Dropbox engineering has published a detailed account of how its in-house cookie auditor validates consent behaviour across more than 200 web surfaces, offering a glimpse into the practical challenges of maintaining privacy compliance at scale. The post, authored by Yasmin McDowell and Lawrence Good, outlines a Playwright-based system that behaves like a privacy-conscious visitor and checks that pages only load cookies consistent with a user's stated preferences.
The auditor runs three separate tests against every page in scope, one simulating a standard US visitor, one simulating an EU visitor, and a third that sends a Global Privacy Control (GPC) signal. Each test begins in a fresh, isolated browser context with no existing cookies, mirroring what a new visitor would see. Before any interaction, the auditor records which cookies have already loaded and verifies they match the expected baseline for that scenario, then locates the page's consent controls, declines non-essential cookies, reloads the page and checks that the preference still applies.
The controls are not identified by text. Dropbox supports 22 languages and the banner may appear as a floating element, a preferences window, or a footer link, so the auditor interacts with the underlying consent elements rather than button labels. A pragmatic design choice is keeping cookie classifications outside the auditor's source code, which allows the Privacy team to update the approved cookie list and known exceptions without waiting for an engineering release. Because the consent banner itself was also built in-house, the auditor plugs directly into existing infrastructure rather than wrapping an off-the-shelf product.
Dropbox built what it calls "an auditor for our auditor," a companion URL detector that uses traffic data to find every live Dropbox web surface. Billions of visit records are filtered down to a manageable list of unique paths, then grouped by consent logic so that representative URLs can stand in for large families of similar pages.
Projects such as @slashgear/gdpr-cookie-scanner ship an open-source CLI that scores GDPR behaviour from 0 to 100 and integrates with GitHub Actions, while ConsentCrawl targets over 25 consent manager platforms including OneTrust, CookieBot and TrustArc Truste. A Dutch study recently used Playwright to analyse 6,168 political party URLs for unconsented tracking, suggesting the same browser automation approach is becoming standard in academic privacy research.
Platform engineers interested in building similar tooling can see the shape of a minimal Playwright assertion in a recent qaskills.sh guide.
Today the auditor produces a weekly report for Privacy and Engineering teams, separating likely violations from known false positives and tracking historical trends. Dropbox's next planned iteration is routing findings directly to the teams that own each page, shortening the loop between detection and fix. The team notes that the browser automation itself may be the simplest part of such a project, with the harder work sitting around it: defining correct behaviour, maintaining an accurate inventory and separating real issues from noise.
Dropbox is a cloud-based file hosting and collaboration platform founded in 2007 by Drew Houston and Arash Ferdowsi and headquartered in San Francisco. The company operates more than 200 web surfaces across its product lineup, which includes Dropbox, Dropbox Sign, DocSend and FormSwift, and has invested heavily in privacy and compliance programmes covering GDPR, CCPA and ISO 27018.
Playwright is an open-source browser automation library developed and maintained by Microsoft. It drives Chromium, WebKit and Firefox through a single API across JavaScript, TypeScript, Python, Java and .NET, and has become a widely used tool for end-to-end testing, web scraping and, increasingly, automated privacy and compliance audits of the kind Dropbox describes.