Benjamin Admin
662327e8b4
CI / nodejs-build (push) Successful in 2m47s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / detect-changes (push) Successful in 10s
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / validate-canonical-controls (push) Successful in 16s
CI / loc-budget (push) Failing after 17s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-python-backend (push) Successful in 42s
CI / test-python-document-crawler (push) Has been skipped
CI / test-go (push) Has been skipped
CI / iace-gt-coverage (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped
Massiv-Update auf Basis BMW-Test-Iterationen (v1→v9): Core Compliance-Check - Sonnet check_type Klassifikation: text/process/review fuer alle 1874 MCs in compliance.doc_check_controls (script + Sidecar /data/mc_classification.db). rag_document_checker filtert auf check_type='text' fuer doc_check. Plus fits_doc_type-Audit (v2) + ui_only-Audit fuer DSA/E-Commerce-MCs in falscher doc_type-Schublade. - scope_requires-Filter: biometric/ai_decision/child_targeting MCs werden per business_profile gefiltert (FRT skipped fuer BMW etc.). - Embedding-Match (BGE-M3) als Phase-3 nach Regex-Match: Per-doc_type-Threshold-Override (impressum 0.50, dse/cookie 0.60), Short-Field-Rescue (15-Wort-Chunks) fuer Pflichtfelder im Impressum. Title+check_question als Embedding-Input fuer mehr Kontext. - Cookie-Text-Routing: consent-tester gibt cmp_cookie_text aus dem CMP-Reconstruct zurueck, Backend bevorzugt das gegen DOM-Extraction wenn richer (BMW 1824 vs 600 Worte). Vendor-Redundanz + EU-Alternativen + Cost-Saving - vendor_redundancy.analyze() — funktionale Kategorisierung der CMP-Vendors, Detektion von Mehrfach-Anbietern pro Kategorie, EU-Alternative-Lookup (Matomo, IONOS, HERE, Friendly Captcha, Smart AdServer, ...). - vendor_cost_estimator: Tier-Inferenz aus Cookie-Footprint (Cookie-Anzahl + Premium-Feature-Cookies + Third-Party-Quote → starter/professional/ enterprise/premier). - Self-Service-Werbung (Google/Meta/Pinterest/...) = 0 Lizenz-Kosten (nur Media-Spend, separat). DSP-Plattformen behalten enge Range. - Tier-aware Saving-Range: bei Enterprise/Premier nutzen wir den oberen 40-100%-Band der Listpreise, nicht starter→premier. - Multi-Function-Tools (Matomo Pro, SAP CX, IONOS Cloud, Userlike, Smart AdServer, HERE Maps, Vimeo Pro, LamaPoll) — ein Tool ersetzt mehrere Kategorien gleichzeitig. Cookie-Wissens-DB + Funktionale Klassifikation - cookie_knowledge_db: 50 kuratierte Top-Cookies (Google/Meta/Adobe/MS/...) mit vendor, exact_purpose, data_collected, IAB-TCF-IDs, reid_risk, schrems_ii_status, EuGH-Urteile, EU-Alternative. - cookie_function_classifier: pro Cookie funktionale Rolle (tracking_id, ad_pixel, session_id, ab_test, csrf, ...) + blocking_impact. Country-Inferenz aus Rechtsform - cookie_link_validator: Country-Field wird aus Vendor-Name abgeleitet (A/S=DK, GmbH=DE, Inc=US, B.V.=NL, ...) plus Vendor-Lookup-Table. Reduziert false-positive no_country-Flags bei eindeutig-EU-Vendors (Adform DK, Pinterest IE). Action-Recipes + Doc-Anchor-Locator - finding_action_recipes: pro Finding-Typ (no_cookies_listed, no_country, broken_opt_out, "Auftragsverarbeiter erwaehnen", "Art. 22 Profiling", ...) eine strukturierte Anweisung mit what/why/fix_text/where/example. Zum 1:1-Einfuegen in Kunden-Dokumente. - doc_anchor_locator: Embedding-basiert (BGE-M3 cosine) — sucht den passenden Absatz im existierenden Kundendokument fuer jeden Finding. Per-Run Thread-Local-Cache. Fallback: keyword-Match. - Email-Rendering integriert Recipe + Anchor pro Doc-Pruefungs-Fail + Vendor-Flag-Liste mit aufklappbarer Action-Liste. - Score-Erklaerung pro Vendor-Zeile (3/5-Untertitel + Tooltip). Migration-Pipeline (Compliance-Check -> Customer Banner/Documents) - migration_to_banner.py: Vendor-Liste -> CookieBannerConfig mit 4 Kategorien + Review-Flags. - migration_to_document.py: Vendor-Liste -> Cookie-Policy + VVT-Register + Privacy-Policy-Pre-Fills. - agent_migration_routes: 3 Preview-Endpoints (banner-preview, document-preview, summary). Persistierung der cmp_vendors in /data/compliance_audits.db check_payloads-Tabelle. Borlabs-Parity Cookie-Banner-Features - Consent-Historie im Banner: window.bpShowConsentHistory() + localStorage. - Content-Blocker: cookie-banner-content-blocker.ts — YouTube/Maps/Video Placeholder bis Einwilligung. - Google Consent Mode v2 erweitert: wait_for_update + region=EEA/CH/GB. - Consent-Log Export (CSV/JSON) per einwilligungen_export_routes. Bug-Fixes - canonical_control_routes: _jsonish-Helper fuer string-typed jsonb, similar-controls-Endpoint mit _has_embedding_col()-Cache (kein 500 mehr). - Control-Library Frontend: defensive .map-Coercer in 2 Detail-Views. - Embedding-Service-Batching (32er Batches statt 165 in einem Call). - KeyError 'control_id' in MC-Result-Aggregation (defensive .get). - Master-Controls-Klick-Through von /sdk/master-controls auf /sdk/control-library?control=<id> mit URL-Param-Auto-Open. - Dockerfile: /data pre-chowned auf appuser (Audit-DB-Schreibrecht). - Cookie-Text-Routing-Bug (cmp_reconstructed > DOM-extraction). - doc_type-aware MC-Filter (statt all-text-MCs). - Master-Contract-Dedup (60 BMW-Internal-Eintraege = 1 Adobe-Vertrag). - A3-v2-Audit hat 24 UI-Sprache-MCs als 'process' reklassifiziert. Tests - test_migration_mappers.py (9 Tests) - test_migration_endpoints.py (4 Tests) Skripte (one-shot) - classify_mc_check_type.py (v1) + _v2 (PK=control_id,doc_type) - audit_mc_doctype_fit.py (v1 fits) + _v2 (ui_only + scope_requires) BMW-Run-Bilanz v1 (broken) -> v9 (alle Fixes): DSE 7,5% -> 81-83% Impressum 4% -> 100% (6 echte MCs alle erfuellt) Cookie 0% -> 79-83% (CMP-Text-Routing + Embedding) Plus: 10 Konsolidierungs-Kategorien, geschaetzte Saving 200k-3M / Jahr Plus: Action-Recipes + Doc-Anchors fuer jeden Fail Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
609 lines
26 KiB
Python
609 lines
26 KiB
Python
"""
|
|
Cookie-Knowledge-Datenbank — maximal extrahierbares Wissen pro Cookie-Name.
|
|
|
|
Pro Eintrag erfassen wir:
|
|
- vendor : Setzender Anbieter (volle Firma + Sitzland)
|
|
- exact_purpose : was der Cookie GENAU tut (nicht nur Kategorie)
|
|
- data_collected : Welche Datenfelder (Client-ID, Timestamp, IP, etc.)
|
|
- ip_relevant : Wird IP-Adresse erfasst/uebermittelt?
|
|
- ip_anonymized : Per Default anonymisiert?
|
|
- tcf_purpose_ids : IAB TCF v2.2 Purpose-IDs (1-11)
|
|
- iab_vendor_id : IAB Global Vendor List ID (fuer TCF-Sync)
|
|
- typical_lifetime : Wie lange persistiert
|
|
- reid_risk : Re-Identifikations-Risiko (low/medium/high)
|
|
- technical_necessity: Erforderlich nach §25(2) TDDDG? (none/partial/full)
|
|
- schrems_ii_status : Drittlandtransfer-Bewertung
|
|
- eugh_rulings : Relevante EuGH-/CNIL-/LfDI-Entscheidungen
|
|
- eu_alternative_* : EU-Cookie/Vendor-Ersatz mit gleicher Funktion
|
|
- notes : Sonstige Hinweise (Vermeidung, Konfiguration)
|
|
|
|
Quellen: Cookiepedia, IAB Europe TCF v2.2 Vendor List, Cookiebot DB,
|
|
CNIL Cookies & Trackers Guidelines 2024, EDPB Cookie Guidelines 2/2023,
|
|
DSK-Orientierungshilfe Telemedien 2021, Vendor-eigene Dokumentation.
|
|
|
|
Stand: 2026-05.
|
|
|
|
Erweiterung: Pull-Requests willkommen — Format siehe TEMPLATE_ENTRY am
|
|
Ende der Datei.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TypedDict
|
|
|
|
|
|
class CookieKnowledge(TypedDict, total=False):
|
|
vendor: str
|
|
vendor_country: str
|
|
exact_purpose: str
|
|
data_collected: list[str]
|
|
ip_relevant: bool
|
|
ip_anonymized: bool
|
|
tcf_purpose_ids: list[int]
|
|
iab_vendor_id: int | None
|
|
typical_lifetime: str
|
|
reid_risk: str # 'low' | 'medium' | 'high'
|
|
technical_necessity: str # 'none' | 'partial' | 'full'
|
|
schrems_ii_status: str
|
|
eugh_rulings: list[str]
|
|
eu_alternative_cookies: list[str]
|
|
eu_alternative_vendor: str
|
|
notes: str
|
|
|
|
|
|
# ─── Google ──────────────────────────────────────────────────────────
|
|
|
|
_GOOGLE_BASE = {
|
|
"vendor": "Google LLC", "vendor_country": "US",
|
|
"schrems_ii_status": "Drittlandtransfer in die USA. Mit DPF "
|
|
"(EU-US Data Privacy Framework, 2023) wieder zulaessig, "
|
|
"aber bereits Klage NOYB anhaengig (Schrems III). "
|
|
"Risiko-Bewertung empfohlen.",
|
|
"eugh_rulings": [
|
|
"EuGH C-311/18 (Schrems II, 16.07.2020) — Privacy Shield gekippt",
|
|
"CNIL SAN-2022-002 (10.02.2022) — Google Analytics ohne Anonymisierung "
|
|
"unzulaessig",
|
|
"Datenschutzkonferenz (DSK) Orientierungshilfe 2024 — GA4 mit "
|
|
"Server-Side-Tagging als Mitigation moeglich",
|
|
],
|
|
}
|
|
|
|
KB: dict[str, CookieKnowledge] = {
|
|
|
|
# ─── Google Analytics ─────────────────────────────────────────────
|
|
"_ga": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "Unterscheidet eindeutig Besucher; persistiert die "
|
|
"ueber alle Sessions hinweg gueltige Client-ID.",
|
|
"data_collected": ["client_id", "first_visit_timestamp", "ip_address"],
|
|
"ip_relevant": True, "ip_anonymized": False,
|
|
"tcf_purpose_ids": [8, 10],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"eu_alternative_cookies": ["_pk_id"],
|
|
"eu_alternative_vendor": "Matomo",
|
|
"notes": "Mit IP-Anonymisierung (`anonymizeIp: true`) + Server-Side-Tagging "
|
|
"DSGVO-konfigurierbar. Ohne diese Massnahmen einwilligungspflichtig.",
|
|
},
|
|
"_gid": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "Unterscheidet Besucher innerhalb einer Session "
|
|
"(24h-Bucket).",
|
|
"data_collected": ["session_id", "ip_address"],
|
|
"ip_relevant": True, "ip_anonymized": False,
|
|
"tcf_purpose_ids": [8],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "24 Stunden",
|
|
"reid_risk": "medium",
|
|
"technical_necessity": "none",
|
|
"eu_alternative_cookies": ["_pk_ses"],
|
|
"eu_alternative_vendor": "Matomo",
|
|
},
|
|
"_gat": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "Throttling-Cookie — begrenzt Anzahl Requests an "
|
|
"Google Analytics pro Sekunde.",
|
|
"data_collected": ["throttle_flag"],
|
|
"ip_relevant": False, "ip_anonymized": True,
|
|
"tcf_purpose_ids": [],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "1 Minute",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
"notes": "Reines Performance-Steuerungs-Cookie. Trotzdem einwilligungspflichtig "
|
|
"da er Teil des GA-Trackings ist.",
|
|
},
|
|
"_gat_gtag_UA_": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "GTM-spezifisches Throttling — pro Universal-Analytics-Property.",
|
|
"data_collected": ["throttle_flag"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "1 Minute",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
"notes": "Suffix nach `UA_` ist die Property-ID. Pattern-Match noetig.",
|
|
},
|
|
"_ga_*": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "GA4-Persistierung — eindeutige Stream-ID + Session-Daten.",
|
|
"data_collected": ["stream_id", "session_count", "session_start_ts"],
|
|
"ip_relevant": True, "ip_anonymized": False,
|
|
"tcf_purpose_ids": [8, 10],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"notes": "GA4-Format. Suffix `_<measurement_id>`. Server-Side-GTM "
|
|
"ist die einzige praktikable DSGVO-Mitigation.",
|
|
},
|
|
"NID": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "Personalisiert Google-Suche, AdSense, Maps; "
|
|
"speichert Praeferenzen + Sicherheits-Token.",
|
|
"data_collected": ["user_pref_id", "session_id", "security_token"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"notes": "Klassischer Google-Werbe-Cookie. Hohe Re-ID-Gefahr da Cross-Site.",
|
|
},
|
|
"IDE": {
|
|
"vendor": "Google LLC (DoubleClick)", "vendor_country": "US",
|
|
"exact_purpose": "Conversion-Tracking + Werbe-Targeting bei "
|
|
"Google Display Network / DoubleClick.",
|
|
"data_collected": ["doubleclick_id", "ad_interactions"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 755,
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": _GOOGLE_BASE["schrems_ii_status"],
|
|
"eugh_rulings": _GOOGLE_BASE["eugh_rulings"],
|
|
},
|
|
"test_cookie": {
|
|
**_GOOGLE_BASE,
|
|
"exact_purpose": "DoubleClick-Probe-Cookie — testet ob Browser Cookies akzeptiert.",
|
|
"data_collected": ["browser_supports_cookies"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "15 Minuten",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
},
|
|
|
|
# ─── Meta / Facebook ──────────────────────────────────────────────
|
|
"_fbp": {
|
|
"vendor": "Meta Platforms Ireland Ltd.", "vendor_country": "IE/US",
|
|
"exact_purpose": "First-Party-Pixel von Facebook/Meta — identifiziert "
|
|
"den Browser fuer Werbe-Conversion-Tracking + Ad-Retargeting.",
|
|
"data_collected": ["browser_id", "first_visit_ts"],
|
|
"ip_relevant": True, "ip_anonymized": False,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 891,
|
|
"typical_lifetime": "90 Tage",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "Daten gehen an Meta US trotz IE-Sitz. "
|
|
"Aktuell DPF-abgedeckt, aber Schrems III erwartet.",
|
|
"eugh_rulings": [
|
|
"EuGH C-311/18 (Schrems II)",
|
|
"EDSA Aufsichts-Statement 2023 zu Meta-Pixel",
|
|
"LDA Bayern Pruefverfuegung 2024",
|
|
],
|
|
"eu_alternative_vendor": "Smart AdServer (Equativ, FR)",
|
|
"notes": "Conversions API (CAPI) als Server-Side-Variante reduziert Cookie-"
|
|
"Abhaengigkeit. Trotzdem werden Daten an Meta gesendet.",
|
|
},
|
|
"_fbc": {
|
|
"vendor": "Meta Platforms Ireland Ltd.", "vendor_country": "IE/US",
|
|
"exact_purpose": "Speichert die ClickID einer Meta-Ad-Kampagne; "
|
|
"ordnet Conversion dem urspruenglichen Ad-Klick zu.",
|
|
"data_collected": ["fbclid", "ad_campaign_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9],
|
|
"iab_vendor_id": 891,
|
|
"typical_lifetime": "90 Tage",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
},
|
|
"fr": {
|
|
"vendor": "Meta Platforms Ireland Ltd.", "vendor_country": "IE/US",
|
|
"exact_purpose": "Werbe-Targeting + Cross-Site-Tracking auf "
|
|
"Facebook-Plattform.",
|
|
"data_collected": ["encrypted_user_id", "session_data"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 891,
|
|
"typical_lifetime": "3 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
},
|
|
|
|
# ─── Adobe ────────────────────────────────────────────────────────
|
|
"s_cc": {
|
|
"vendor": "Adobe Systems Software Ireland Limited", "vendor_country": "IE/US",
|
|
"exact_purpose": "Cookie-Test — prueft ob der Browser Cookies "
|
|
"akzeptiert (Adobe Analytics Bootstrap).",
|
|
"data_collected": ["browser_supports_cookies"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "partial",
|
|
"schrems_ii_status": "Adobe-IE-Hosting, jedoch US-Datentransfer fuer "
|
|
"Cloud-Services. DPF-abgedeckt.",
|
|
},
|
|
"s_sq": {
|
|
"vendor": "Adobe Systems Software Ireland Limited", "vendor_country": "IE/US",
|
|
"exact_purpose": "Speichert den letzten Klick (URL + Position) "
|
|
"fuer Click-Map-Reports.",
|
|
"data_collected": ["last_click_url", "last_click_xy"],
|
|
"ip_relevant": False,
|
|
"tcf_purpose_ids": [8],
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
},
|
|
"AMCV_": {
|
|
"vendor": "Adobe Systems Software Ireland Limited", "vendor_country": "IE/US",
|
|
"exact_purpose": "Adobe Marketing Cloud Visitor ID — Cross-Tool-ID fuer "
|
|
"Analytics + Target + Audience Manager.",
|
|
"data_collected": ["marketing_cloud_visitor_id", "first_visit_ts"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 8, 9, 10],
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"notes": "Suffix nach `AMCV_` ist die Org-ID. Klassischer Cross-Tool-Track.",
|
|
},
|
|
"mbox": {
|
|
"vendor": "Adobe Systems Software Ireland Limited", "vendor_country": "IE/US",
|
|
"exact_purpose": "Adobe Target — A/B-Testing, Personalisierung, "
|
|
"Audience-Targeting.",
|
|
"data_collected": ["mbox_visitor_id", "experiment_assignments"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"typical_lifetime": "2 Jahre",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
},
|
|
"s_target_qa": {
|
|
"vendor": "Adobe Systems Software Ireland Limited", "vendor_country": "IE/US",
|
|
"exact_purpose": "Adobe Target Premium-Feature — QA-Modus fuer Personalisations-Tests.",
|
|
"data_collected": ["target_qa_session"],
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
"notes": "Premium-Feature-Cookie. Anwesenheit = Enterprise-Lizenz Indikator.",
|
|
},
|
|
|
|
# ─── Microsoft / Bing ─────────────────────────────────────────────
|
|
"MUID": {
|
|
"vendor": "Microsoft Corp.", "vendor_country": "US",
|
|
"exact_purpose": "Microsoft-User-ID fuer Bing, Microsoft Advertising, "
|
|
"Clarity Heatmaps.",
|
|
"data_collected": ["microsoft_user_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 8, 9, 10],
|
|
"iab_vendor_id": 165,
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "US-Transfer, DPF-zertifiziert.",
|
|
},
|
|
"_uetsid": {
|
|
"vendor": "Microsoft Corp.", "vendor_country": "US",
|
|
"exact_purpose": "Universal Event Tracking — Session-Cookie fuer "
|
|
"Microsoft Advertising Conversion-Tracking.",
|
|
"data_collected": ["session_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [9],
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "medium",
|
|
"technical_necessity": "none",
|
|
},
|
|
"_uetvid": {
|
|
"vendor": "Microsoft Corp.", "vendor_country": "US",
|
|
"exact_purpose": "Universal Event Tracking — persistente Visitor-ID.",
|
|
"data_collected": ["visitor_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9],
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
},
|
|
|
|
# ─── LinkedIn ─────────────────────────────────────────────────────
|
|
"bcookie": {
|
|
"vendor": "LinkedIn Ireland Unlimited Company", "vendor_country": "IE/US",
|
|
"exact_purpose": "Browser-Identifikation; wird genutzt fuer Anmelde-"
|
|
"Vorgang + LinkedIn Insight-Tag-Tracking.",
|
|
"data_collected": ["browser_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 8, 9],
|
|
"iab_vendor_id": 14,
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "US-Datenuebermittlung (Mutter Microsoft).",
|
|
},
|
|
"lidc": {
|
|
"vendor": "LinkedIn Ireland Unlimited Company", "vendor_country": "IE/US",
|
|
"exact_purpose": "Daten-Routing zwischen LinkedIn-Datacentern.",
|
|
"data_collected": ["routing_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "1 Tag",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "partial",
|
|
},
|
|
"li_gc": {
|
|
"vendor": "LinkedIn Ireland Unlimited Company", "vendor_country": "IE/US",
|
|
"exact_purpose": "Speichert die Cookie-Einwilligung fuer LinkedIn-Embeds.",
|
|
"data_collected": ["consent_state"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "6 Monate",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
},
|
|
|
|
# ─── Matomo (EU-Alternative) ──────────────────────────────────────
|
|
"_pk_id": {
|
|
"vendor": "InnoCraft Ltd (Matomo)", "vendor_country": "NZ-mit-EU-self-hosting",
|
|
"exact_purpose": "Matomo Visitor-ID — Pendant zu _ga, aber DSGVO-konform "
|
|
"wenn IP-Anonymisierung aktiv.",
|
|
"data_collected": ["visitor_id", "first_visit_ts"],
|
|
"ip_relevant": True, "ip_anonymized": True,
|
|
"tcf_purpose_ids": [8],
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "low", # bei aktivierter Anonymisierung
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "Bei On-Premise-Deployment KEIN Drittlandtransfer. "
|
|
"Matomo Cloud EU mit Frankfurt-Hosting verfuegbar.",
|
|
"notes": "Empfohlener Drop-in-Ersatz fuer Google Analytics.",
|
|
},
|
|
"_pk_ses": {
|
|
"vendor": "InnoCraft Ltd (Matomo)", "vendor_country": "NZ-mit-EU-self-hosting",
|
|
"exact_purpose": "Matomo Session-Cookie.",
|
|
"data_collected": ["session_id"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "none",
|
|
},
|
|
|
|
# ─── Captcha ──────────────────────────────────────────────────────
|
|
"hcaptcha": {
|
|
"vendor": "Intuition Machines Inc. (hCaptcha)", "vendor_country": "US",
|
|
"exact_purpose": "hCaptcha Bot-Erkennung — Session-Token fuer Challenge-Solver.",
|
|
"data_collected": ["bot_score", "session_id", "ip_address"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "medium",
|
|
"technical_necessity": "full",
|
|
"schrems_ii_status": "US-Transfer (Intuition Machines, San Francisco).",
|
|
"eu_alternative_vendor": "Friendly Captcha (DE), Turnstile (Cloudflare EU)",
|
|
"notes": "Technisch erforderlich fuer Bot-Schutz, aber EU-Alternativen "
|
|
"ohne Drittland-Risiko verfuegbar.",
|
|
},
|
|
"cf_clearance": {
|
|
"vendor": "Cloudflare Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Cloudflare-Bot-Management Pro — bestaetigt dass User "
|
|
"die JS-Challenge bestanden hat.",
|
|
"data_collected": ["challenge_token"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
"notes": "Premium-Feature-Cookie. Anwesenheit = Cloudflare Bot-Management "
|
|
"Pro im Einsatz.",
|
|
},
|
|
|
|
# ─── CDN / Performance ────────────────────────────────────────────
|
|
"__cf_bm": {
|
|
"vendor": "Cloudflare Inc.", "vendor_country": "US",
|
|
"exact_purpose": "Cloudflare Bot Management — basis Bot-Erkennung.",
|
|
"data_collected": ["bot_score", "client_hash"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
"notes": "Strictly necessary nach §25(2) TDDDG (Sicherheit). Keine Einwilligung noetig.",
|
|
},
|
|
"aws-alb": {
|
|
"vendor": "Amazon Web Services Inc.", "vendor_country": "US",
|
|
"exact_purpose": "AWS Application Load Balancer Sticky Sessions — "
|
|
"routet Anfragen konsistent an dieselbe Backend-Instanz.",
|
|
"data_collected": ["target_instance_id"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "1 Stunde",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
"schrems_ii_status": "AWS Frankfurt verfuegbar — bei korrektem Region-Setup "
|
|
"kein US-Transfer.",
|
|
},
|
|
|
|
# ─── Retargeting / Advertising ────────────────────────────────────
|
|
"_pin_unauth": {
|
|
"vendor": "Pinterest Europe Ltd.", "vendor_country": "IE/US",
|
|
"exact_purpose": "Pinterest Tag — Conversion-Tracking + Audience-Aufbau.",
|
|
"data_collected": ["pinterest_user_id"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 762,
|
|
"typical_lifetime": "1 Jahr",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
},
|
|
"cto_dna": {
|
|
"vendor": "Criteo S.A.", "vendor_country": "FR",
|
|
"exact_purpose": "Criteo Dynamic Retargeting — produktspezifische "
|
|
"Werbeauslieferung basierend auf Browser-History.",
|
|
"data_collected": ["criteo_user_id", "product_views"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 91,
|
|
"typical_lifetime": "13 Monate",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "Criteo ist FR-basiert, aber Daten gehen auch in die USA. "
|
|
"Multi-Region-Setup pruefen.",
|
|
"notes": "Trotz FR-Sitz nicht automatisch DSGVO-konform — CNIL-Bussgeld "
|
|
"EUR 60M 2022 wegen mangelnder Einwilligungs-Granularitaet.",
|
|
},
|
|
"afm": {
|
|
"vendor": "Adform A/S", "vendor_country": "DK",
|
|
"exact_purpose": "Adform Audience Matching — Cross-Device-Identifikation "
|
|
"fuer programmatische Werbung.",
|
|
"data_collected": ["adform_user_id", "device_signals"],
|
|
"ip_relevant": True,
|
|
"tcf_purpose_ids": [4, 9, 10],
|
|
"iab_vendor_id": 50,
|
|
"typical_lifetime": "30 Tage",
|
|
"reid_risk": "high",
|
|
"technical_necessity": "none",
|
|
"schrems_ii_status": "Adform ist DK-basiert, EU-Hosting Standard. Keine "
|
|
"Schrems-II-Probleme bei Standard-Setup.",
|
|
},
|
|
|
|
# ─── Consent / Funktional (Strictly Necessary) ────────────────────
|
|
"JSESSIONID": {
|
|
"vendor": "Java EE / Tomcat (Site-Software)", "vendor_country": "N/A",
|
|
"exact_purpose": "Server-Session-ID fuer Java-basierte Anwendungen.",
|
|
"data_collected": ["session_id"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
"notes": "Strictly necessary. Keine Einwilligung nach §25(2) TDDDG.",
|
|
},
|
|
"PHPSESSID": {
|
|
"vendor": "PHP (Site-Software)", "vendor_country": "N/A",
|
|
"exact_purpose": "PHP-Session-ID — serverseitige Sitzungs-Persistierung.",
|
|
"data_collected": ["session_id"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "Session",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
},
|
|
"cookie_consent": {
|
|
"vendor": "BreakPilot Consent-Banner (own)", "vendor_country": "DE",
|
|
"exact_purpose": "Speichert die Einwilligungsentscheidung des Nutzers "
|
|
"pro Kategorie.",
|
|
"data_collected": ["consent_state_per_category", "timestamp"],
|
|
"ip_relevant": False,
|
|
"typical_lifetime": "180 Tage",
|
|
"reid_risk": "low",
|
|
"technical_necessity": "full",
|
|
"notes": "Strictly necessary nach Art. 7(1) DSGVO Nachweispflicht.",
|
|
},
|
|
|
|
# ─── Templated / pattern-based entries (Suffix variabel) ──────────
|
|
# Diese werden via regex-Lookup gefangen, der Eintrag dient als Fallback.
|
|
"_uet_": {
|
|
"vendor": "Microsoft Corp.", "vendor_country": "US",
|
|
"exact_purpose": "Microsoft Universal Event Tracking — Suffix nach `_uet_`.",
|
|
"data_collected": ["event_id"],
|
|
"ip_relevant": True,
|
|
"typical_lifetime": "30 Minuten",
|
|
"reid_risk": "medium",
|
|
"technical_necessity": "none",
|
|
},
|
|
}
|
|
|
|
|
|
# ─── Pattern-Lookup fuer Cookies mit variablem Suffix ───────────────
|
|
|
|
_PATTERN_LOOKUPS: list[tuple[str, str]] = [
|
|
(r"^_ga_[A-Z0-9_]+$", "_ga_*"),
|
|
(r"^_gat_gtag_UA_", "_gat_gtag_UA_"),
|
|
(r"^AMCV_", "AMCV_"),
|
|
(r"^_uet[a-z]+", "_uet_"),
|
|
(r"^aws-alb", "aws-alb"),
|
|
(r"^_pk_id\.", "_pk_id"),
|
|
(r"^_pk_ses\.", "_pk_ses"),
|
|
]
|
|
|
|
|
|
def lookup_cookie(name: str) -> CookieKnowledge | None:
|
|
"""Return rich knowledge for a cookie name, or None if unknown."""
|
|
import re
|
|
if not name:
|
|
return None
|
|
# Direct hit
|
|
if name in KB:
|
|
return KB[name]
|
|
# Pattern-based
|
|
for pattern, kb_key in _PATTERN_LOOKUPS:
|
|
if re.search(pattern, name):
|
|
return KB.get(kb_key)
|
|
# Strip common suffixes (.bmw.de, .domain etc.)
|
|
base = name.split(".", 1)[0]
|
|
if base != name and base in KB:
|
|
return KB[base]
|
|
return None
|
|
|
|
|
|
def enrich_vendor_with_knowledge(vendor: dict) -> dict:
|
|
"""Add per-cookie knowledge to each cookie in vendor['cookies']."""
|
|
cookies = vendor.get("cookies") or []
|
|
enriched = []
|
|
for c in cookies:
|
|
info = lookup_cookie(c.get("name", ""))
|
|
if info:
|
|
enriched.append({**c, "knowledge": info})
|
|
else:
|
|
enriched.append(c)
|
|
return {**vendor, "cookies": enriched}
|
|
|
|
|
|
# ─── Hilfen fuer Aggregate-Reports ──────────────────────────────────
|
|
|
|
def summarize_compliance_risk(vendor: dict) -> dict:
|
|
"""Aggregiere Re-ID-Risiko + Drittland-Status ueber alle Cookies eines Vendors."""
|
|
cookies = vendor.get("cookies") or []
|
|
risk_counts = {"high": 0, "medium": 0, "low": 0}
|
|
schrems_affected = 0
|
|
technical_only = 0
|
|
for c in cookies:
|
|
k = c.get("knowledge") or lookup_cookie(c.get("name", ""))
|
|
if not k:
|
|
continue
|
|
risk = k.get("reid_risk", "low")
|
|
risk_counts[risk] = risk_counts.get(risk, 0) + 1
|
|
if "us" in k.get("vendor_country", "").lower() or "schrems" in k.get("schrems_ii_status", "").lower():
|
|
schrems_affected += 1
|
|
if k.get("technical_necessity") == "full":
|
|
technical_only += 1
|
|
return {
|
|
"reid_risk_distribution": risk_counts,
|
|
"high_risk_cookie_count": risk_counts["high"],
|
|
"schrems_ii_affected_cookies": schrems_affected,
|
|
"strictly_necessary_cookies": technical_only,
|
|
"total_classified": sum(risk_counts.values()),
|
|
}
|
|
|
|
|
|
# ─── TEMPLATE_ENTRY (fuer Kuratierung neuer Cookies) ───────────────
|
|
|
|
TEMPLATE_ENTRY: CookieKnowledge = {
|
|
"vendor": "<Voller Firmenname>",
|
|
"vendor_country": "<ISO-2 Code oder 'IE/US' bei Doppel-Standort>",
|
|
"exact_purpose": "<1-2 Saetze was der Cookie GENAU tut>",
|
|
"data_collected": ["<feldname_1>", "<feldname_2>"],
|
|
"ip_relevant": False,
|
|
"ip_anonymized": False,
|
|
"tcf_purpose_ids": [], # TCF v2.2: 1-11
|
|
"iab_vendor_id": None, # Aus https://iabeurope.eu/tcf-vendor-list/
|
|
"typical_lifetime": "<Session | XX Tage | XX Monate | XX Jahre>",
|
|
"reid_risk": "low", # low | medium | high
|
|
"technical_necessity": "none", # none | partial | full
|
|
"schrems_ii_status": "<Drittlandtransfer-Bewertung>",
|
|
"eugh_rulings": [],
|
|
"eu_alternative_cookies": [],
|
|
"eu_alternative_vendor": "",
|
|
"notes": "",
|
|
}
|