<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-consent-management
description: >-
  Implement consent management platforms and workflows to collect, store, and
  enforce user consent per GDPR Article 7, CCPA opt-out rights, and the IAB
  Transparency & Consent Framework (TCF).
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - consent
  - gdpr
  - ccpa
  - tcf
  - consent-management
  - lawful-basis
  - opt-out
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Consent Management

## Overview

Consent management ensures that personal data processing is lawful by collecting,
recording, and enforcing user consent decisions. This skill covers implementing
consent collection workflows compliant with GDPR Article 7 (conditions for consent),
CCPA/CPRA opt-out mechanisms, and the IAB Transparency & Consent Framework (TCF 2.2)
for advertising ecosystems.

Mode: `[MODE: PRIVACY]` — Consent lifecycle and regulatory compliance.

## Prerequisites

| Requirement | Details |
|---|---|
| Understanding of GDPR Article 6(1)(a) consent as lawful basis and Article 7 conditions | Required |
| Knowledge of CCPA §1798.120 (right to opt out) and CPRA amendments | Required |
| Familiarity with IAB TCF 2.2 specification for ad-tech consent | Required |
| Python 3.10+ for consent management tooling | Required |
| Database for consent record storage (audit trail) | Required |

## Key Concepts

### GDPR Consent Requirements (Article 7)

```text
Valid consent must be:
  ✓ Freely given — no bundling, no detriment for refusal
  ✓ Specific — per-purpose consent, not blanket
  ✓ Informed — clear language, identity of controller, purposes
  ✓ Unambiguous — affirmative action (no pre-ticked boxes)
  ✓ Withdrawable — as easy to withdraw as to give
  ✓ Documented — controller must demonstrate consent was given
```

### Consent Record Schema

```json
{
  "consent_id": "uuid",
  "subject_id": "hashed_user_id",
  "purposes": ["analytics", "marketing", "personalization"],
  "granted": ["analytics"],
  "denied": ["marketing", "personalization"],
  "timestamp": "2026-01-15T10:30:00Z",
  "method": "banner_interaction",
  "version": "policy_v2.1",
  "ip_hash": "sha256_truncated",
  "user_agent": "anonymized",
  "withdrawal_timestamp": null
}
```

### IAB TCF 2.2 Integration

```bash
# Decode a TCF consent string
node scripts/agent.js --action decode-tcf \
  --consent-string "CPXxRfAPXxRfAAfKABENB-CgAAAAAAAAAAYgAAAAAAAA"

# Validate vendor consent against TCF purposes
node scripts/agent.js --action validate-vendor \
  --vendor-id 755 --purposes "1,2,7,9" --consent-string "TCF_STRING"
```

### CCPA Opt-Out Implementation

```bash
# Register CCPA opt-out signal
node scripts/agent.js --action ccpa-optout \
  --subject-id "user_hash_123" --sale-categories "advertising,analytics"

# Check Global Privacy Control (GPC) header
node scripts/agent.js --action check-gpc \
  --headers '{"Sec-GPC": "1"}'
```

## Workflow

### Step 1: Define Consent Purposes

```bash
node scripts/agent.js --action define-purposes \
  --purposes '[
    {"id":"essential","name":"Essential Cookies","required":true},
    {"id":"analytics","name":"Analytics","required":false},
    {"id":"marketing","name":"Marketing","required":false}
  ]' --output /tmp/purposes.json
```

### Step 2: Record Consent Decision

```bash
node scripts/agent.js --action record \
  --subject-id "user_abc" --granted "essential,analytics" \
  --denied "marketing" --policy-version "v2.1" \
  --output /tmp/consent_record.json
```

### Step 3: Validate Consent Before Processing

```bash
node scripts/agent.js --action validate \
  --subject-id "user_abc" --purpose "marketing"
```

### Step 4: Process Withdrawal

```bash
node scripts/agent.js --action withdraw \
  --subject-id "user_abc" --purpose "analytics"
```

## Verification

- [ ] Consent collected per-purpose (no blanket consent)
- [ ] No pre-ticked boxes — affirmative opt-in only
- [ ] Withdrawal mechanism equally accessible as granting
- [ ] Consent records include timestamp, version, method, purposes
- [ ] GPC/DNT signals respected where legally required
- [ ] TCF consent string decoded and validated before vendor processing
- [ ] Consent audit trail retained for controller's accountability obligation (Art. 5(2))
- [ ] Re-consent triggered on material privacy policy changes

## References

- [GDPR Article 7 — Conditions for Consent](https://gdpr-info.eu/art-7-gdpr/)
- [GDPR Recital 32 — Conditions for Consent](https://gdpr-info.eu/recitals/no-32/)
- [IAB TCF 2.2 Specification](https://iabeurope.eu/transparency-consent-framework/)
- [CCPA §1798.120 — Right to Opt Out](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5)
- [Global Privacy Control Specification](https://globalprivacycontrol.org/)
