Independently verify OneTrust / CookiePro in Brazil

The Brazil test

Compare the local banner controls with the saved purpose choices. Read the Brazilian configuration in the deployed CMP, follow optional-category refusal, and inspect the result. Include the preferences entry point used to change a choice later; translated banner text alone doesn't prove a Brazil rule matched.

Set expected behavior with your policy owner before testing. Business scope, data purposes, and exceptions affect that expectation. Use the Brazil ANPD: cookies and personal data guide as a policy reference; this procedure checks browser behavior and does not certify legal compliance.

CookieTrail does not currently offer a Brazil country route. Use a separately verified regional browser exit for this procedure.

Run the same paths from a verified visitor

1. Confirm routing. Record the browser exit and the regional rule OneTrust / CookiePro actually selected. Browser language, timezone, and a DevTools location override are not proof of IP-based routing.
2. Start clean. Use separate new sessions for first load, acceptance, and rejection or opt-out. Begin storage and network capture before page load; record the capture window and deployed version.
3. Read the decision. Save the banner controls used, the category or purpose values, and any Consent Mode mapping. Use this installation’s documented readback.
4. Compare and repeat. Compare observed tools with the expected policy, investigate a mismatch, and rerun the same URL, regional rule, and paths after deployment.

Read OneTrust / CookiePro’s saved state

Check active group IDs against the categories in the deployed OneTrust configuration.

1. Record the deployed data-domain-script value and the published regional configuration. Check that the visitor matched the intended rule.
2. Read OnetrustActiveGroups after initialization and after each decision. Map its group IDs to this site's category definitions; do not assume the same IDs mean the same thing on every site.
3. Check listeners for OneTrustGroupsUpdated and the tag integrations consuming it. A group update without a corresponding tag update leaves the test incomplete.

Read the OneTrust JavaScript events for your installed configuration.

(() => ({
  activeGroups: window.OnetrustActiveGroups ?? null,
  note: "Map group IDs using this site's published categories."
}))()

(() => {
  if (typeof window.__tcfapi !== "function")
    return { status: "TCF unavailable or disabled" };
  window.__tcfapi("addEventListener", 2, (data, ok) => {
    if (!ok || !data ||
        !["tcloaded", "useractioncomplete"].includes(data.eventStatus))
      return;
    console.log({
      cmpId: data.cmpId,
      expectedCmpId: 28,
      identityMatches: data.cmpId === 28,
      cmpStatus: data.cmpStatus,
      eventStatus: data.eventStatus,
      gdprApplies: data.gdprApplies,
      purposeConsents: data.purpose?.consents,
      purposeLegitimateInterests: data.purpose?.legitimateInterests
    });
    window.__tcfapi("removeEventListener", 2,
      () => {}, data.listenerId);
  });
})()

Compare state with observed activity

A saved denial can coexist with a tag that ran too early or never received the update. Trace the affected integration and its event timing. A network request alone does not prove a violation: Google’s advanced Consent Mode can send cookieless requests.

Unreadable state, unverified routing, or a missing capture makes the result inconclusive. Browser captures also cannot establish what a server-side integration does. Keep that investigation separate and compare evidence after the fix.