INFRA Signal 148
Dropbox automates cookie-banner compliance with an auditor that simulates user privacy choices
↗
Dropbox built an in-house cookie auditor that visits its web pages as a privacy-conscious user to verify that only cookies matching the user's stated preferences are loaded.
Manual QA across hundreds of web surfaces is unsustainable, so this tool automates verification of cookie consent behavior. It also respects GPC signals, making it relevant for evolving privacy standards. However, it requires translating legal concepts into machine-testable rules, which is a significant engineering effort.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Dropbox's cookie auditor simulates a privacy-conscious user to check that web pages load only cookies consistent with that user's preferences.
The auditor must handle over 200 web surfaces, changing URLs, and GPC signals, making compliance testing complex.
Privacy requirements are encoded as testable rules outside the auditor's source code, letting the Privacy team update approved cookies without code changes.
THE CLUSTER