v0.10.0

Upgrade notes:

• New reports carry schemaVersion: "1.5.0". It adds the report language hu and the
  linked-page observation with its reasons. Consumers that accept 1.4.0 only must add 1.5.0
  (schemas/report-1.5.0.schema.json).
• On sites with subdomains, the first crawled page of up to five other hosts (docs., blog.)
  now gets the consent, banner and HTTPS checks too. That can add findings and one consent run
  per host. --host-checks main or "hostChecks": "main" keeps the previous behaviour.
• The legal notice and the privacy policy linked from the start page are loaded once more for the
  new legal-notice-content, privacy-policy-vendors and privacy-policy-content rules, plus a
  cookie policy the privacy policy links. That is up to three extra page loads per scan, also
  through a network adapter, and can add findings. Deselect a rule to skip its load. Without a
  legal notice link, a page behind a vague legal link or the privacy policy is read instead.
• New dependency pdfjs-dist (5.1.x, the last line that supports Node 20.12) to read PDF cookie
  policies. It brings the optional @napi-rs/canvas, which privalint does not use; install with
  --omit=optional to skip it.
• Native scans make DNS lookups for up to 20 first-party subdomains that received requests, to
  find CNAME-cloaked trackers. Scans through a network adapter make none.
• New rules run by default and can add findings: mixed-content reports a form that submits over
  HTTP as an error, so scans with the default --fail-on error can fail on it;
  form-preticked-consent, privacy-policy-content, third-party-personal-data and
  banner-keyboard add warnings,
  referrer-policy info.
• Values of e-mail and phone parameters in request addresses are replaced by [redacted] in
  finding evidence, so evidence strings of native scans can differ from earlier reports.
• Scans with the settings check can report the new consent-preselected error on banners whose
  settings layer starts with optional categories switched on.

Added

• Fix guides for Cookiebot, Usercentrics, OneTrust and Complianz (docs/fixes, English and
  German): each consent finding mapped to the setting in that consent manager, every step linked to
  the vendor's documentation. When the consent manager is recognised, the fix of the finding links
  the section; Hungarian reports link the English guide. Complianz's documented reopen class
  cmplz-show-banner now counts as a settings link (#138)
• privacy-policy-vendors reads a cookie policy published as a PDF on the same site: it is
  downloaded (up to 5 MB, through the network adapter when there is one) and its text extracted
  with pdf.js, without running code from the file. A PDF that fails or is larger stays unread as
  before (#113)
• --format html (and -o report.html) writes a self-contained HTML report with inline CSS for
  light and dark: findings by page and severity, evidence in collapsible sections, fixes, legal
  basis and the disclaimer. Every scanned value is escaped, and the page loads nothing (#129)
• --baseline <report.json> (Action input baseline) compares the findings with an earlier JSON
  report: each finding is marked new or existing by rule, page and subject (the SARIF
  fingerprint), baseline.fixed lists the findings that are gone where the rule ran again, and --fail-on counts new
  findings only. Text and Markdown show the counts, SARIF sets baselineState. A baseline with
  another schema major version is rejected (#128)
• New opt-in rule gpc-signal (--gpc, config gpc, Action input gpc): privalint loads the
  start page once more with Global Privacy Control (Sec-GPC: 1 and
  navigator.globalPrivacyControl) and notes as info whether the banner hides and trackers stay
  away. The outcome is in consent.gpc (schema 1.5.0) (#132)
• --check-accept (config acceptCheck, Action input check-accept): privalint also accepts in a
  fresh browser, reloads and records what loads then. privacy-policy-vendors then also looks for
  services that run only with consent, and thirdParties lists them with the phase
  after-accept. The outcome is in consent.accept (schema 1.5.0); there is no finding of its
  own (#131)
• New rule banner-keyboard (warning): before clicking reject, privalint presses Tab up to 60
  times and warns when the reject control never gets focus, with the element and the press that
  focused the accept control as evidence (#122)
• CNAME-cloaked trackers: native scans resolve the CNAME chain of first-party subdomains that
  received requests and report a chain that reaches a tracker (from the tracker list and AdGuard's
  cname-trackers list) through pre-consent-trackers, with the chain as evidence. No DNS lookups
  through a network adapter or offline (#126)
• New rule fingerprinting (warning): a third-party script reads back a canvas, the unmasked WebGL
  renderer or an offline audio rendering before consent. Charts that only draw are not reported;
  reCAPTCHA, hCaptcha and Turnstile are info. The Fingerprint agent hosts are on the tracker list
  (#124)
• Trackers routed through the site's own domain are recognised by their path and parameters on
  any host: GA4 /g/collect?v=2&tid=G-…, Universal Analytics collect hits, server-side Google Tag
  Manager gtm.js?id=GTM-… and gtag/js?id=G-…, and Meta Pixel /tr?id=…&ev=…. The evidence names
  the host they were proxied through (#125)
• New opt-in rule trackers-after-close (--check-close, config closeCheck, Action input
  check-close): privalint closes the banner with its close button ("×", "Schließen") in a fresh
  browser, reloads and reports trackers that load then as errors, since closing is no choice. A
  banner without a close button counts as checked. The result is in consent.close (schema
  1.5.0) (#121)
• New rule banner-language (info): the consent banner is in another language than the page's
  <html lang>, guessed from common words of eight languages. A banner in the language of the
  browser locale is not reported, since many consent managers follow it (#123)
• --sitemap (config sitemap, Action input sitemap) chooses the pages after the start page from
  the sitemap: Sitemap: lines in robots.txt, else /sitemap.xml, with sitemap indexes one level
  deep. Up to half the pages go to pages likely to hold forms or checkout steps (/kontakt,
  /newsletter, /checkout, …), shallowest first and one per section; the rest take one page per
  section in turn. Same-site pages only, within maxPages; without
  a sitemap the crawl follows links as before (#133)
• Reports list every host outside the site that answered a request in thirdParties: registrable
  domain, first page, phases, request count and the vendor privalint knows it as, hosts only. The
  Markdown report shows it as a collapsed table, a starting point for the privacy policy and for
  new list entries (#127)
• --device <name> (config device, Action input device) emulates a Playwright device such as
  "iPhone 15": viewport, user agent and touch, so banners are checked in their mobile layout, where
  the reject button is often hidden or smaller. The report records it in options.device
  (schema 1.5.0) (#130)
• New rule third-party-personal-data (warning): requests to other sites carry e-mail
  addresses or phone numbers in their query string, plain or as SHA-256 hashes in parameters
  such as em or ud[em]. Only parameter names are reported, and the values are replaced by
  [redacted] in every finding that shows a request address (#118)
• third-party-embeds fixes point to the YouTube privacy-enhanced mode, the Vimeo dnt=1
  parameter and a placeholder image for Google Maps. None replaces consent (#137)
• New rule form-preticked-consent (warning): a form ticks a newsletter or advertising consent
  checkbox before the visitor chooses (#139)
• New rule mixed-content: a form on an HTTPS page submits to an http:// address (error);
  scripts, images, frames or stylesheets referenced over HTTP are info (#120)
• New rule referrer-policy (info): the page sets unsafe-url or no-referrer-when-downgrade by
  header or meta tag and contacts other hosts, which then receive the full page address (#119)
• New rule privacy-policy-content: the privacy policy gives no e-mail or postal address of the
  controller, or still contains template text such as [Firmenname] or "Musterstraße" (warning);
  a data protection officer named without contact details is info. On an overview page that links
  further privacy documents, a missing contact is info (#116)
• legal-notice-content reads a page behind a vague legal link ("Rechtliche Hinweise") or the
  privacy policy when the start page links no legal notice, and reports what it misses there as
  info (#114)
• Trackers from the vendors' own documentation: Google Ads conversions on www.google.com,
  Reddit Pixel, VWO (hosts and cookies), Microsoft Xandr universal pixel and the Amazon Associates
  oneTag (#71)
• The Drupal banner EU Cookie Compliance is recognised by name, as seen on a Hungarian railway
  site that offers only "accept all"
• --lang hu: findings, fixes and the text, Markdown and SARIF reports in Hungarian, with
  schema 1.5.0 for the new language value (#59)
• New rule privacy-policy-vendors: trackers and cookie-setting embeds the start page uses that
  the privacy policy, or a cookie policy it links, doesn't name (warning); font services, CDNs and
  other listed services as info. Names match as whole words, with known other names (#105)
• New rule legal-notice-content: the legal notice linked from the start page gives no postal
  address or e-mail address (warning), or names a registered legal form without a register entry
  (info). Postcodes of Germany, Austria, Switzerland and Hungary are recognised (#104). With
  --region hu a missing tax number of a company, with --region at a m...

v0.9.1

Upgrade notes:

• If your network adapter refuses POST requests, pages with API or analytics calls stay partial.
  Forward the page's own POST, PUT, PATCH, DELETE and OPTIONS requests with their body, like
  examples/controlled-scanner.ts now does.

Changed

• The fixes of impressum-link and privacy-policy-link suggest labels in the language the page
  declares in <html lang>: "Legal notice" and "Privacy policy" on an English site, "Impresszum"
  and "Adatkezelési tájékoztató" on a Hungarian one, "Impressum" and "Datenschutzerklärung" on a
  German one. Without a declared language the region decides. The BGH two-click ruling is only
  cited with --region de (#96)
• The example adapter in examples/controlled-scanner.ts forwards the page's own POST, PUT,
  PATCH, DELETE and OPTIONS requests with their body instead of refusing them. Refused API and
  analytics calls made every page with one partial. The controlled-scanning docs explain why an
  adapter should do the same (#98)

Fixed

• A crawled link that redirects to another site is no longer scanned as one of the site's pages.
  It is listed in offSiteRedirects and doesn't count against --max-pages (#95)
• impressum-link no longer takes a deeper page such as /blocks/contact for the contact page.
  A contact page is /kontakt, /contact, /contact-us or /kapcsolat at the top of the site
  or under a language prefix, or a link labelled as one. "Kapcsolat" is recognised (#97)

v0.9.0

Upgrade notes:

• The Action's max-pages, concurrency, lang, region and fail-on-incomplete inputs now
  default to empty and are then not passed, so privalint.config.json applies. Workflows without a
  config file behave as before; workflows with one now get its values.
• New scans write report schema 1.4.0. Schemas 1.0.0 to 1.3.0 are unchanged and still shipped.
• Six new rules may add findings to existing scans: consent-banner-missing, banner-legal-links,
  https-transport, form-privacy-notice, withdrawal-button and accessibility-statement.
  Disable any of them with --disable or "rules" in the config.

Added

• --check-settings reads the IAB TCF API (__tcfapi('getTCData')) after saving with
  everything off. Consent the API still reports for a purpose or vendor is a
  trackers-after-settings error; purposes left on through legitimate interest are a warning. The
  numbers are in consent.settings.tcf (#60, step 1)
• Capture timing in the diagnostics: timing.loadMs, timing.networkIdleMs and, for adapter
  scans, timing.peakQueued. Adapter timeouts say whether the request was queued or fetching
  (#70)
• Report schema 1.4.0 with the fields above. Schemas 1.0.0 to 1.3.0 stay available
• Trackers: Adobe Analytics, Target, Audience Manager and Experience Platform Tags, etracker,
  INFOnline, Piwik PRO, Heap, Pendo, Optimizely, Chartbeat and Comscore, each from the vendor's own
  documentation. The Facebook SDK (connect.facebook.net/<locale>/sdk.js) is reported as its own
  vendor in the social category instead of as the Meta Pixel
• Embeds: SoundCloud, Mapbox, Trusted Shops, Pinterest widgets and Google Calendar
• Bugsnag, Rollbar and Datadog Browser RUM/Logs ingest hosts join Sentry: a skipped error report
  to them no longer makes a capture incomplete (#69)
• --check-settings picks the narrowest level when a banner offers consent levels as radio
  buttons (otpbank.hu), and knows the save labels "Elfogadom a kiválasztottakat" (telekom.hu) and
  "Elfogadom a fenti …" (#57)
• Action inputs config and check-settings
• The Markdown report (job summary, PR comment) shows the first two evidence items under each
  finding
• trackers-after-reject reads the IAB TCF API after "Reject all" too, stored as consent.tcf
  (#79)
• Consent banners that appear late are found: without a result, privalint looks again for up to
  one more settle period. consent.bannerWaitMs says how long (#77)
• With --max-pages, pages selected by a query parameter (/?page_id=2, /index.php?id=7) are
  crawled as separate pages (#75)
• New rule consent-banner-missing (warning): trackers run on the start page and no consent
  banner was found at all. New observation kind banner-search (#82)
• New rules for online shops, checked on the start page of sites with a cart, checkout or shop
  system: withdrawal-button (warning, § 356a BGB / Art. 11a Directive 2011/83/EU, since
  19.06.2026) and accessibility-statement (info, § 14 BFSG / European Accessibility Act) (#83,
  #84)
• Trackers are recognised by their localStorage and sessionStorage key names too, before consent
  and after a refusal. Only names are read, never values (#80)
• New rule banner-legal-links (warning): a banner that blocks the page (modal, half the viewport
  or no scrolling) and doesn't link the privacy policy or the Impressum (#89)
• New rule https-transport: start page over plain HTTP (error), http:// without a redirect to
  HTTPS (warning), no HSTS (info). Native scans only; adapter and offline scans skip it by design
  with transport-not-checked (#90)
• --check-settings objects to legitimate interest on TCF banners: it opens a "Berechtigtes
  Interesse" / "Legitimate interest" tab and uses its "object to all" button, or switches off the
  toggles there. consent.settings.legitimateInterest says what it did (#60)
• New rule form-privacy-notice (info): forms with an email, phone or password field and no
  privacy-policy link next to them, while the page links it elsewhere (#91)

Changed

• google-fonts and adobe-fonts drop one level with --region ch, like the other third-party
  rules (#85)

• impressum-link notes vague legal links ("Rechtliche Hinweise", "Rechtliches", "Legal", "Jogi
  tudnivalók") as info instead of warning that there is no Impressum (#72)

• SARIF declares the label-based rules (reject-option, consent-settings-link,
  impressum-link, privacy-policy-link) with precision medium (#76)

• An --output path in a missing directory fails before the scan starts. If writing fails after
  the scan, the report is still printed and the exit code is 2 (#74)

• Tracker, embed and font rules count requests that got an HTTP error response. A pixel that
  answers 403 has still received the visitor's IP address and referrer

• Action inputs max-pages, concurrency, lang, region and fail-on-incomplete default to
  empty and are then not passed, so privalint.config.json applies. Before, their defaults
  silently overrode the config file

Fixed

• Basic-auth credentials in the target URL (https://user:pass@staging…) no longer appear in any
  report, SARIF upload or PR comment. They still open the site
• A real request failure is no longer relabelled as "cancelled by the page" when two requests
  share a URL, which could make an incomplete capture look complete
• When the banner doesn't appear in the settings check's fresh browser, the report says
  banner-not-shown instead of a browser failure
• The SARIF rule help cites the scan's region, like each result
• SARIF page locations keep percent escapes, so /über-uns no longer shares a location with a
  page named /_C3_BCber-uns. Locations of pages with non-ASCII paths change once (#86)
• A fetch from a worker that got its answer but wasn't read no longer makes an adapter capture
  incomplete. Requests from cross-origin iframes and workers are confirmed to go through the
  adapter (#88)
• A shop cookie named put_… is no longer reported as Magnite advertising (#73)
• The settings control is found when it sits in a nested shadow root (#78)
• An open Server-Sent Events stream no longer makes a capture incomplete (#81)
• --check-settings could click "Alle bestätigen", "Confirm all" or "Alle übernehmen" as the save
  button, which switches everything on. A label covering everything only counts as saving when it
  names the selection ("Alle Einstellungen speichern")
• A page with "Angebot annehmen" and a privacy link in the footer, or a footer menu with
  "Acceptable Use Policy" next to "Cookie Policy", no longer counts as a consent banner. Accept
  buttons must sit in a dialog, an overlay or a small container about cookies, and must not lead to
  another page
• A known consent manager whose reject selector is out of date no longer produces a "no reject"
  finding; the reject button next to the accept button is found by its label
• The settings check leaves checkboxes outside the consent layer alone, such as "remember me" in a
  login form
• "Cookie beállítások" is recognised as a link to reopen the settings
• A JavaScript redirect while the page settles no longer leaves the report on the old URL
• The Markdown "How to fix" section lists each vendor's fix instead of one per rule, and escapes
  @ so a PR comment can't mention anyone
• docs/configuration.md lists the region hu
• test/config.test.ts builds the CLI into its own temporary directory, so a parallel build can't
  change it mid-test (#68)

v0.8.0

Fewer false "not checkable" results, legal references that match the rule pages, and the current Usercentrics banner.

Behaviour changes to know about

• Coverage gate (--fail-on-incomplete, fail-on-incomplete in the Action, assessCoverage): it now follows capture.complete. Before, it failed every page that recorded any issue, including omitted beacons and requests the page cancelled itself, which the report already counted as complete. Pipelines that exited with 3 only for those reasons now pass.
• Legal references in findings (#58): trackers-after-reject and trackers-after-settings cite Art. 6(1)(a) GDPR instead of Art. 7(3). Art. 7(3) is about withdrawing consent that was given; after a refusal there is nothing to withdraw, the tracking simply lacks a legal basis. reject-option drops Art. 7(3) as well and adds EDPB Opinion 08/2024 for the EU profile; third-party-cdns cites the Munich Google Fonts ruling by analogy for Germany; Planet49 carries its date. Findings and rule pages now cite the same provisions. If you match on reference strings, update them.

Fixed

• Skipped error reports (#64): read-only adapters skip POST requests, including the reports a page sends to Sentry. On sites using Sentry every page used to be "not checkable" because of that. Skipped requests to Sentry's ingest hosts (o<number>.ingest.sentry.io and regional forms, per Sentry's docs) no longer restrict the capture; skipped POSTs to any other host still do. The report format is unchanged.
• Usercentrics v3 (#55): the current banner (#usercentrics-cmp-ui) is recognised by name again, and --check-settings uses its own settings and save buttons. Checked live on a German bank's site: rejected, settings opened, 17 switches off, saved.

Also in this cycle

• --sandbox confirmed on macOS and on an Ubuntu 24.04 host; the AppArmor restriction there is explained by the error message (#37).

No change to the report format; reports still use schema 1.3.0.

Full changelog: https://github.com/JExcellence/privalint/blob/main/CHANGELOG.md

v0.7.1

Two fixes, both from outside contributors. Thank you @dannyward630 and @bfs2021.

Fixed

• Intercom Messenger (#63, closes #61, by @dannyward630): third-party-embeds now recognises all Intercom Messenger hosts listed in Intercom's Content Security Policy guide, including the regional, realtime and attachment hosts. Before, only widget.intercom.io was matched, so a page where the Messenger loaded from a cached script was missed. Intercom's marketing site and Inbox hosts are still not matched.
• Contentsquare opt-out cookie (#62, closes #56, by @bfs2021): _cs_optout is the cookie Contentsquare sets when a visitor opts out. It was matched by the _cs_ prefix and reported as a tracker, so trackers-after-reject flagged the visitor's own refusal. The tracking cookies (_cs_id, _cs_s, …) are still matched.

No change to the report format; reports still use schema 1.3.0.

Full changelog: https://github.com/JExcellence/privalint/blob/main/CHANGELOG.md

v0.7.0

Added

• Chat and review widgets in third-party-embeds: Intercom, Tawk.to, Zendesk Web Widget,
  Trustpilot and Typeform, with hosts from the vendors or observed on live sites (#32)
• Opt-in check of the consent banner's settings layer (#38): with --check-settings (or
  settingsCheck: true) privalint loads the start page again in a fresh browser, opens the
  settings, switches off every optional category, saves and reloads. The new rule
  trackers-after-settings reports trackers that still load. Without the flag the rule is
  skipped with settings-check-disabled, which does not make a report partial
• Report schema 1.3.0 with consent.settings, options.settingsCheck, the observation kind
  after-settings and the matching reasons, and the region hu. 1.0.0 to 1.2.0 stay unchanged
  and supported
• Region hu for Hungary (#47): findings cite Eht. 155. § (4) for cookies, Ekertv. 4. § for the
  imprint and the GDPR in Hungarian form. Hungarian banner buttons ("Elfogadom", "Elutasítom",
  "Csak a szükségesek"), settings links ("Süti beállítások"), "Impresszum" and
  "Adatkezelési tájékoztató" are recognised. Reports stay in English or German
• Cookies the hand-maintained tracker list doesn't know are looked up in about 1,000 analytics
  and marketing cookies from the Open Cookie Database
  (Apache-2.0, credited in the new NOTICE file). The data matches cookie names only, never
  request hosts; wildcard entries match as prefixes, all others exactly. Names shorter than four
  characters, generic names such as session or visitor and cookies that store a consent or
  opt-out choice are left out. Entries in src/data/trackers.ts still win, by cookie name and by
  the cookie's domain. npm run cookies:build regenerates the list (#39)

Changed

• First-party detection uses the registrable domain from the public suffix list, including
  private suffixes like github.io, netlify.app and vercel.app. A crawl on a.github.io no
  longer follows links to b.github.io, and shop.example.co.uk counts as part of
  example.co.uk. Sibling subdomains such as blog.example.de and shop.example.de now count
  as one site. IP addresses, localhost and hosts that are themselves a public suffix only match
  the exact same host. The list ships with the new runtime dependency tldts, so scans make no
  extra network requests (#36)
• The error for --sandbox failing to start now names Docker's default seccomp profile as the
  usual cause inside containers. Tested on Ubuntu 24.04 in Docker: the sandbox fails with the
  default profile and starts once the profile allows user namespaces. Before, the message only
  pointed to AppArmor, which does not apply there

v0.6.1

A fix for pages that were wrongly reported as incompletely captured.

Fixed

• Requests the page cancels itself no longer make a page capture incomplete. Frameworks drop their own requests, for example Next.js cancelling RSC prefetches when the network is slow. In adapter mode such a request used to be stored as browser-failure, so one cancelled prefetch on a busy server could turn every rule on the start page into "not checkable". (#45)

  privalint now detects the cancel from Chromium (Network.loadingFailed with canceled), not from error text. It stops the adapter call if it is still running, and records the request as kind: 'skipped', skippedReason: 'cancelled-by-page'. That does not restrict the capture, like an omitted beacon, and the URL still counts for the tracker rules. Requests the browser cancels because the page navigates, such as the reload after rejecting, are recorded the same way. Real failures (adapter errors, timeouts, connection, TLS, DNS, limits) still make the capture incomplete.

Report format

New reports use schema 1.2.0, which adds the skip reason cancelled-by-page. Schemas 1.0.0 and 1.1.0 are unchanged and still supported by identifyReportSchema().

If you validate reports against a pinned schema file, add privalint/schemas/report-1.2.0.schema.json (and sarif-properties-1.2.0.schema.json). A validator that only knows 1.1.0 will treat new reports as an unsupported version.

Full changelog: https://github.com/JExcellence/privalint/blob/main/CHANGELOG.md

v0.6.0

More consent managers and trackers, a concurrency input for the Action, and no more false "incomplete" results on sites that need no cookie banner.

Changed

• Sites without a banner that don't need one (#35): if no consent banner was found and nothing that needs consent loaded before a choice (pre-consent-trackers and third-party-embeds checked completely, no findings), trackers-after-reject, reject-option and consent-settings-link are now skipped with the reason no-consent-needed instead of being not evaluable. With fail-on-incomplete such sites no longer exit with 3.

  Upgrading: if you disabled those three rules only to get a bannerless site past fail-on-incomplete, you can remove them from disable. A site that loads trackers or embeds without a banner still reports them as not evaluable, as before.

Added

• Consent managers (#30): Axeptio, TrustArc, CookieHub, Cookie Information and Cookie-Script are recognised by their button selectors, read from their live banners. Reports name the tool, and the reject path uses the real button instead of a label guess.
• Session-replay tools (#31): FullStory, Mouseflow, Smartlook, Lucky Orange and Contentsquare in the tracker list. Every host comes from the vendor's own material or from requests seen on live sites; the sources are listed in docs/rules/pre-consent-trackers.md.
• Action input concurrency (#34): passed to --concurrency, so multi-page scans in CI can load several pages at once. Default stays 1.

Report format

Schema 1.1.0 gains the no-consent-needed value for reason and explanation. Schema 1.0.0 is unchanged.

Full changelog: https://github.com/JExcellence/privalint/blob/main/CHANGELOG.md

v0.5.0

Two new rules, faster crawls and an opt-in Chromium sandbox.

New rules

• adobe-fonts (error): fonts loaded from Adobe Fonts / Typekit (use.typekit.net, p.typekit.net). The fix text explains that, unlike Google Fonts, these need a separate licence to be self-hosted. (#8)
• consent-settings-link (warning): after "reject" and a reload, no visible link or button reopens the cookie settings (Art. 7(3) GDPR). Known reopen widgets of the supported consent managers count, as do links and buttons labelled like "Cookie-Einstellungen". Checked against the vendor sites of Cookiebot, OneTrust, CookieFirst, Osano, Termly, Complianz and CookieYes without false warnings. (#28)

If your site uses a consent banner without a footer link or floating button to reopen it, this release adds a warning to your scan.

Upgrading with fail-on-incomplete: on a site without a consent banner, consent-settings-link is not evaluable, like trackers-after-reject and reject-option. If you already disable those two for that reason, add consent-settings-link to the list, otherwise the step exits with 3.

Options

• --concurrency <n> (config/API: concurrency): loads up to n pages of a crawl at once. Results are committed in breadth-first order, so pages, findings and SARIF fingerprints are identical to a sequential scan. A six-page crawl went from 20 s to 11 s at --concurrency 3. Default stays 1. (#14)
• --sandbox (API: sandbox: true): runs Chromium with its sandbox, recommended when scanning untrusted sites on a machine with secrets. Off by default; if it can't start, privalint stops with an explanation instead of silently running without it. (#13)

Trackers and consent managers

• Criteo, Taboola, Outbrain, Adform and Quantcast added to the tracker list (#7)
• Osano: the reject button is found again (osano-cm-denyAll) (#9)

Report format

Schema 1.1.0 gains three optional fields: options.sandbox, options.concurrency and consent.settingsControl. Existing 1.1.0 reports stay valid.

Full changelog: https://github.com/JExcellence/privalint/blob/main/CHANGELOG.md

v0.4.1

Fixed

• A beacon that the network adapter deliberately did not send no longer marks the page capture as
  incomplete. Its URL is still checked by the tracker rules, so a skipped tracker beacon is still
  reported. Before, a single first-party statistics ping made every rule on a clean site report
  "not checkable".