Glossary
The vocabulary, used precisely.
Consent vocabulary is used loosely in exactly the way that causes trouble — “cookies” meaning all storage, “consent” meaning a banner, “compliant” meaning nothing in particular. Here is what each term means on this site.
- CMP
- Consent Management Platform: the system that presents consent choices to visitors, records them and — if it is doing its job — controls what the site is allowed to run as a result. The last part is what separates a CMP from a banner.
- Cookie
- A small piece of data a site stores in the browser and sends back on later requests. Cookies are the most familiar storage mechanism and no longer the most important one, which is why regulators increasingly talk about “storage and access technologies” instead.
- Tracker
- An umbrella term for a third-party service that collects information about visitors. Useful shorthand, but not every third party is a tracker — a font host and an advertising pixel are both third parties and only one of them is the problem.
- Pixel
- A tiny image or script request whose purpose is the request itself: loading it tells the vendor a visitor was here. Blocking one is about preventing the request, not hiding an image.
- First-party cookie
- A cookie set on the domain the visitor is actually on. Often necessary for the site to work, and often also used for analytics, so “first-party” does not automatically mean “exempt”.
- Third-party cookie
- A cookie set by a domain other than the one being visited. Browsers restrict these heavily now, which has pushed tracking toward first-party storage and server-side collection rather than ending it.
- localStorage
- Browser storage that persists until it is cleared and is not sent with requests. It is storage and access in exactly the sense the rules care about, and a cookie-only scan misses it.
- Fingerprinting
- Identifying a device from the combination of its characteristics rather than from stored data. It is designed to survive cookie deletion, which is precisely why it is treated as an access technology in its own right.
- Consent
- A freely given, specific, informed and unambiguous indication of agreement. The word is doing a lot of work in that sentence, and each adjective has produced a regulatory decision somewhere.
- Opt-in
- Nothing non-essential runs until the visitor agrees. The default state before a decision is the part implementations get wrong.
- Opt-out
- Services may run until the visitor objects. Which model applies depends on jurisdiction and context, which is why DotCensus treats it as policy configuration rather than a global setting.
- Consent receipt
- A structured record of a decision: what was shown, under which policy and inventory version, what was granted and denied, and when. A boolean is not a receipt.
- Consent Manifest
- The machine-readable map from each service to its vendor, purpose, execution rule, storage and signal mappings. It is the contract between what a scan discovered and what the runtime enforces.
- Privacy Health
- Continuous verification: loading the site in fresh, refused and accepted states and comparing observed behaviour with the declared configuration. A completeness and drift signal — not a compliance certification.
- Preference center
- The control a visitor uses to review or change their decision after the first visit. If it is hard to find, the decision was arguably never revocable in practice.
- Purpose
- What data is being used for — analytics, personalization, advertising measurement. Purposes are what a person is actually agreeing to; categories are how they are grouped for display.
- Vendor
- The third party that receives or processes the data. Frameworks like TCF make the vendor list explicit rather than implied by whichever scripts happen to load.
- Consent Mode
- Google's mechanism for communicating consent state to Google tags through documented consent types, so tags adjust behaviour rather than simply being removed. It has a basic and an advanced deployment model and they behave differently.
- TCF
- The IAB Europe Transparency and Consent Framework: a standardized way for publishers, CMPs and advertising vendors to exchange consent signals, currently moving to v2.4 for the web. Support requires registration and conformance, which is a process with an outcome.
- GPP
- The IAB Tech Lab Global Privacy Platform: one transport carrying jurisdiction-specific privacy strings, so a site does not need a separate mechanism per region.
- GPC
- Global Privacy Control: a signal a browser can send expressing an opt-out preference. Whether it is legally binding depends on jurisdiction, so a runtime should detect it and let policy decide its effect.
- SBOM
- A Software Bill of Materials — the components inside a piece of software. Borrowed here as an analogy: a website has a comparable inventory of services, and almost nobody maintains one.
- Storage and access technologies
- The broader category regulators now use: cookies, pixels, web storage, fingerprinting, scripts and tags. Naming it this way is why DotCensus scans storage and requests rather than only cookies.
Know what runs before you ask visitors to trust it.
Start with a scan of what your website loads today. The list is usually longer than the team expects, and that is the useful part.
No code to install for a scan Public pages only DotCensus runs on DotCensus