Automated GDPR Audit
A mass-scan platform running 24 compliance checks across 9 CMPs under 3 consent states. Handles non-deterministic banners, classifies unknown cookies, and works around anti-bot protections.
- Status
- prototype
- Year
- 2025
- Stack
- Playwright, Browserbase, LLM (Claude), Cookie analysis
Why this project
Manually checking a website’s GDPR compliance (consent banner, cookies dropped before consent, categorisation) is slow and repetitive once it has to be redone across many pages, environments or brands. The idea: build a mass-scan platform able to audit a large number of sites, with CMP coverage broad enough to stay useful under real-world conditions.
Use cases
- Running 24 compliance checks per site, covering 9 market CMPs
- Systematic verification across 3 consent states (before interaction, after acceptance, after refusal)
- Handling non-deterministic banners (position, appearance timing, A/B variants)
- Classifying unknown cookies not listed in the CMP
- Working around anti-bot protections that block standard automated browsing
How it works
A Playwright / Browserbase orchestrator drives navigation at scale, captures the cookies dropped at each consent state, and passes this context to an LLM tasked with qualifying compliance and classifying unknown cookies. Anti-bot workarounds and non-deterministic banner handling are treated as explicit special cases rather than silent exceptions, to avoid skewing the scan’s coverage rate.
What I took away
Moving from a one-off check to a mass scan changes the nature of the problem: robustness against CMP heterogeneity and anti-bot protections becomes more critical than the sophistication of the analysis itself. The LLM is reliable at qualifying ambiguous text, but only once the upstream signal (cookies actually dropped, banner state) has been made reliable.