Cookie consent glossary

Software that asks website visitors for consent to cookies and tracking, stores their choice, blocks non-essential scripts until consent is given and passes the choice on to tags and ad partners.

In GetCookies: GetCookies is a CMP for websites. It does not cover native mobile apps. See features.

Google's interface that tells Google tags what a visitor agreed to through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Tags set defaults before consent and adjust when the CMP sends an update. Google requires it for advertising to visitors in the EEA.

In GetCookies: On every plan, the loader sets the four signals before your tags run (denied until the visitor chooses), and each choice is sent as an update through Google's tag (gtag.js) or the GetCookies GTM template. Visitor-region detection, URL passthrough and ads data redaction need Pro. See Google Consent Mode v2.

The Transparency and Consent Framework from IAB Europe is a standard for passing consent to advertising vendors. The CMP encodes the visitor's choices per purpose and vendor in a TC string that vendors read through the __tcfapi interface.

In GetCookies: GetCookies has TCF 2.3 built in for Pro and above and starts issuing TC strings once it is a registered IAB Europe CMP. See the TCF configuration guide.

A CMP that IAB Europe has validated and listed with a CMP ID. Many ad exchanges only accept TC strings from registered CMPs. Google separately keeps a list of certified CMPs for serving ads in the EEA, the UK and Switzerland.

In GetCookies: GetCookies is not registered with IAB Europe and not on Google's certified list yet. If your ad partners require either, compare registered alternatives.

Stopping non-essential scripts from running until the visitor has consented, rather than only showing a banner. Under the GDPR and the ePrivacy rules, consent has to come before non-essential cookies are set.

In GetCookies: GetCookies holds back scripts that match your blocking rules or that you mark with type="text/plain" and data-cookieconsent, on every plan. It holds back scripts, not iframes. See data-attribute blocking.

A stored record of each consent decision, kept so the site owner can show when and how consent was given. Article 7(1) GDPR requires the controller to be able to demonstrate consent.

In GetCookies: Each record the GetCookies banner writes holds the choices, a timestamp, the browser's user-agent string, a SHA-256 hash of the visitor's random GetCookies visitor id, the visitor's region and compliance mode, and whether a GPC signal was present. The banner does not store the visitor's IP address. How long records are kept depends on the plan; see security.

A crawler that loads a site's pages and lists the cookies and trackers they set, so they can be categorised and declared.

In GetCookies: Free includes 3 scans a month of up to 50 pages each; scheduled scans start on Pro. See pricing.

Groups that visitors consent to instead of approving each cookie one by one. Strictly necessary cookies need no consent; the others do.

In GetCookies: GetCookies uses necessary, preferences, analytics and marketing. See cookie categories explained.

A page or table that lists each cookie a site uses, its purpose, provider and lifetime, usually linked from the cookie policy.

In GetCookies: GetCookies generates a cookie declaration from your scan results on Pro and above.

Showing a different consent experience depending on where the visitor is, for example opt-in under the GDPR and an opt-out link under California law.

In GetCookies: Geo-targeting is on Pro and above. See features.

Opt-in means nothing non-essential runs until the visitor agrees, which is the GDPR model. Opt-out means tracking may run until the visitor objects, which is the model of US state laws such as the CCPA.

In GetCookies: The JavaScript API reports the mode for each visitor with getComplianceMode(). See developers.

A browser signal through which a visitor asks sites not to sell or share their personal data. Several US state laws, including California's, require businesses to treat it as an opt-out.

In GetCookies: When enabled in your domain settings, GetCookies treats a GPC signal as an opt-out and records it in the consent log and webhooks.

Two Google Consent Mode settings for visitors who have not allowed advertising storage: URL passthrough keeps click information in page URLs instead of cookies, and ads data redaction strips ad click identifiers from requests.

In GetCookies: GetCookies turns both on for EEA visitors without marketing consent, on Pro and above.

The share of visitors who accept a category, usually reported separately for analytics and marketing. A higher rate means more measurable traffic, but banners must not push visitors with dark patterns.

In GetCookies: Consent analytics and banner A/B testing are on Pro and above. See consent analytics.