt-in, missing AI Act disclosure) is a release blocker; wire this suite into the go/no-go checklist there.
  • accessibility-testing——在此编写实际的WCAG/axe-core/键盘/屏幕阅读器测试。本技能仅梳理无障碍法律框架；不编写无障碍断言。
  • security-testing——安全合规（OWASP Top 10:2025、依赖项和供应链扫描）是隐私合规的补充；威胁模型不同，工具也不同。
  • ai-system-testing——定义AI功能的评估层（幻觉、越狱、提示注入）。本技能仅测试第50条披露；该技能测试AI本身的行为。
  • ci-cd-integration——每周定时审计和合规质量门的流水线配置。
  • release-readiness——合规测试失败（如同意在opt-in前触发、缺失AI法案披露）属于发布阻塞项；需将本套件接入该技能的发布准入清单。

Reference Files (in 
references/
)

参考文件（位于
references/
目录下）

  • gdpr-cmp-tests.md — Playwright code for banners/dark patterns, cookie state before/after consent, persistence and withdrawal, third-party script blocking, Global Privacy Control (
    navigator.globalPrivacyControl
    ), TCF v2 
    __tcfapi
    consent read + v2.3 version guard, and Google Consent Mode v2.
  • eu-ai-act-tests.md — Article 50 transparency-disclosure test and the Article 5 prohibited-practice (biometric library) gate, with the Omnibus timeline note.
  • better-ads-tests.md — Coalition for Better Ads checks: live-property auto-playing-unmuted-video detection and mobile ad-density measurement.
  • cookie-compliance.md — Typed cookie inventory, attribute validation (with SameSite normalization), and inventory drift detection.
  • ci-automation.md — Scheduled weekly compliance-audit GitHub Actions workflow with 90-day artifact retention.
  • gdpr-cmp-tests.md——Playwright代码，涵盖横幅/暗模式、同意前后的Cookie状态、持久性与撤回、第三方脚本拦截、Global Privacy Control（
    navigator.globalPrivacyControl
    ）、TCF v2 
    __tcfapi
    同意读取 + v2.3版本验证、Google Consent Mode v2。
  • eu-ai-act-tests.md——第50条透明度披露测试及第5条禁止行为（生物识别库）拦截逻辑，包含综合法案时间线说明。
  • better-ads-tests.md——Better Ads联盟检查：实时属性自动播放非静音视频检测、移动端广告密度测量。
  • cookie-compliance.md——类型化Cookie清单、属性验证（含SameSite标准化）、清单漂移检测。
  • ci-automation.md——每周定时合规审计的GitHub Actions工作流配置，工件保留期限为90天。