CONSENT MANAGEMENT PROVIDERS (CMPs)

No, the CMP will not necessarily need to have consent to set a cookie to capture and store consent state. We consider that setting a cookie to manage and respect a user’s choices as required by the law falls under a necessity exception.

Once the CMP has read and stored a user’s consent status it is important to understand how that consent status is handled.

There are two consent states in the protocol:

• No Consent (0), which could include new users who have not yet been asked for their consent, users who have said no, or users who have revoked consent
• Consent (1)

Possible consent states that will not be explicitly signalled include:

• Revoked – this can, however, be determined based on the audit trail held by the vendor. NOTE: Revocation is not the same as a user requesting right to access or deletion of data.
• New User – this can be determined by the absence of a stored consent signal.

Initially, CMPs and publishers will host their own revocation pages, and when consent is revoked, the consent status will be updated in the storage medium from 1 to 0.

The lifespan of consent differs from case to case. Consistent with what regulatory authorities have interpreted to be a reasonable lifespan of a cookie under the ePrivacy Directive, as guidance, consent should be valid for 13 months before a refresh or reminder is recommended.

Yes, vendors must report global consent changes to the CMP. Vendors should also report publisher-specific consent changes to the CMP if possible. 

Publisher-specific consent status overrules a global consent status for that service. For example, a user gives global consent for data processing by a particular vendor on Site A. User then visits Site B and is prompted for publisher-specific consent and says no. Result: vendor has global consent except on Site B. When comparing two like signals, for example both conveying publisher-specific consent, then the signal with the most recent timestamp prevails. CMPs must resolve conflicts before transmitting any consent signal in the DaisyBit mechanism.