Audits A/B tests of cookie consent banners for GDPR/CNIL compliance, ensuring equal accept/reject ease and detecting dark patterns like visual asymmetry.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
A/B testing consent banners is a common practice to optimize consent rates. However, when these experiments manipulate users into consenting through design asymmetry, deceptive patterns, or unequal ease of acceptance versus rejection, they violate GDPR Article 7 and ePrivacy Directive Article 5(3). The CNIL has been the most active enforcer, issuing a EUR 150 million fine to Google (January 202...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
A/B testing consent banners is a common practice to optimize consent rates. However, when these experiments manipulate users into consenting through design asymmetry, deceptive patterns, or unequal ease of acceptance versus rejection, they violate GDPR Article 7 and ePrivacy Directive Article 5(3). The CNIL has been the most active enforcer, issuing a EUR 150 million fine to Google (January 2022) and a EUR 60 million fine to Meta (January 2022) specifically for consent banner design violations.
CNIL Deliberation No. 2020-091 (September 17, 2020) and EDPB Guidelines 05/2020 establish:
| Authority | Target | Fine | Date | Key Finding |
|---|---|---|---|---|
| CNIL | Google LLC | EUR 150,000,000 | January 6, 2022 | google.fr: accepting cookies required 1 click; rejecting required multiple clicks through secondary menu |
| CNIL | Meta Platforms Ireland | EUR 60,000,000 | January 6, 2022 | facebook.com: "Accept Cookies" button prominently displayed; "Refuse" buried in secondary layer |
| CNIL | Microsoft Ireland | EUR 60,000,000 | December 22, 2022 | bing.com: "Accept" button displayed without equally visible "Refuse" |
| CNIL | TikTok | EUR 5,000,000 | December 29, 2022 | tiktok.com: rejecting cookies more complex than accepting; insufficient information |
| Italian Garante | Clearview AI | EUR 20,000,000 | March 9, 2022 | No valid consent mechanism for biometric data processing |
What to check:
Measurement:
What to check:
CNIL standard: A "Refuse All" button must be available on the same layer and with the same prominence as the "Accept All" button.
What to check:
Examples of non-compliant language:
What to check:
What to check:
What can be legitimately tested:
| Permitted Tests | Prohibited Tests |
|---|---|
| Banner position (top vs bottom) | Accept button larger than reject button |
| Color scheme (both buttons same treatment) | Accept button more prominent than reject |
| Text wording (both options equally neutral) | Additional clicks required to reject |
| Layout arrangement (if equal prominence maintained) | Pre-selecting consent purposes in one variant |
| Icon usage (same for both options) | Cookie wall in any variant |
| Animation/transition style | Accept-only first layer with reject buried |
| Privacy information presentation format | Discouraging language for reject option |
For each active consent banner experiment:
For each variant, score against the 5 categories:
| Category | Weight | Score (0-10) | Notes |
|---|---|---|---|
| Visual Asymmetry | 25% | 0 = equal, 10 = extreme asymmetry | |
| Interaction Asymmetry | 30% | 0 = equal clicks, 10 = many more clicks to reject | |
| Language Manipulation | 20% | 0 = neutral, 10 = strongly manipulative | |
| Timing/Delay | 15% | 0 = no delays, 10 = significant delays on reject | |
| Repeated Prompting | 10% | 0 = respects choice, 10 = constant nagging |
Overall Risk Score: Weighted sum. Score above 3.0 requires remediation. Score above 5.0 requires immediate removal.
If a variant achieves significantly higher consent rates through design asymmetry rather than improved information, this is evidence of manipulation:
Generate audit report with: