v2.0 to v2.1

+ consent-flow testing, policy-based script blocking before consent, and cookie drift

+ version: "2.1"

+ A banner can display a rejected state while tracking continues underneath it. This skill tests consent state, policy-based request blocking, storage, GPC, Consent Mode signals, and disclosure behavior against the product's approved requirements. It delivers reproducible technical evidence; passing those checks does not establish legal compliance or CMP certification.

+ - **US:** CCPA/CPRA and the state laws applicable to the audience. Record the specific opt-out and universal-signal requirements in the regional policy matrix.

+ - **What CMP and advertising products are in use?** The CMP sets the storage format, API, and integration. Record the current certification and TCF requirements for the specific products and regions; do not infer them from a CMP API response or a numeric policy-version comparison.

+ - **Is Google Consent Mode basic or advanced, and what defaults does the regional policy require?** Basic blocks tags until consent; advanced can send permitted measurements without cookies while storage consent is denied. This changes the pre-consent network assertion. See [Google's implementation guide](https://developers.google.com/tag-platform/security/guides/consent).

+ - **What proves each consent transition has completed?** Identify an application/CMP completion signal that includes scheduled tag work. A visible banner or `networkidle` cannot establish that no delayed tracking will occur.

+ ### 1. Make the approved policy the test oracle

+ Record the expected storage, requests, signals, and UI behavior for each region and consent state. Fail deviations from that matrix. A test proves an observed technical result; legal applicability, permitted processing, and visual dark-pattern judgments require their own review.

+ Automate: policy-prohibited cookies and requests, banner functionality, cookie attributes, consent persistence, GPC, and Consent Mode signals. A human still audits privacy-policy language, banner prominence, and cross-border transfer documentation. Don't pretend a minimum button-size assertion settles those questions.

+ - **Consent banner and controls** — verify first-visit visibility, usable accept/reject controls, and the policy link. Minimum dimensions are a mechanical threshold; assess equal prominence and dark patterns separately.

+ - **Cookie state before/after consent** — enforce the approved optional-storage policy at completed initialization, acceptance, and rejection. Maintain exact necessary-cookie names and the full inventory; a prefix must not exempt similarly named tracking cookies.

+ - **Consent persistence and withdrawal** — verify the actual persisted state after navigation and the new update after withdrawal, then check storage and network effects. Use fresh contexts with `storageState: { cookies: [], origins: [] }` for first visits.

+ - **Third-party request blocking** — attach `page.on('request')` before navigation; match configured hostnames and endpoints rather than URL substrings. Basic mode can require zero tracking requests; advanced mode needs assertions for the permitted denied-state traffic. Include first-party proxies and a real completion milestone.

+ - **Global Privacy Control** — verify the HTTP header path and the DOM preference path separately. `extraHTTPHeaders: { 'Sec-GPC': '1' }` does not create `navigator.globalPrivacyControl`. Explicitly label DOM emulation, check the recorded opt-out and policy-prohibited behavior, and use a native GPC-enabled browser for browser-support verification. See the [GPC specification](https://w3c.github.io/gpc/).

+ - **TCF v2 consent state** — use `__tcfapi('addEventListener', 2, callback)`, wait for the relevant completed event, bound failures, and remove the listener. `getTCData` is deprecated. Assert configured purpose/vendor consents; a policy number does not prove TC-string validity, TCF v2.3 freshness, or certification. See the [IAB CMP API](https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md).

+ - **Google Consent Mode v2** — validate all four signals against the regional policy and preserve command ordering. Install the observer in every test and checkpoint before each action. Never seed denied defaults in a test of the app's own defaults. The shared adapter observes gtag argument arrays; object events and GTM consent-template APIs need their documented adapters. See `../analytics-tracking-testing/references/consent-mode.md` for the shared helper and basic/advanced distinction.

+ Checking `window.__cmp.gpcStatus` or similar fabricated globals to "prove" a GPC opt-out. Use the CMP's documented state or settings UI and verify the required network/storage outcome. The GPC HTTP header and DOM property are separate inputs; TCF does not define a GPC-status field.

+ ### Tests that supply the missing consent configuration

+ Pushing a denied default from `addInitScript` while testing application defaults can hide the defect. Observe the app's own commands in every test, retain late updates, and fail observation gaps or replaced data layers instead of repairing them. Pair each gate with a known-good fixture and a targeted broken variant.

+

+ npx playwright test tests/compliance --project=chromium

+ Place the adapted recipes under `tests/compliance` and configure their real readiness signal and policy inventory. First prove they pass on a known-good fixture in an explicitly empty context. Then point them at controlled broken variants: a delayed prohibited request, a missing default, an incorrect or absent post-action update, ignored GPC, and a CMP callback that never completes. Each corresponding test must fail. Verify the HTTP GPC header independently of an explicitly emulated or natively enabled DOM preference. For advanced mode in the all-denied policy, check all four defaults before measurement; for basic mode, validate defaults and updates when tags initialize after acceptance. Retain the scenarios and observation interval with the result.

+ - Global Privacy Control cases pass for the required HTTP and DOM inputs; recorded opt-out and policy-prohibited storage/requests are verified. DOM emulation is identified as emulation.

+ - Google Consent Mode's four signals and command ordering match the approved region/mode matrix; fresh action checkpoints prove accept, reject, partial consent, and withdrawal updates. The observer supplies no application consent defaults.

+ - Controlled good and broken fixtures prove each technical gate distinguishes the intended behavior; bounded timeouts and completion markers prevent silent empty observations.

+ - **gdpr-cmp-tests.md** — Playwright code for banner controls, cookie state, persistence/withdrawal, policy-based request blocking, independent GPC inputs, bounded TCF event reads, and Google Consent Mode transitions.