Testing cookie behavior across hundreds of web surfaces with our in-house auditor

Summary

Maintaining cookie consent behavior across more than 200 web surfaces is difficult because URLs, integrations, experiments, languages, and page settings change over time. Dropbox built an in-house cookie auditor that uses Playwright and fresh isolated browser sessions to test three experiences—a standard US visitor, an EU visitor, and a visitor sending a Global Privacy Control signal. Each test records cookies before interaction, finds consent controls without relying on visible button text, declines non-essential cookies, reloads the page, and verifies that the resulting cookies and saved preference match expected behavior. A companion URL detector narrows the audit set from traffic records, while configurable classifications, exceptions, weekly reports, and historical results support review, trend detection, and follow-up by Privacy and Engineering teams.

Takeaways

1. 1

   The auditor tests actual browser behavior, including cookies loaded before consent, the result of declining non-essential cookies, and whether preferences persist after reload.

2. 2

   Consent classifications, approved cookies, and known exceptions are maintained outside the auditor’s source code so the Privacy team can update them without an engineering release.

3. 3

   Weekly reports separate likely violations from known false positives, and historical results help teams identify when previously correct consent behavior changes.