# Changelog of SiteVerdict — Cookie & Privacy Policy Checker + Draft Generator (`siteverdict/siteverdict-privacy-policy-checker`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-privacy-policy-checker/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-privacy-policy-checker.md

## Changelog

### 2.0.0 (2026-10-11) - shared accuracy engine + client reports

- **Shared SiteVerdict consent engine v2.0** (same as the Consent Auditor):
  - Reject/Accept read-back from the CMP and confidence on every finding ("check manually" items are not scored);
  - wrong-click guards and late-banner wait;
  - closed shadow DOM banners;
  - consent-or-pay detection;
  - bot-protection pages reported as `blocked` (not charged);
  - Google CMP and Transcend support.
- **Fix: "after Reject" double counting.** It now counts only cookies/storage that are **new** after the click. Previously, a cookie set before consent and still present after Reject was also reported as "after Reject" (critical).
- **Fix: what counts as a tracker firing.** These no longer count: library downloads (incl. session-replay scripts), cookieless Consent Mode / UET pings, Google limited-ads requests, and embedded video players.
- **Fix: generic cookie names.** `sb`, `SM`, `UID`, `MUID`, `bcookie`… are only matched on the vendor's domain. Google `AEC` / `SOCS` are strictly necessary. YouTube `YSC` is functional.
- **New: client report** (`clientReport`). White-label HTML + PDF per site with a first-visit screenshot. Event `client-report`.
- **New: monitoring mode.** Detects:
  - policy text changes (hash only, the text is not stored);
  - policy URL and "last updated" changes;
  - new cookies not in the policy;
  - new cookies before consent;
  - new/resolved issues.
- **New: alerts** to Slack / HTTPS webhook (event `alert-sent`).
- **New: AI-drafted policy wording** with the user's own Anthropic / OpenAI key (event `ai-fix-generated`). Uses placeholders for anything not observed; DRAFT, not legal advice.

### 1.0 (11 Oct 2026)

- First release.
- **Cookie and storage inventory** across three consent scenarios: no click, Reject, Accept.
  - Covers cookies, localStorage, sessionStorage and third-party tags.
  - Each item gets a purpose category, provider, party, expiry and its consent state.
- **Policy discovery.** Finds policy links in the footer, header and cookie banner, links from the privacy notice, and common paths (robots.txt respected).
  - Layered/hub notices are expanded with up to 8 sub-pages.
  - Short cookie pages are expanded with their "detailed cookie information" page.
- **Policy checks:**
  - UK GDPR Art 13/14 privacy-notice elements, with evidence quotes and section headings.
  - Cookie-policy elements.
  - Inventory ↔ policy matching, at three levels: name, name pattern, provider.
  - Providers that are observed but not named, and providers that are named but not observed.
- **ICO/PECR consent indicators:**
  - non-essential cookies before consent
  - tracking after Reject
  - no first-layer Reject
  - consent-or-pay
  - functional or unrecognised cookies set before consent
- EU ePrivacy notes.
- **DRAFT outputs.** A cookie-policy template (Markdown + HTML), a cookie table (Markdown) and the inventory (CSV), all clearly marked "DRAFT – not legal advice".
- **Pay-per-event pricing:** `site-checked` and `draft-generated`. The run stops at the user's maximum total charge, and failed or empty work is never charged.
- Detection logic for vendors, CMPs and cookies is copied from the SiteVerdict Tracking & Consent Auditor, with added functional vendors (Intercom, Zendesk, tawk.to, Stripe, reCAPTCHA, Contentsquare, SpeedCurve, Klaviyo).