Glossary
The words behind cookie banners
Short definitions you can quote, then the detail.Adequacy decisionAn adequacy decision is a European Commission decision that a non-EU country, territory or framework provides an essentially equivalent level of data protection, so personal data can flow there without further safeguards.
AnonymizationAnonymization is the irreversible transformation of personal data so that no individual can be identified by any means reasonably likely to be used, which takes the resulting data outside data protection law altogether.
CMPA consent management platform (CMP) is the software that shows the cookie banner, blocks trackers until the visitor chooses, records the choice and passes it to tags, advertising frameworks and Google Consent Mode.
ConsentConsent, in data protection law, is a freely given, specific, informed and unambiguous indication of a person's wishes, expressed by a statement or a clear affirmative action, that allows the processing of their personal data.
Consent ModeGoogle Consent Mode is the mechanism by which a website tells Google tags (Analytics, Ads, Tag Manager) whether the visitor has consented, so the tags adjust what they store and send instead of being blocked outright.
Consent withdrawalConsent withdrawal is the right to take back consent at any time, and the law requires that withdrawing be as easy as giving it.
CookieA cookie is a small text record that a website stores in the visitor's browser and that the browser sends back with every later request to the same domain, so the site can recognize the browser.
Cookie policyA cookie policy is the page that lists the cookies and similar technologies a website uses, with their purpose, provider, lifetime and legal basis, and explains how visitors can change or withdraw their choices.
Cookie wallA cookie wall is a barrier that blocks access to a website or its content until the visitor accepts tracking cookies, with no way to continue without consenting.
Dark patternA dark pattern is an interface design that steers people into choices they would not otherwise make, such as a cookie banner where accepting takes one click and refusing takes several.
Data controllerThe data controller is the person or organization that determines the purposes and means of processing personal data, and therefore carries the legal responsibility for it.
Data layerThe data layer is a JavaScript array (dataLayer in Google Tag Manager) into which a website pushes events and values, such as the visitor's consent choice, so that tags and triggers can react to them.
Data processorA data processor is an organization that processes personal data on behalf of a controller and only on its documented instructions, such as a hosting provider, an email service or an analytics vendor acting for the website.
Do Not TrackDo Not Track (DNT) is a browser setting from 2009 that added a DNT: 1 header asking websites not to track the user; it was never legally binding, most sites ignored it, and browsers have been removing it in favor of Global Privacy Control.
DPADPA most often means a Data Processing Agreement, the contract Article 28 of the GDPR requires between a controller and a processor; the same initials also stand for Data Protection Authority, the national regulator.
DPIAA Data Protection Impact Assessment (DPIA) is the documented analysis a controller must carry out before processing that is likely to result in a high risk to people's rights, describing the processing, its necessity and the measures that address the risks.
DPOA Data Protection Officer (DPO) is the person an organization designates to inform and advise on data protection, monitor compliance and act as the contact point for data subjects and the supervisory authority.
ePrivacyePrivacy refers to the EU's Directive 2002/58/EC on privacy and electronic communications, the law that requires consent before cookies and similar technologies are stored on or read from a user's device.
FingerprintingFingerprinting identifies a browser or device without storing anything on it, by combining dozens of observable attributes such as the user agent, screen size, fonts, time zone, hardware and canvas rendering into a signature that is stable enough to recognize the same visitor again.
First-party cookieA first-party cookie is set by the domain shown in the browser's address bar, so only that website (and scripts running on it) can read it.
GPCGlobal Privacy Control (GPC) is a browser setting that sends a Sec-GPC: 1 header and a JavaScript flag to every website, telling it that the visitor refuses the sale or sharing of their personal data, which several US state laws require businesses to honor as a valid opt-out.
Granular consentGranular consent lets a visitor accept or refuse each purpose of processing separately, for example analytics but not advertising, instead of a single all-or-nothing choice.
IAB TCFThe IAB Transparency and Consent Framework (TCF) is the advertising industry's standard, run by IAB Europe, for collecting and passing on users' consent and objections to hundreds of advertising vendors in a single encoded string.
Legal basisA legal basis is one of the conditions listed in a data protection law that makes processing personal data lawful, such as consent, a contract, a legal obligation or legitimate interest.
Legitimate interestLegitimate interest is the legal basis in Article 6(1)(f) of the GDPR that allows processing necessary for a controller's or third party's interests, unless the interests or rights of the data subject override them.
Local storageLocal storage is the browser's Web Storage API, which lets a website keep key-value data on the device without sending it with every request; legally it is treated like cookies, because it stores information on the user's terminal equipment.
Persistent cookieA persistent cookie carries an expiry date and stays in the browser until that date or until the user deletes it, so a site can recognize the browser across visits.
Personal dataPersonal data is any information relating to an identified or identifiable natural person, including online identifiers such as cookie IDs, advertising IDs and IP addresses that can single someone out.
PixelA tracking pixel is a tiny, usually invisible image or script request loaded from a third-party server that reports the page view, the visitor's identifiers and events such as purchases to that third party.
Prior consentPrior consent means that consent is obtained before a cookie is set or a tracker runs, so that nothing non-essential is stored or read on the device until the visitor has made a positive choice.
Privacy policyA privacy policy is the document in which an organization tells people what personal data it collects, why, on what legal basis, with whom it shares it, how long it keeps it, where it transfers it and what rights they have.
Proof of consentProof of consent is the record a website keeps to demonstrate that a visitor gave valid consent: when, to what, through which banner version, and in which language.
PseudonymizationPseudonymization is processing personal data so that it can no longer be attributed to a specific person without additional information kept separately, for example by replacing names with codes or hashing an IP address with a secret salt; the data remains personal data.
Reject allReject all is the button on a cookie banner that refuses every non-essential cookie in one click, and regulators expect it to be as visible and as easy to use as Accept all.
SCCStandard Contractual Clauses (SCCs) are contract templates adopted by the European Commission that allow personal data to be transferred to a country without an adequacy decision, by binding the recipient to GDPR-level obligations.
Session cookieA session cookie has no expiry date and is deleted when the browser session ends, so it only lasts for a single visit.
Supervisory authorityA supervisory authority is the independent public body that monitors and enforces data protection law in a country, handles complaints, investigates and imposes fines, such as the CNIL in France or the ICO in the United Kingdom.
Tag managerA tag manager is a tool that loads a website's marketing and analytics scripts (tags) from a single container and fires them on configurable triggers, so that consent can be enforced in one place.
TC StringThe TC String is the compact, base64-encoded record generated by a TCF consent management platform that encodes a user's consent and objections per purpose and per vendor, and that advertising systems read to decide what they may do.
Third-party cookieA third-party cookie is set by a domain other than the one in the address bar, typically by an advertising network, a social media widget or an embedded video player, and lets that domain recognize the same browser across many websites.