Chapter 10 — Privacy and data protection: control configuration
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Cookies and consent"]
N2["10.2 The cookie lab"]
N3["10.3 Fixing the configuration"]
N4["10.4 Verifying the change"]
N5["Lab — Cookies set before consent"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Cookies and consent"]
N2["10.2 The cookie lab"]
N3["10.3 Fixing the configuration"]
N4["10.4 Verifying the change"]
N5["Lab — Cookies set before consent"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Cookies and consent]
|
v
[10.2 The cookie lab]
|
v
[10.3 Fixing the configuration]
|
v
[10.4 Verifying the change]
|
v
[Lab — Cookies set before consent]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) check cookie behaviour on a website; (2) configure consent correctly; (3) verify configuration changes.
10.1 Cookies and consent
Marlow's booking website sets cookies and similar technologies. Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a user's device, unless it is strictly necessary for a service the user requested. EDPB Guidelines 05/2020 explain that consent must be freely given, specific, informed and unambiguous. Leila's task is technical: check which cookies the site actually sets, when they are set and whether the consent banner controls them as the privacy notice claims. Cookies that only remember a visitor's chosen settings may be exempt, but only after the visitor has made that choice.
10.2 The cookie lab
Leila loads the site in a clean browser profile, records cookies before interacting with the banner and repeats after accepting. The lab summarises her synthetic results: seven cookies, of which three are set before consent without an exemption. The analytics cookie and an advertising pixel load immediately. A language cookie is also set automatically before the visitor has chosen a language, so it is not clearly necessary for a service the visitor requested. The session and security token cookies are strictly necessary and correctly load immediately.
10.3 Fixing the configuration
The website uses a tag manager to load scripts. Leila works with the web developer to set the analytics and advertising tags to fire only after consent is recorded, and to set the language cookie only when a visitor selects a language. The banner is changed so that refusing is as easy as accepting, with buttons of equal size on the first layer. The advertising pixel is removed altogether, because Marlow does not run advertising campaigns that need it and nobody could explain why it was installed.
10.4 Verifying the change
Leila repeats the test in a clean profile after the change. Before consent, only the session and security cookies appear. After refusing, no analytics cookies appear, even after browsing several pages. After accepting, analytics loads as expected. She records the results with dates and browser versions. She also adds the test to the release checklist, because website changes and new plugins often reintroduce tags that load before consent, and a quick repeat test catches this before patients are affected. Screenshots show each cookie list.
Lab — Cookies set before consent
"""Check which cookies a synthetic booking site sets before consent (stdlib only)."""
cookies = [
("session_id", "strictly necessary", "before"),
("csrf_token", "strictly necessary", "before"),
("lang", "functional", "before"),
("_ga", "analytics", "before"),
("_fbp", "advertising", "before"),
("chat_widget", "functional", "after"),
("ab_test", "analytics", "after"),
]
bad = [c for c in cookies if c[2] == "before" and c[1] not in ("strictly necessary",)]
for n, cat, when in cookies:
flag = "PROBLEM" if (n, cat, when) in bad else "ok"
print(f"{n:12s} {cat:19s} set {when:6s} consent {flag}")
print(f"cookies set before consent without exemption: {len(bad)} of {len(cookies)}")
Run with python3 lab_cookies.py. Verified output:
session_id strictly necessary set before consent ok
csrf_token strictly necessary set before consent ok
lang functional set before consent PROBLEM
_ga analytics set before consent PROBLEM
_fbp advertising set before consent PROBLEM
chat_widget functional set after consent ok
ab_test analytics set after consent ok
cookies set before consent without exemption: 3 of 7
Worked example
Leila finds three of seven cookies set before consent without exemption, has tags fire only after consent, removes an unused advertising pixel, equalises banner buttons and verifies with a clean profile.
Synthetic case. The website is synthetic; Directive 2002/58/EC Article 5(3) and EDPB Guidelines 05/2020 are real.
Errors and limits
Cookie names do not prove purpose; check what each script actually does.
Exercises
- EX037 — Before consent. How many cookies were set before consent without exemption? Rubric: 3 = 3 of 7;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX038 — Language cookie. Why was the language cookie a problem? Rubric: 3 = set before the visitor chose a language;; 2 = mentions choice;; 1 = vague;; 0 = none.
- EX039 — Pixel decision. What happened to the advertising pixel? Rubric: 3 = removed; nobody needed it;; 2 = mentions removal;; 1 = delayed;; 0 = none.
- EX040 — Release check. Why add the cookie test to the release checklist? Rubric: 3 = changes often reintroduce early tags;; 2 = mentions regressions;; 1 = vague;; 0 = none.
Continue studying — lesson 10 (chapter 10 of 18)
← Chapter 09 · Course chapter index · Chapter 11 →
Continue to the next authored lesson.