fix(audit): P93+P95 — Reject-Wording erweitert + Vendor-zentrisches Cookie-Format akzeptiert
CI / detect-changes (push) Successful in 10s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / test-python-backend (push) Successful in 38s
CI / test-python-document-crawler (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / validate-canonical-controls (push) Successful in 16s
CI / loc-budget (push) Failing after 16s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / nodejs-build (push) Has been skipped
CI / test-go (push) Has been skipped
CI / iace-gt-coverage (push) Has been skipped

P93: 'Cookies verbieten', 'Tracking ablehnen', 'verweigern' usw. zaehlen
nun als expliziter Reject-Mechanismus. EDPB 5/2020 schreibt kein bestimmtes
Wort vor — BMW False-Positive 'Kein Ablehnen-Mechanismus' weg.

P95: cookie_table-Check akzeptiert nun zwei gleichwertige Formate:
(a) klassische Tabelle, (b) Vendor-Detailseite mit Block pro Anbieter
(Name+Anschrift, Zweck, Speicherdauer aggregiert, Cookie-Namen-Liste,
Opt-Out-Link). BMW-Stil mit Adform-Block ist DSK-OH 2024 konform.
False-Positive 'tabellarisches Cookie-Verzeichnis fehlt' wird seltener.

Hinweis-Text in cookie_table umformuliert: nennt beide akzeptablen
Formate, weniger normativ.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-05-21 12:21:29 +02:00
parent e5b4672f2a
commit e1df24cad7
2 changed files with 35 additions and 4 deletions
+12 -2
View File
@@ -159,8 +159,18 @@ async def check_banner_text(page) -> dict:
# (e.g. only "Nur technisch Notwendige" — semantically
# a reject but EDPB 5/2020 + DSK-OH 2024 prefer explicit
# labeling so users recognize it as the reject option)
explicit_reject_texts = ["ablehnen", "reject", "alle ablehnen",
"decline", "alles ablehnen"]
# P93: EDPB 5/2020 schreibt kein bestimmtes Wort vor — Reject-
# Mechanismus muss gleichwertig zur Annahme sein. BMW nutzt
# "Cookies verbieten", andere Sites "Tracking ablehnen" o.ae. —
# alle rechtlich gleichwertig.
explicit_reject_texts = [
"ablehnen", "reject", "alle ablehnen",
"decline", "alles ablehnen",
"cookies verbieten", "cookies blockieren",
"tracking ablehnen", "tracking verbieten",
"zurueckweisen", "block all", "deny all",
"alle verweigern", "verweigern",
]
implicit_reject_texts = ["nur notwendige", "nur technisch", "nur essenzielle",
"nur essentielle", "notwendige akzeptieren",
"essential only", "only necessary",