# Indirect collection notice verification

Requirements: **REQ-NZ-INDIRECT**, **REQ-PRODUCT-INDIRECT-NOTICE**.

The automated suite exercises deterministic identities, explicit advance/collected wording, intact pinned privacy artifacts, selected indirect categories, source/collector separation, explicit recipient/law/access decisions and absolute plain-text links. It rejects direct-only purposes, mismatched subsets, unsafe links, unexpected/private fields, malformed enums, oversized data, getters, executable serialization and cycles. Digest/fact verification rejects tampering even where structural normalization accepts a shape. Explicit preview gates cover draft privacy and notice wording.

Rendering checks keep core particulars out of collapsed/hidden containers, escape supplied text, preserve unique instance IDs and avoid consent/submission controls. A React SSR test, isolated packed Astro consumer, packed TypeScript consumer and optional browser bundle check cover the published interfaces. Earlier direct notices remain covered by their existing suite, including indirect-only rejection.

The website includes light/dark script-free examples, downloadable descriptors/text and reviewed-context guidance. Host tests check that these pages do not access an evidence store and that pinned privacy bytes match the release. Chrome layout inspection covered the normal 1728px desktop viewport and a 390 × 844 mobile viewport in both themes, with no horizontal overflow. The main notice’s pinned privacy link was followed successfully. This does not prove physical-device, browser-zoom, other-engine or assistive-technology acceptance.

No test establishes that an individual was notified, understood the notice, or qualifies for an exception. Actual delivery, reasonable timing, lawful collection, factual review, applicable codes and sector-specific rules remain outside this component. The requirement stays partial and legally unreviewed.