Cookie Consent Review

Cookie Consent Review

Purpose

Organize a review of a website or app's cookie and tracking-technology consent implementation into an attorney-ready fact record. The skill inventories the trackers actually present against what the site or app discloses, describes the consent-banner mechanics as implemented, records consent-record-keeping facts, names dark-pattern indicators neutrally, notes the presence of a consent management platform (CMP) or IAB TCF-style framework as a fact (not an endorsement), and flags cross-border divergence. It produces draft legal work product for attorney review — not legal advice.

This skill never concludes that a consent implementation "is compliant," that a banner design "is" or "is not" a dark pattern, or that a given consent record satisfies any law's evidentiary requirements. Those are attorney determinations that vary by jurisdiction, regulator guidance, and the totality of the implementation. The skill organizes the facts so counsel can make that determination.

Use When

• A website or app's cookie banner, tracker inventory, or consent flow needs a first-pass legal/compliance read.
• A privacy or marketing team has run a tracker scan and needs the results compared against the cookie notice or privacy policy.
• The organization is evaluating or has just deployed a consent management platform (CMP) and wants its configuration facts organized for review.
• A regulator inquiry, complaint, or internal audit has raised a question about whether disclosed and actual tracking match, or whether the consent flow gives users a genuine choice.
• The organization operates across multiple markets and needs the site's consent mechanics checked for jurisdiction-specific divergence (for example, prior-consent vs. opt-out models, or reject-parity requirements).
• A redesign of the cookie banner or consent flow is proposed and the current-state facts need to be captured before changes are made.

Required Inputs

• The tracker inventory or scan output — a list of cookies, pixels, SDKs, and other tracking technologies actually present on the site or app, ideally from a scan tool or manual audit, including the technology name, vendor, and stated category (essential, functional, analytics, advertising, etc.), if categorized. Do not proceed on a description of "we use some cookies" alone.
• The cookie/tracking disclosure text — the cookie notice, cookie policy, or the tracking section of the privacy policy, in full.
• A description or screenshots of the consent banner — its timing (does tracking occur before a choice is made), the choices actually offered (accept all, reject all, customize, close/dismiss), the visual layout and prominence of each choice, and any pre-checked boxes or pre-selected categories.
• Consent-record-keeping facts — what the organization logs when a user makes a choice (timestamp, choice made, banner version, user/device identifier), where the record is stored, and the stated retention period for consent records.
• Optional: whether a CMP or IAB TCF-style framework is in use, and which one.
• Optional: the geographies/markets where the site or app operates, so cross-border divergence can be flagged against the actual footprint rather than assumed.
• Optional: the practice group's practice-profiles/privacy.md if populated and loaded alongside this skill. If present, use its Standard Positions and Escalation Thresholds to benchmark the review; if absent, proceed without profile benchmarking.