consent

Overview ¶

Package consent audits how a site asks for, and behaves before, visitor consent to tracking. It answers two questions a GDPR/ePrivacy review always asks.

**Is consent asked for correctly?** The analyzer detects the consent management platform (CMP) in use and inspects the site's Google Consent Mode configuration: whether the v2 signals Google has required since March 2024 are declared, whether tracking storage is granted by default (which defeats the mechanism), whether the defaults are declared before the tag loader runs, and whether `wait_for_update` gives an async CMP time to answer first.

**Is it respected?** This is the part a static review misses, and it works because of a property of the crawl itself: gocrawl never clicks a consent banner. Every page it fetches is therefore a visit by someone who has consented to nothing, and whatever the site sets or sends during that visit is its pre-consent behaviour. The analyzer reads two records of it:

• Cookies. In headless mode the browser's cookie jar is captured after the page settles, which sees JavaScript-set and third-party cookies — where nearly all tracking lives. In raw mode only `Set-Cookie` response headers are visible, so the check still runs but catches only server-set cookies (see the docs for what that misses).
• Network beacons. In headless mode the render records outbound requests, so a call to a measurement endpoint before any consent is direct evidence that tags fired early.

The analyzer is passive: it reads what the crawl already fetched and never interacts with a banner, clicks "accept", or sends probes of its own.

Consent configuration lives in the shared template, so findings are aggregated and emitted once per host rather than repeating on every page. This is an engineering signal, not legal advice — whether a given cookie is lawful depends on context the crawler cannot see.