Privacy panel vs security panel
AHQ-PRV findings live under Lab → Privacy (observation). They do not dock Best practices the way a missing CSP does. That split keeps a marketing pixel conversation from looking like a transport failure.
GPC and California-style “Your Privacy Choices” signals share the same panel; this article focuses on the EU-shaped cookie and consent patterns in the same rule family.
Signals mapped to familiar EU discussions
Cookies on the first response before any interaction — structural pattern discussed under ePrivacy Art 5(3); purpose still cannot be judged from outside. Tracking pixels inside noscript — a JS CMP cannot suppress them. Tracker scripts without a recognised consent gate attribute. First-layer consent UI where Reject is missing, pre-ticked, or demoted to a text link while Accept is a button (EDPB-recognised patterns).
Every row carries wording that scope and exemptions cannot be determined from outside the site. That is the product promise.
What to do with a privacy fail
Defer non-essential Set-Cookie until after consent where required, remove noscript marketing pixels, gate tags, and give Reject equal prominence. Re-audit; do not ask an LLM to invent a DPIA from the finding text alone.
Pair with the GPC article when you also need Sec-GPC acknowledgment and gpc.json — related signals, different regulations.