The vocabulary of consent, defined against a working system.

Cookie banner

The interface that tells a visitor what optional technologies a site wants to use and collects their decision, and, under an opt-in model, the thing standing between those technologies and the page.

Also called: Consent notice, cookie notice

Prior consent

Consent obtained before the storage or access it authorises, rather than during or after that act; exemptions and the validity of consent still require their own analysis.

Source: ePrivacy Directive Art. 5(3)

Implied consent

Consent inferred from a person’s action or from their failure to object, available under some regimes for non-sensitive purposes and unavailable in prior-consent jurisdictions.

Available in: Canada (PIPEDA), for non-sensitive purposes

Consent withdrawal

A visitor revoking a permission they previously gave, which has to be as easy as giving it, and has to actually stop the technology it authorised.

Source: GDPR Art. 7(3); LGPD Art. 8 §5

Consent record

The stored evidence of one visitor’s decision (who, what, when, under which policy version and which regional rule), which is what "demonstrate consent" actually means.

Required by: GDPR Art. 7(1); LGPD Art. 8 §2

Consent category

The unit a visitor actually decides about: a named purpose such as analytics or marketing that a set of technologies is attached to.

Default set: Necessary, functional, analytics, marketing, media

Custom purpose

A consent category you define yourself, with its own key, its own description and its own independently stored decision.

Key format: custom_ plus a lowercase identifier

Preference centre

The per-category interface a visitor uses to make or change a decision, reachable after the first choice as well as at it.

Purpose: Granular choice and withdrawal

First-party cookie

A cookie stored on the domain the visitor is actually on, which says who holds it, not who benefits from it, and therefore says nothing about whether it needs consent.

Set for: The current host or an allowed parent Domain

Third-party cookie

A cookie stored on a domain other than the one the visitor is on, historically the backbone of cross-site advertising and now widely restricted by browsers.

Set on: A domain other than the site

Local and session storage

Browser storage APIs that hold data on the device without using cookies, and which are covered by the same consent rule, because the rule is about the device, not the format.

Covered by: ePrivacy Art. 5(3), same as cookies

Tracking pixel

A small piece of code (usually a script, sometimes a one-pixel image) whose job is to report an event to a vendor, typically for advertising measurement.

Common examples: Meta Pixel, TikTok Pixel, LinkedIn Insight

Tag manager

A container loaded once that can inject any number of other tags at runtime, which makes it a single point of control and a single point of failure for consent.

Examples: Google Tag Manager, Tealium, Ensighten

Script blocking

Preventing a third-party script from executing until its consent category is granted: the enforcement half of consent management.

Correct method: Do not create the element

Browser fingerprinting

Identifying a device from the characteristics it exposes (fonts, canvas rendering, screen metrics, timing) rather than from anything stored on it.

Stores: Nothing on the device

Google Consent Mode

Google’s signalling protocol, by which a site tells Google tags which consent states apply, and which only works if the denied defaults are set before the tags run.

Mechanism: gtag consent default and update calls

IAB TCF

The Transparency and Consent Framework, an advertising-industry protocol that encodes consent into a string vendors in the programmatic chain can read.

Artefact: The euconsent-v2 consent string

Global Privacy Control

A browser-level signal that communicates an opt-out of sale and sharing, legally binding in California and honoured automatically where the resolved model is opt-out.

Signal: navigator.globalPrivacyControl; Sec-GPC header

Do Not Track

An earlier browser signal expressing a preference not to be tracked that never achieved a generally binding, interoperable response standard, and which helps explain why GPC was designed differently.

Signal: DNT: 1 request header

Legal basis

The justification a regime requires before personal data may be processed at all, of which consent is one option, and not always the right one.

GDPR bases: Six, in Article 6(1)

Personal data

Information relating to an identified or identifiable person, a category broad enough to include the cookie identifier most people assume falls outside it.

GDPR definition: Article 4(1), includes online identifiers

Pseudonymisation

Processing data so it can no longer be attributed to a person without additional information kept separately: a risk-reduction measure, not an exit from data protection law.

Defined in: GDPR Article 4(5)

Data controller

The party that decides why and how personal data is processed, and, for the visitors of your website, that is you.

Test: Who determines purposes and means

Data processor

A party that processes personal data on a controller’s instructions, bound by a contract that limits what it may do with it.

Acts on: Documented instructions

Data subject request

A person exercising a right over their own data (access, erasure, rectification, portability, objection or withdrawal) with a clock attached.

Kinds tracked: Access, erasure, rectification, portability, objection, withdrawal

Privacy by default

The principle that the out-of-the-box configuration should be the most protective one, so a person who changes nothing is still protected.

GDPR: Article 25(2)

PECR

The Privacy and Electronic Communications Regulations 2003: the UK instrument that actually contains the cookie consent rule, separately from the UK GDPR.

Full name: Privacy and Electronic Communications (EC Directive) Regulations 2003

Dark pattern

An interface designed so the outcome the operator prefers is easier than the one the person would choose, and, in consent interfaces, a defect in the consent itself.

Effect: Consent may not be freely given

HAR capture

An HTTP Archive file (a browser’s complete record of the requests a page made), which turns "it looked fine when I checked" into something reviewable.

Format: JSON, exported from browser developer tools