@cookiecrumbs-eu/mcp 0.7.0

package/dist/config/rules_reference.json

@@ -0,0 +1,569 @@
+{
+    "version": 1,
+    "generated_note": "Citation knowledge base shared by the MCP server (rules_reference, check_first_layer, explain_classification) and the dashboard Issue detail page. Every `quote` in this file was read from the cited primary source; entries where the exact wording could not be verified carry `quote: null` and a `summary` written in our own words. Nothing here is legal advice.",
+    "topics": [
+        "prior_consent",
+        "consent_definition",
+        "reject_first_layer",
+        "pre_ticked",
+        "deceptive_design",
+        "withdrawal",
+        "refusal_symmetry",
+        "cookie_wall",
+        "consent_retention",
+        "essential_cookies",
+        "legal_basis",
+        "transparency",
+        "proof",
+        "analytics",
+        "tcf",
+        "us_optout",
+        "quebec",
+        "brazil",
+        "switzerland",
+        "uk_pecr",
+        "accessibility",
+        "consent_mode"
+    ],
+    "rules": [
+        {
+            "id": "eprivacy_art_5_3",
+            "topic": "prior_consent",
+            "source": "Directive 2002/58/EC (ePrivacy Directive), Article 5(3), as substituted by Directive 2009/136/EC",
+            "source_url": "https://eur-lex.europa.eu/eli/dir/2002/58/oj",
+            "published": "2009-11-25",
+            "paragraph": "Art. 5(3)",
+            "quote": "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.",
+            "summary": "Storing or reading anything on a visitor's device needs prior consent, except for transmission or what is strictly necessary for a service the visitor explicitly asked for.",
+            "applies_to": ["preconsent_tracker", "install_unverified", "necessary_missing", "necessary_not_locked", "fallback_disabled"]
+        },
+        {
+            "id": "gdpr_art_4_11",
+            "topic": "consent_definition",
+            "source": "Regulation (EU) 2016/679 (GDPR), Article 4(11)",
+            "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+            "published": "2016-04-27",
+            "paragraph": "Art. 4(11)",
+            "quote": "‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;",
+            "summary": "Consent has to be a freely given, specific, informed and unambiguous act. Silence or a pre-set switch is not an act.",
+            "applies_to": ["default_on_non_necessary", "preconsent_tracker", "reject_not_layer1"]
+        },
+        {
+            "id": "gdpr_art_6_1_a",
+            "topic": "legal_basis",
+            "source": "Regulation (EU) 2016/679 (GDPR), Article 6(1)(a)",
+            "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+            "published": "2016-04-27",
+            "paragraph": "Art. 6(1)(a)",
+            "quote": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes;",
+            "summary": "Consent is one of the six lawful bases for processing; it is the one the ePrivacy Directive requires for non-essential storage and access.",
+            "applies_to": ["preconsent_tracker", "unclassified_tracker"]
+        },
+        {
+            "id": "gdpr_art_7_1",
+            "topic": "proof",
+            "source": "Regulation (EU) 2016/679 (GDPR), Article 7(1)",
+            "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+            "published": "2016-04-27",
+            "paragraph": "Art. 7(1)",
+            "quote": "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.",
+            "summary": "The burden of proof sits with the controller: it must be able to show that consent was given, and what the visitor was shown at the time.",
+            "applies_to": ["no_screenshots", "install_unverified", "version_missing_texts"]
+        },
+        {
+            "id": "gdpr_art_7_3",
+            "topic": "withdrawal",
+            "source": "Regulation (EU) 2016/679 (GDPR), Article 7(3)",
+            "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+            "published": "2016-04-27",
+            "paragraph": "Art. 7(3)",
+            "quote": "The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.",
+            "summary": "Withdrawal must be possible at any time and must be as easy as giving consent — which is why a permanent re-open control is required.",
+            "applies_to": ["reopen_disabled", "headless_layout"]
+        },
+        {
+            "id": "gdpr_recital_32",
+            "topic": "pre_ticked",
+            "source": "Regulation (EU) 2016/679 (GDPR), Recital 32",
+            "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+            "published": "2016-04-27",
+            "paragraph": "Recital 32",
+            "quote": "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.",
+            "summary": "Silence, pre-ticked boxes and inactivity are explicitly named as things that do not amount to consent.",
+            "applies_to": ["default_on_non_necessary", "locked_non_necessary"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p7",
+            "topic": "prior_consent",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 7",
+            "quote": "As a preliminary remark, the task force members recalled that by default, no cookies which require consent can be set without a consent and that consent must be expressed by a positive action on the part of the user.",
+            "summary": "Nothing that needs consent may be set before the visitor acts. No action means no consent.",
+            "applies_to": ["preconsent_tracker", "fallback_disabled", "regime_unknown_override", "default_on_non_necessary"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p8",
+            "topic": "reject_first_layer",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 8",
+            "quote": "When authorities were asked whether they would consider that a banner which does not provide for accept and refuse/reject/not consent options on any layer with a consent button is an infringement of the ePrivacy Directive, a vast majority of authorities considered that the absence of refuse/reject/not consent options on any layer with a consent button of the cookie consent banner is not in line with the requirements for a valid consent and thus constitutes an infringement.",
+            "summary": "A layer that carries an accept button and no refuse option is, for a vast majority of the supervisory authorities, an infringement.",
+            "applies_to": ["reject_not_layer1", "headless_layout"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p10",
+            "topic": "pre_ticked",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 10",
+            "quote": "The taskforce members confirmed that pre-ticked boxes to opt-in do not lead to valid consent as referred to either in the GDPR (see in particular recital 32 “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”) or in Article 5(3) of the ePrivacy Directive.",
+            "summary": "Pre-ticked opt-in boxes — including a category switch that starts on — never produce valid consent.",
+            "applies_to": ["default_on_non_necessary", "locked_non_necessary"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p13",
+            "topic": "deceptive_design",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 13",
+            "quote": "The members agreed that for the consent to be valid, the user should be able to understand what they consent to and how to do so. In order for a valid consent to be freely given, the taskforce members agreed that in any case a website owner must not design cookie banners in a way that gives users the impression that they have to give a consent to access the website content, nor that clearly pushes the user to give consent (one way could be on the contrary to allow the continuation of the navigation without cookies from the first level in particular for example).",
+            "summary": "A banner must not suggest that consent is compulsory to read the site, and must not push the visitor towards accepting.",
+            "applies_to": ["reject_not_layer1", "short_body", "missing_text", "contrast_button"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p14",
+            "topic": "deceptive_design",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 14",
+            "quote": "The taskforce members agreed that the following examples do not lead to valid consents (non-exhaustive list): - the only alternative action offered (other than granting consent) consists of a link behind wording such as ‘refuse’ or ‘continue without accepting’ embedded in a paragraph of text in the cookie banner, in the absence of sufficient visual support to draw an average user’s attention to this alternative action; - the only alternative action offered (other than granting consent) consists of a link behind wording such as ‘refuse’ or ‘continue without accepting’ placed outside the cookie banner where the buttons to accept cookies are presented, in the absence of sufficient visual support to draw the users’ attention to this alternative action outside the frame;",
+            "summary": "A refuse option hidden as text inside a paragraph, or placed outside the banner, is not a valid alternative to accepting.",
+            "applies_to": ["reject_not_layer1", "contrast_text", "implied_dismiss_text_missing"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p17",
+            "topic": "deceptive_design",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 17",
+            "quote": "The taskforce members agreed that a general banner standard concerning colour and/or contrast cannot be imposed on data controllers. In order to assess the conformity of a banner, a case-by-case verification must be carried out in order to check that the contrast and colours used are not obviously misleading for the users and do not result in an unintended and, as such, invalid consent from them.",
+            "summary": "There is no fixed colour standard, but colours and contrast must not mislead a visitor into an unintended consent — which is why we compare the Accept and Reject styling rather than judge either alone.",
+            "applies_to": ["contrast_button", "contrast_button_bg", "contrast_text"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p18",
+            "topic": "deceptive_design",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 18",
+            "quote": "Based on concrete examples, the taskforce members took the view that at least this practice could be manifestly misleading for users: - an alternative action is offered (other than granting consent) in the form of a button where the contrast between the text and the button background is so minimal that the text is unreadable to virtually any user.",
+            "summary": "A Reject button whose label is unreadable against its own background is called out as manifestly misleading.",
+            "applies_to": ["contrast_button", "contrast_button_bg", "contrast_text", "a11y_violation"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p24",
+            "topic": "legal_basis",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 24",
+            "quote": "In this regard, the taskforce members took the view that non-compliance found concerning Art. 5 (3) in the ePrivacy directive (in particular when no valid consent is obtained where required), means that the subsequent processing cannot be compliant with the GDPR. Also, the TF members confirmed that the legal basis for the placement/reading of cookies pursuant to Article 5 (3) cannot be the legitimate interests of the controller.",
+            "summary": "Legitimate interest cannot be used as the basis for placing or reading cookies, and an invalid consent taints everything processed afterwards.",
+            "applies_to": ["preconsent_tracker", "unclassified_tracker"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p26",
+            "topic": "essential_cookies",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 26",
+            "quote": "It appears that some controllers classify as “essential” or “strictly necessary” cookies and processing operations which use personal data and serve purposes which would not be considered as “strictly necessary” within the meaning of Article 5(3) ePrivacy Directive or the ordinary meaning of “strictly necessary” or “essential” under the GDPR.",
+            "summary": "Putting a tracker in the necessary category does not make it necessary; the label has to match the Article 5(3) meaning.",
+            "applies_to": ["necessary_not_locked", "locked_non_necessary", "unclassified_tracker"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p27",
+            "topic": "essential_cookies",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 27",
+            "quote": "Taskforce members agreed that the assessment of cookies to determine which ones are essential raises practical difficulties, in particular due to the fact that the features of cookies change regularly, which prevents the establishment of a stable and reliable list of such essential cookies.",
+            "summary": "No fixed list of essential cookies exists, because what a cookie does changes over time — the assessment has to be re-done as the site changes.",
+            "applies_to": ["unclassified_tracker", "declaration_stale"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p28",
+            "topic": "essential_cookies",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 28",
+            "quote": "The existence of tools to establish the list of cookies used by a website has been discussed, as well as the responsibility of website owners to maintain such lists, and to provide them to the competent authorities where requested and to demonstrate the « essentiality » of the cookies listed.",
+            "summary": "The site owner is responsible for keeping the cookie list current and for being able to justify every entry it calls essential.",
+            "applies_to": ["declaration_stale", "unclassified_tracker", "block_unknown_category"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p30",
+            "topic": "essential_cookies",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 30",
+            "quote": "The opinion n°04/2012 on Cookie Consent Exemption of WP 29 has also been recalled in relation to the criteria mentioned to assess which cookies are essential, and in particular the fact that cookies allowing website owners to retain the preferences expressed by users, regarding a service, should be deemed essential.",
+            "summary": "A cookie that stores the visitor's own consent choice is itself essential — which is why the consent cookie is never gated.",
+            "applies_to": ["necessary_missing", "necessary_not_locked"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p32",
+            "topic": "withdrawal",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 32",
+            "quote": "Website owners should put in place easily accessible solutions allowing users to withdraw their consent at any time, such as an icon (small hovering and permanently visible icon) or a link placed on a visible and standardized place.",
+            "summary": "A permanently reachable control — a floating icon or a link in a standard place — is the expected way to let people withdraw.",
+            "applies_to": ["reopen_disabled", "headless_layout"]
+        },
+        {
+            "id": "edpb_taskforce_2023_p34",
+            "topic": "withdrawal",
+            "source": "EDPB, Report of the work undertaken by the Cookie Banner Taskforce, adopted on 17 January 2023",
+            "source_url": "https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf",
+            "published": "2023-01-17",
+            "paragraph": "para. 34",
+            "quote": "In addition to the requirements for the collection of consent to be valid in accordance with the GDPR and under Article 5(3) ePrivacy Directive, three additional cumulative conditions are mandatory (i) the possibility to withdraw consent, (ii) the ability to withdraw consent at any time, (iii) withdrawal of consent must be as easy as to give consent.",
+            "summary": "Three cumulative conditions for withdrawal: it must be possible, available at any time, and as easy as consenting.",
+            "applies_to": ["reopen_disabled"]
+        },
+        {
+            "id": "edpb_guidelines_05_2020",
+            "topic": "consent_definition",
+            "source": "EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1",
+            "source_url": "https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf",
+            "published": "2020-05-04",
+            "paragraph": null,
+            "quote": null,
+            "summary": "The EDPB's general guidelines on consent set out what freely given, specific, informed and unambiguous mean in practice, including that consent must be separable from other terms, that scrolling or continued browsing is not an unambiguous act, and that the controller must be able to show what the person was told. We cite it as the general framework behind the taskforce report; we do not quote it here because the exact wording of the relevant passages was not verified against the PDF.",
+            "applies_to": ["default_on_non_necessary", "preconsent_tracker", "version_missing_texts", "missing_text"]
+        },
+        {
+            "id": "cnil_reco_2026_refusal_same_simplicity",
+            "topic": "refusal_symmetry",
+            "source": "CNIL, Recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux « cookies et autres traceurs » — version consolidée (délibérations n° 2020-092 and n° 2025-131), § 2.3 « S'agissant des modalités du refus »",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "Le responsable de traitement doit offrir aux utilisateurs tant la possibilité d’accepter que de refuser les opérations de lecture et/ou d’écriture avec le même degré de simplicité.",
+            "summary": "Accepting and refusing must be offered with the same degree of simplicity.",
+            "applies_to": ["reject_not_layer1", "contrast_button"]
+        },
+        {
+            "id": "cnil_reco_2026_refusal_same_screen",
+            "topic": "refusal_symmetry",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 2.3 « S'agissant des modalités du refus »",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "Ainsi, la Commission recommande fortement que le mécanisme permettant d’exprimer un refus de consentir aux opérations de lecture et/ou d’écriture soit accessible sur le même écran et avec la même facilité que le mécanisme permettant d’exprimer un consentement.",
+            "summary": "The refusal control should sit on the same screen, and be as easy to use, as the consent control — one click to accept must not be answered by several clicks to refuse.",
+            "applies_to": ["reject_not_layer1"]
+        },
+        {
+            "id": "cnil_reco_2026_global_buttons",
+            "topic": "refusal_symmetry",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 2.3",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "Par exemple, au stade du premier niveau d’information, les utilisateurs peuvent avoir le choix entre deux boutons présentés au même niveau et sur le même format, sur lesquels sont inscrits respectivement « tout accepter » et « tout refuser », « autoriser » et « interdire », ou « consentir » et « ne pas consentir », ou toute autre formulation équivalente et suffisamment claire.",
+            "summary": "Two buttons on the first layer, at the same level and in the same format — Accept all and Reject all — is the pattern the CNIL describes as simple and clear.",
+            "applies_to": ["reject_not_layer1", "contrast_button", "contrast_button_bg"]
+        },
+        {
+            "id": "cnil_reco_2026_deceptive_design",
+            "topic": "deceptive_design",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 2.3",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "Afin de ne pas induire en erreur les utilisateurs, la Commission recommande que les responsables de traitement s’assurent que les interfaces de recueil des choix n’intègrent pas de pratiques de design potentiellement trompeuses laissant penser aux utilisateurs que leur consentement est obligatoire ou qui mettent visuellement plus en valeur un choix plutôt qu’un autre. Il est recommandé d’utiliser des boutons et une police d’écriture de même taille, offrant la même facilité de lecture, et mis en évidence de manière identique.",
+            "summary": "Buttons should be the same size, equally readable and equally emphasised; nothing may suggest that consent is compulsory.",
+            "applies_to": ["contrast_button", "contrast_button_bg", "contrast_text", "a11y_violation"]
+        },
+        {
+            "id": "cnil_reco_2026_close_window_refusal",
+            "topic": "refusal_symmetry",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 2.3",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "En particulier, lorsque le refus peut être manifesté par la simple fermeture de la fenêtre de recueil du consentement ou encore par l’absence d’interaction avec celle-ci pendant un certain laps de temps, cette possibilité doit être clairement indiquée aux utilisateurs sur cette fenêtre.",
+            "summary": "If closing the banner or ignoring it counts as a refusal, the banner itself has to say so.",
+            "applies_to": ["implied_dismiss_text_missing", "missing_text"]
+        },
+        {
+            "id": "cnil_reco_2026_retention_six_months",
+            "topic": "consent_retention",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 2.3 « S'agissant de la conservation des choix »",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 2.3",
+            "quote": "Au regard de ces éléments, la Commission considère, de manière générale, que conserver ces choix (tant le consentement que le refus) pendant une durée de 6 mois constitue une bonne pratique de la part des éditeurs.",
+            "summary": "Keeping both the consent and the refusal for about six months before asking again is described as good practice.",
+            "applies_to": ["fallback_disabled"]
+        },
+        {
+            "id": "cnil_reco_2026_withdrawal_icon",
+            "topic": "withdrawal",
+            "source": "CNIL, Recommandation « cookies et autres traceurs » — version consolidée, § 3 « Retrait et gestion du consentement »",
+            "source_url": "https://www.cnil.fr/sites/default/files/2026-01/recommandation_cookies_consolidee.pdf",
+            "published": "2026-01-16",
+            "paragraph": "§ 3",
+            "quote": "L’éditeur d’un site web peut également fournir aux utilisateurs un module de paramétrage accessible sur toutes les pages du site au moyen d’une icône « cookie », située par exemple en bas à gauche de l’écran, leur permettant d’accéder au mécanisme de gestion et de retrait de leur consentement.",
+            "summary": "A settings module reachable from every page — for example through a persistent cookie icon — is the CNIL's illustration of an accessible withdrawal mechanism.",
+            "applies_to": ["reopen_disabled", "headless_layout"]
+        },
+        {
+            "id": "cnil_cookie_wall_definition",
+            "topic": "cookie_wall",
+            "source": "CNIL, « Cookie walls » : la CNIL publie des premiers critères d'évaluation",
+            "source_url": "https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premiers-criteres-devaluation",
+            "published": "2022-05-16",
+            "paragraph": null,
+            "quote": "L’expression « mur de traceur », ou « cookie wall » en anglais, désigne le fait de conditionner l’accès à un service à l’acceptation, par l’internaute, du dépôt de certains traceurs sur son terminal (ordinateur, smartphone, etc.).",
+            "summary": "A cookie wall makes access to a service conditional on accepting trackers.",
+            "applies_to": ["reject_not_layer1"]
+        },
+        {
+            "id": "cnil_cookie_wall_legality",
+            "topic": "cookie_wall",
+            "source": "CNIL, « Cookie walls » : la CNIL publie des premiers critères d'évaluation",
+            "source_url": "https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premiers-criteres-devaluation",
+            "published": "2022-05-16",
+            "paragraph": null,
+            "quote": "Si l’exigence d’un consentement « libre » n’entraîne pas une interdiction générale de la pratique des cookie walls, leur légalité doit être appréciée en tenant notamment compte de l’existence d’alternative(s) réelle(s) et satisfaisante(s) proposée(s) en cas de refus des traceurs.",
+            "summary": "Cookie walls are not banned outright, but their lawfulness turns case by case on whether a real and satisfactory alternative exists for someone who refuses. CookieCrumbs never renders a wall itself; this entry exists so the question is answered from the source rather than from opinion.",
+            "applies_to": ["reject_not_layer1"]
+        },
+        {
+            "id": "ico_sat_statistical_purposes",
+            "topic": "analytics",
+            "source": "ICO, Guidance on the use of storage and access technologies — What are the exceptions? (statistical purposes exception)",
+            "source_url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/",
+            "published": "2026-04-01",
+            "paragraph": "Statistical purposes exception",
+            "quote": "The statistical purposes exception enables you to understand how visitors interact with your service. Provided your use of storage and access technologies for this purpose is in line with the exception, you don’t need to get consent under PECR.",
+            "summary": "Under PECR as amended by the Data (Use and Access) Act 2025 there is a statistical-purposes exception, so some first-party measurement can run without consent in the UK — but only inside the exception's limits.",
+            "applies_to": ["preconsent_tracker", "regime_unknown_override"]
+        },
+        {
+            "id": "ico_sat_statistical_conditions",
+            "topic": "analytics",
+            "source": "ICO, Guidance on the use of storage and access technologies — What are the exceptions?",
+            "source_url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/",
+            "published": "2026-04-01",
+            "paragraph": "Statistical purposes exception",
+            "quote": "To rely on the exception, you must only use the storage and access technologies for the purpose of improving your service or website, and not for any other purposes. This is the case whether you store or access information for this purpose, or whether you use a third party, such as an analytics provider to do this for you. You must ensure that the information resulting from the storage or access is aggregate statistical information that you cannot use to identify people.",
+            "summary": "The exception only holds if the measurement is used solely to improve the service and produces aggregate information that cannot identify people — using a third-party analytics provider does not change that test.",
+            "applies_to": ["preconsent_tracker", "unclassified_tracker"]
+        },
+        {
+            "id": "ico_sat_statistical_not_tracking",
+            "topic": "analytics",
+            "source": "ICO, Guidance on the use of storage and access technologies — What are the exceptions?",
+            "source_url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/",
+            "published": "2026-04-01",
+            "paragraph": "Using web analytics tools to monitor or track people",
+            "quote": "The statistical purposes exception does not allow you to monitor or track individual visitors to your service.",
+            "summary": "Anything that follows an individual — session recording, conversion IDs shared with advertising partners, profiling by IP or pages visited — falls outside the exception and needs consent.",
+            "applies_to": ["preconsent_tracker", "consent_mode_mismatch"]
+        },
+        {
+            "id": "ico_pecr_anonymous_data",
+            "topic": "analytics",
+            "source": "ICO, Guide to PECR — Cookies and similar technologies",
+            "source_url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/",
+            "published": "2019-07-03",
+            "paragraph": "Do the rules still apply if the data is anonymous?",
+            "quote": "Yes. Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies.",
+            "summary": "PECR is about storage on the device, not about whether the data is personal — \"it's anonymous analytics\" is not by itself an answer.",
+            "applies_to": ["preconsent_tracker"]
+        },
+        {
+            "id": "ico_pecr_strictly_necessary",
+            "topic": "essential_cookies",
+            "source": "ICO, Guide to PECR — Cookies and similar technologies",
+            "source_url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/",
+            "published": "2019-07-03",
+            "paragraph": "Are there any exemptions?",
+            "quote": "the cookie is strictly necessary to provide an ‘information society service’ (eg a service over the internet) requested by the subscriber or user. Note that it must be essential to fulfil their request – cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent.",
+            "summary": "Convenient is not essential, and essential-for-the-operator is not essential-for-the-visitor.",
+            "applies_to": ["necessary_not_locked", "locked_non_necessary", "unclassified_tracker"]
+        },
+        {
+            "id": "tcf_v5_ui_default_off",
+            "topic": "tcf",
+            "source": "IAB Europe, Transparency & Consent Framework Policies, Version 2026-05-29.5.0.b, Appendix B (User Interface Requirements), Policy C(d)",
+            "source_url": "https://iabeurope.eu/wp-content/uploads/TCF-Policies-TransparencyConsentFramework_Policies_Version-2026-05-29.5.0.b.docx.pdf",
+            "published": "2026-05-29",
+            "paragraph": "Appendix B, Policy C(d)",
+            "quote": "When a user accesses a layer, which will be a secondary layer when using a layered approach, allowing them to make granular and specific consent choices with respect to each Purpose, under Policy C(c)(III), and/or to make granular and specific opt-in choices with respect to each Special Feature under Policy C(c)(IV) the default choice must be \"no consent\", \"no opt-in\" or \"off\".",
+            "summary": "In a TCF UI every purpose and special feature toggle must start off.",
+            "applies_to": ["default_on_non_necessary", "locked_non_necessary"]
+        },
+        {
+            "id": "tcf_v5_ui_resurface",
+            "topic": "tcf",
+            "source": "IAB Europe, Transparency & Consent Framework Policies, Version 2026-05-29.5.0.b, Appendix B, Policy C(f)",
+            "source_url": "https://iabeurope.eu/wp-content/uploads/TCF-Policies-TransparencyConsentFramework_Policies_Version-2026-05-29.5.0.b.docx.pdf",
+            "published": "2026-05-29",
+            "paragraph": "Appendix B, Policy C(f)",
+            "quote": "A user must be able to resurface the Framework UI from an easily accessible link or call to action, such as a floating icon or a footer link available on each webpage of the Publisher's website, or from the top-level settings of the Publisher's app as to allow them to withdraw their consent as easily as it was to give it.",
+            "summary": "A TCF CMP must be re-openable from every page, and if the first layer offered a Consent to all, the re-opened UI must offer an equivalent Withdraw consent to all.",
+            "applies_to": ["reopen_disabled", "headless_layout"]
+        },
+        {
+            "id": "tcf_v5_ui_contrast",
+            "topic": "tcf",
+            "source": "IAB Europe, Transparency & Consent Framework Policies, Version 2026-05-29.5.0.b, Appendix B, Policy C(g)",
+            "source_url": "https://iabeurope.eu/wp-content/uploads/TCF-Policies-TransparencyConsentFramework_Policies_Version-2026-05-29.5.0.b.docx.pdf",
+            "published": "2026-05-29",
+            "paragraph": "Appendix B, Policy C(g)",
+            "quote": "Calls to action in a Framework UI must not be invisible, illegible, or appear disabled. While calls to action do not need to be identical, to ensure they are clearly visible, they must have matching text treatment (font, font size, font style) and, for the text of each, a minimum contrast ratio of 5 to 1.",
+            "summary": "TCF sets a hard floor: matching text treatment on the two primary calls to action and at least 5:1 text contrast — stricter than WCAG AA's 4.5:1.",
+            "applies_to": ["contrast_button", "contrast_text", "a11y_violation"]
+        },
+        {
+            "id": "qc_law25_s8_1",
+            "topic": "quebec",
+            "source": "Act respecting the protection of personal information in the private sector (Quebec), CQLR c P-39.1, section 8.1 (added by 2021, c. 25 — Law 25)",
+            "source_url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1",
+            "published": "2023-09-22",
+            "paragraph": "s. 8.1",
+            "quote": "In addition to the information that must be provided in accordance with section 8, any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified, located or profiled must first inform the person (1) of the use of such technology; and (2) of the means available to activate the functions that allow a person to be identified, located or profiled.",
+            "summary": "Technology that can identify, locate or profile has to be disclosed first, together with the means to activate it — which implies it is off until the person turns it on.",
+            "applies_to": ["qc_settings_text_missing", "default_on_non_necessary", "missing_text"]
+        },
+        {
+            "id": "qc_law25_s9_1",
+            "topic": "quebec",
+            "source": "Act respecting the protection of personal information in the private sector (Quebec), CQLR c P-39.1, section 9.1 (added by 2021, c. 25 — Law 25)",
+            "source_url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1",
+            "published": "2023-09-22",
+            "paragraph": "s. 9.1",
+            "quote": "Any person carrying on an enterprise who collects personal information when offering to the public a technological product or service having privacy settings must ensure that those settings provide the highest level of confidentiality by default, without any intervention by the person concerned. The first paragraph does not apply to privacy settings for browser cookies.",
+            "summary": "Highest confidentiality by default — note the express carve-out for browser cookie settings, which is why the Quebec regime rests on s. 8.1 rather than on s. 9.1 for cookies.",
+            "applies_to": ["qc_settings_text_missing", "default_on_non_necessary"]
+        },
+        {
+            "id": "ccpa_7025_b_signal_format",
+            "topic": "us_optout",
+            "source": "California Code of Regulations, Title 11, § 7025(b) — Opt-Out Preference Signals",
+            "source_url": "https://www.law.cornell.edu/regulations/california/11-CCR-7025",
+            "published": "2023-03-29",
+            "paragraph": "§ 7025(b)",
+            "quote": "A business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing: (1) The signal shall be in a format commonly used and recognized by businesses. An example would be an HTTP header field or JavaScript object.",
+            "summary": "Global Privacy Control — the Sec-GPC header and navigator.globalPrivacyControl — is a valid opt-out request that has to be processed.",
+            "applies_to": ["us_link_text_missing", "consent_mode_mismatch"]
+        },
+        {
+            "id": "ccpa_7025_f_frictionless",
+            "topic": "us_optout",
+            "source": "California Code of Regulations, Title 11, § 7025(f) — processing an opt-out preference signal in a frictionless manner",
+            "source_url": "https://www.law.cornell.edu/regulations/california/11-CCR-7025",
+            "published": "2023-03-29",
+            "paragraph": "§ 7025(f)",
+            "quote": "Except as allowed by these regulations, processing an opt-out preference signal in a frictionless manner as required by Civil Code section 1798.135, subdivision (b)(1), means that the business shall not: (1) Charge a fee or require any valuable consideration if the consumer uses an opt-out preference signal. (2) Change the consumer's experience with the product or service offered by the business. (3) Display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial content in response to the opt-out preference signal.",
+            "summary": "Frictionless means no fee, no degraded experience and no interstitial in response to the signal — a modal thrown up because GPC was seen breaks it. Showing whether the visitor has opted out is expressly not a violation, which is why the runtime uses a non-blocking status chip.",
+            "applies_to": ["us_link_text_missing", "headless_layout"]
+        },
+        {
+            "id": "ccpa_7025_e_link_or_frictionless",
+            "topic": "us_optout",
+            "source": "California Code of Regulations, Title 11, § 7025(e)",
+            "source_url": "https://www.law.cornell.edu/regulations/california/11-CCR-7025",
+            "published": "2023-03-29",
+            "paragraph": "§ 7025(e)",
+            "quote": "They do not give the business the choice between posting the above-referenced links or honoring opt-out preference signals. Even if the business posts the above-referenced links, the business must still process opt-out preference signals, though it may do so in a non-frictionless manner.",
+            "summary": "The \"Do Not Sell or Share My Personal Information\" link and honouring the signal are not alternatives: the signal must always be processed; only the link becomes optional if the signal is handled frictionlessly.",
+            "applies_to": ["us_link_text_missing"]
+        },
+        {
+            "id": "wcag22_sc_1_4_3",
+            "topic": "accessibility",
+            "source": "W3C, Web Content Accessibility Guidelines (WCAG) 2.2, Success Criterion 1.4.3 Contrast (Minimum), Level AA",
+            "source_url": "https://www.w3.org/TR/WCAG22/#contrast-minimum",
+            "published": "2023-10-05",
+            "paragraph": "SC 1.4.3",
+            "quote": "The visual presentation of text and images of text has a contrast ratio of at least 4.5:1, except for the following: Large Text Large-scale text and images of large-scale text have a contrast ratio of at least 3:1;",
+            "summary": "The AA contrast floor the banner theme is linted against.",
+            "applies_to": ["contrast_text", "contrast_button", "contrast_button_bg", "a11y_violation"]
+        },
+        {
+            "id": "wcag22_sc_2_5_8",
+            "topic": "accessibility",
+            "source": "W3C, Web Content Accessibility Guidelines (WCAG) 2.2, Success Criterion 2.5.8 Target Size (Minimum), Level AA",
+            "source_url": "https://www.w3.org/TR/WCAG22/#target-size-minimum",
+            "published": "2023-10-05",
+            "paragraph": "SC 2.5.8",
+            "quote": "The size of the target for pointer inputs is at least 24 by 24 CSS pixels, except when: Spacing Undersized targets (those less than 24 by 24 CSS pixels) are positioned so that if a 24 CSS pixel diameter circle is centered on the bounding box of each, the circles do not intersect another target or the circle for another undersized target;",
+            "summary": "Banner controls, including the re-open icon, must meet the 24×24 CSS pixel target floor or the spacing exception.",
+            "applies_to": ["a11y_violation", "reopen_disabled"]
+        },
+        {
+            "id": "anpd_br_cookies_guide",
+            "topic": "brazil",
+            "source": "ANPD (Brazil), Guia orientativo sobre cookies e proteção de dados pessoais",
+            "source_url": "https://www.gov.br/anpd/pt-br",
+            "published": "2022-10-01",
+            "paragraph": null,
+            "quote": null,
+            "summary": "The Brazilian authority's cookie guide expects a first layer in Portuguese with concise purposes, an accept-all and a reachable reject, granular management, withdrawal as easy as consent, and a cookie policy listing the trackers. Legitimate interest can cover some first-party measurement that does not build cross-site profiles. We have not verified the exact Portuguese wording, so no quote is given.",
+            "applies_to": ["reject_not_layer1", "missing_text", "no_default_lang", "declaration_stale"]
+        },
+        {
+            "id": "fdpic_ch_cookie_guidance",
+            "topic": "switzerland",
+            "source": "FDPIC (EDÖB), Leitfaden betreffend Datenbearbeitungen mittels Cookies und ähnlichen Technologien, V. 1.1",
+            "source_url": "https://www.edoeb.admin.ch/de",
+            "published": "2025-10-06",
+            "paragraph": null,
+            "quote": null,
+            "summary": "Switzerland's baseline under Art. 45c FMG is inform-and-opt-out, but the FDPIC treats profiling, cross-site tracking and unexpected or high-risk processing as needing opt-in equivalent to the GDPR, and dark patterns invalidate consent either way. We have not verified the exact German wording, so no quote is given.",
+            "applies_to": ["regime_unknown_override", "default_on_non_necessary"]
+        },
+        {
+            "id": "uk_duaa_2025_schedule_a1",
+            "topic": "uk_pecr",
+            "source": "Data (Use and Access) Act 2025 — new Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003",
+            "source_url": "https://www.legislation.gov.uk/ukpga/2025/18/contents",
+            "published": "2025-06-19",
+            "paragraph": "Schedule A1",
+            "quote": null,
+            "summary": "The Act adds consent exceptions to PECR regulation 6, including statistical purposes and user-chosen appearance or functionality preferences, each conditional on clear information and a simple, free means to object. We summarise rather than quote because the exact statutory wording as commenced was not verified against legislation.gov.uk; the ICO's guidance entries above carry the verified wording of the statistical-purposes test.",
+            "applies_to": ["preconsent_tracker", "regime_unknown_override", "block_unknown_category"]
+        },
+        {
+            "id": "google_consent_mode_signals",
+            "topic": "consent_mode",
+            "source": "Google, Consent mode (tag platform developer documentation)",
+            "source_url": "https://developers.google.com/tag-platform/security/guides/consent",
+            "published": "2024-03-06",
+            "paragraph": null,
+            "quote": null,
+            "summary": "Google tags read ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage and security_storage. Mapping a category to the wrong signal — most damagingly sending granted ad_storage for a visitor who refused marketing — leaks data to Google Ads and contradicts the recorded choice. We do not quote the vendor documentation because its wording changes without notice; the compliance point is carried by the EDPB and ICO entries.",
+            "applies_to": ["consent_mode_mismatch", "gcm_advanced_unverified"]
+        }
+    ]
+}