Topics: privacy, tracking, consent, headless browsers, GDPR
Technologies: python (Playwright or Puppeteer), network traffic analysis, javascript
Tldr; build the part of a compliance checker that watches what a website actually does during a visit, and use it to detect behavioural tracking and consent theatre on sites that are meant to serve the public.
Motivation: A privacy policy that says the right thing is worthless if the site behaves otherwise. Many public-serving websites, often without realising it, load third-party tracking, set identifying cookies before consent, or present consent dialogues whose ‘reject’ path does not actually stop data collection. Static inspection of a page cannot catch this, because the behaviour only appears when the page runs. A compliance checker therefore needs a behavioural layer: a controlled visit, under observation, that records what requests fire, what is stored, and in what order relative to any consent interaction. This project builds that layer for the Privacy standard and evaluates it against real public-sector sites.
Implementation: You will build a headless-browser harness that visits a website, records all network requests, cookies, and local storage, and captures the sequence of events around any consent dialogue (what fires before consent, what changes after acceptance, and, critically, what changes after refusal). You will define behavioural checks that flag likely violations, such as identifying requests to known tracking domains before consent, or no change in behaviour between acceptance and refusal. You will run the harness across a corpus of public-sector sites and analyse the results, reporting both the incidence of behavioural tracking and the reliability of your detection method. The deliverable is a working behavioural-check module and an empirical study of what it finds.
What you will learn: (i) how tracking and consent mechanisms actually operate at the network level; (ii) how to drive and observe a browser programmatically; (iii) the difference between what a site claims and what it does; (iv) the legal and privacy significance of pre-consent data collection under GDPR; (v) how to turn observed behaviour into a defensible compliance judgement.
References:
[1] Do Cookie Banners Respect my Choice? https://arxiv.org/pdf/1911.09964
[2] Global Privacy Control: https://globalprivacycontrol.github.io/gpc-spec/
[3] dotPublic compliance checker prototype: https://dotpublic.org/checker