compliance-testing

Files (1)

• SKILL.md

SKILL.md (first lines)

<objective>
Test applications for regulatory compliance, focusing on privacy regulations (GDPR, CCPA, ePrivacy), consent management, cookie governance, and advertising standards. Compliance is binary -- you either comply or you do not -- and the penalties for non-compliance are significant. Automated testing catches configuration drift and regressions that manual audits miss between review cycles.

**Before starting:** Check for `.agents/qa-project-context.md` in the project root. It contains applicable regulations, CMP details, ad networks, and geographic requirements that determine which compliance tests to implement.
</objective>

---

## Discovery Questions

### Applicable Regulations

1. **Which privacy and platform regulations apply?**
   - **EU:** GDPR, ePrivacy Directive (cookies), Digital Services Act (DSA — applied 17 Feb 2024), EU AI Act (prohibitions + literacy from 2 Feb 2025; GPAI obligations + penalties from 2 Aug 2025; full applicability 2 Aug 2026).
   - **US:** CCPA/CPRA (California) plus comprehensive state laws now active in ~20 states — including Texas TDPSA, Indiana CDPA (eff. 1 Jan 2026), Delaware DPDPA (eff. 1 Jan 2025), Nebraska NDPA, Minnesota CDPA, Rhode Island DTPPA. Most require honoring the Global Privacy Control (`Sec-GPC: 1`) signal.
   - **UK:** UK GDPR/DPA, ePrivacy via PECR, Online Safety Act 2023, Data Use and Access Act (DUAA) replacing parts of UK GDPR/DPA.
   - **Other:** LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa).

   Multiple regulations apply simultaneously when you serve users in multiple regions. AI features layer EU AI Act obligations on top of existing privacy law.

2. **What is the legal basis for data processing?** Consent (opt-in), legitimate interest, contractual necessity? This determines whether explicit consent is required before processing.

3. **Is there a DPO or legal team to consult?** Compliance testing validates technical implementation against legal requirements. The legal team defines those requirements.

### Consent Management

4. **What CMP is in use?** OneTrust, Cookiebot (now a Usercentrics product), Didomi, Usercentrics, Iubenda, Sourcepoint, Axeptio, or custom? The CMP determines consent storage format, API, and integration patterns. **If you serve ads in the EEA or UK, you must use a Google-certified CMP and implement Google Consent Mode v2** — uncertified CMPs block Google ad serving.

5. **What consent categories exist?** Typically: Strictly Necessary (always allowed), Analytics/Performance, Functional/Preferences, Marketing/Targeting.

6. **How is consent communicated to third-party scripts?** TCF (Transparency and Consent Framework)? Custom data layer? Direct CMP API?

### Advertising and Accessibility

7. **What ad networks and formats are used?** Google Ads, Meta, programmatic? Display, video, interstitial? The Coalition for Better Ads defines acceptable formats.

8. **Are there accessibility compliance requirements?** ADA, EAA, Section 508? See the `accessibility-testing` skill for detailed WCAG testing.

---

## Core Principles

### 1. Compliance Is Binary
There is no "mostly compliant." A cookie that fires before consent is a violation. A consent banner that cannot be dismissed without accepting is a violation. Test for exact compliance.

### 2. Automate What You Can, Audit What You Cannot
Automated tests catch: cookies set before consent, scripts loading without consent, consent banner functionality, cookie attributes, consent persistence. Manual audits catch: privacy policy accuracy, legal language correctness, cross-border data transfer documentation. Automate the technical checks; schedule the legal audits.

### 3. Test From the User Perspective
Compliance regulations are written from the user's perspective. Tests should simulate real user interactions with the consent flow, not just check backend state.

### 4. Regulations Change, Tests Must Be Updatable
New regulations emerge regularly. Structure compliance tests with configuration-driven test data so that changing a threshold or adding a cookie category does not require rewriting the suite.

### 5. Defense in Depth
Do not rely solely on the CMP. Verify at multiple layers: CMP configuration, CSP headers, script loading behavior, cookie state, and network requests.

---

## GDPR/CMP Testing with Playwright

### Consent Banner and Dark Pattern Checks

```typescript
import { test, expect } from '@playwright/test';

test.describe('GDPR Consent Banner', () => {
  test.use({ storageState: undefined }); // Fresh context — first visit

  test('consent banner appears on first visit', async ({ page }) => {
    await page.goto('/');
    const banner = page.getByRole('dialog', { name: /cookie|consent|privacy/i });
    await expect(banner).toBeVisible({ timeout: 5000 });
  });

  test('banner provides accept and reject with equal prominence', async ({ page }) => {
    await page.goto('/');
    const banner = page.getByRole('dialog', { name: /cookie|consent|privacy/i });
    const acceptBtn = banner.getByRole('button', { name: /accept|agree|allow/i });
    const rejectBtn = banner.getByRole('button', { name: /reject|decline|deny/i });

    await expect(acceptBtn).toBeVisible();
    await expect(rejectBtn).toBeVisible();

    // Dark pattern check: reject button must be reasonably sized, not a tiny link
    const rejectBox = await rejectBtn.boundingBox();
    expect(rejectBox).not.toBeNull();
    expect(rejectBox!.width).toBeGreaterThan(60);
    expect(rejectBox!.height).toBeGreaterThan(30);
  });

  test('banner links to privacy policy', async ({ page }) => {
    await page.goto('/');
    const banner = page.getByRole('dialog', { name: /cookie|consent|privacy/i });
    const policyLink = banner.getByRole('link', { name: /privacy policy|learn more/i });
    await expect(policyLink).toBeVisible();
    await expect(policyLink).toHaveAttribute('href', /privacy/);
  });
});
```

### Cookie State Before and After Consent

The critical test: no non-essential cookies may be set before the user gives consent.

```typescript
// Cookie classification helpers — maintain based on your cookie inventory
function isStrictlyNecessary(name: string): boolean {
  const necessary = ['__Host-session', 'csrf_token', '__cf_bm', 'consent_status'];
  return necessary.some((n) => name.startsWith(n));
}

function isAnalyticsCookie(name: string): boolean {
  return ['_ga', '_gid', '_gat', '_gtag', 'analytics_'].some((p) => name.startsWith(p));
}

test.describe('Cookie Consent Compliance', () => {
  test.use({ storageState: undefined });

From JaiminVadadoriya/Distributed-Cloud-Storage---Sync-Platform, MIT.

More from JaiminVadadoriya/Distributed-Cloud-Storage---Sync-Platform