Our cookie auditor acts like a privacy-conscious user by visiting web pages and checking that they only load cookies consistent with that user’s preferences.
Dropbox manages over 200 web surfaces, but a cookie banner that looks perfectly functional can quietly stop respecting user choices the moment someone deploys a minor experiment or page update. 👇
When users decline non-essential cookies, websites must actually block tracking scripts and remember that choice across page reloads. Manually checking every page, localized variant, and privacy standard required hours of tedious QA, and newly launched pages were constantly slipping through the cracks.
To solve this, Dropbox built an in-house automated cookie auditor using Playwright, paired with a companion URL detector that scans traffic logs to discover active pages.
The system tests pages by simulating real user visits rather than inspecting static code configurations. To keep rules flexible, the Privacy team maintains approved cookie classifications outside the application source code, allowing policy updates without requiring new engineering releases.
For every discovered page, the auditor spins up clean browser sessions and executes three distinct tests: a US visitor, an EU visitor, and a user with Global Privacy Control (GPC) enabled.
The mechanism follows a strict sequence: - Initial capture: Playwright opens a fresh session with zero saved state → records cookies loaded before interaction → checks them against expected defaults. - Element interaction: Rather than searching for text like "Decline" across 22 supported languages, the tool identifies and interacts with the underlying DOM consent controls. - Opt-out execution: The auditor declines non-essential cookies. - Reload verification: It reloads the page → checks if non-essential cookies were blocked → confirms preferences persist after the refresh.
To keep the test list complete, the companion URL detector searches through billions of raw traffic records. It filters out duplicate paths, groups identical page templates, and isolates a clean set of representative URLs for the auditor to check.
The system now delivers a weekly report to Engineering and Privacy teams. It separates true violations from known false positives, giving teams continuous verification across all active web surfaces.
NayaRead shows a summary and links to the original article. The full article is hosted on dropbox.tech.