# Manage consent and privacy controls

**Flow key:** `consent-and-privacy-controls`

## Outcome

A person can understand, grant, deny, change, and prove granular consent, and the decision propagates to actual collection, use, sharing, and communication.

## Actors

- User/visitor
- Consent service
- Analytics/marketing systems
- Privacy/compliance owner

## Preconditions and entry points

- Purposes, legal basis, regions, vendors, defaults, retention, and withdrawal behavior are known.
- Test instrumentation can observe actual data flows.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| User context | new visitor in consent-required region | returning, signed in, minor/age-gated, other region |
| Purposes | necessary, analytics, personalization, marketing | vendor-level, new purpose/version |
| Choice | deny optional then grant analytics | accept all, granular, withdraw all |
| Storage | fresh browser | existing consent record, blocked cookies, cross-device account |
| Evidence | network/log observation of tagged data flows | third-party script delayed or unavailable |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Enter with no consent record. | Notice is timely, accessible, purpose-specific, and non-manipulative; necessary processing is distinguished. |
| 2 | Deny optional purposes. | The choice saves before optional collection and the product remains usable where promised. |
| 3 | Inspect network/storage and reopen controls. | Optional vendors/events are absent and the saved choice is accurate. |
| 4 | Grant one optional purpose. | Only that purpose begins and the receipt records version, time, region, and subject. |
| 5 | Withdraw consent. | Future processing stops and downstream revocation/deletion behavior follows policy. |
| 6 | Change policy/vendor list or use another device. | Re-consent and synchronization occur only under explicit rules. |

## Alternate paths

- Cookie banner
- Account marketing preferences
- Vendor-level controls
- Minor/parental consent
- Global privacy signal

## Failure and recovery paths

- Tracking fires before choice
- Deny button is obscured
- Withdrawal does not reach vendors
- Stale consent version accepted
- Consent API fails but UI claims success

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [privacy](../../items/quality/privacy.md)
- [policy](../../items/automation/policy.md)
- [checkbox](../../items/controls/checkbox.md)
- [audit](../../items/automation/audit.md)

[Back to Engagement and support flows](index.md)
