{ "schemaVersion": "1.0", "corpus": "methodology", "title": "ConsentMark methodology v7.12", "version": "v7.12", "canonicalUrl": "https://www.consentmark.com/methodology/v7.12.json", "humanUrl": "https://www.consentmark.com/methodology/v7.12", "publisher": { "name": "Obscurity Ltd", "cro": "622475", "jurisdiction": "Ireland", "url": "https://obscurity.ie" }, "licence": { "name": "ConsentMark corpus compilation licence 1.0", "summary": "You may quote, cite and redistribute this corpus, in whole or in part, for any purpose, provided you attribute it to Obscurity Ltd and cite the canonical URL and the asOf date. You may not re-characterise it: presenting a value, a grade band, a gate or a consent state as saying something this corpus does not say, or presenting a derived work as the published corpus, is outside these terms.", "attributionRequired": true, "derivativeReCharacterisation": "not permitted" }, "citeAs": "ConsentMark. (2026, October 13). ConsentMark methodology v7.12. Obscurity Ltd (CRO 622475). https://www.consentmark.com/methodology/v7.12", "asOf": "2026-10-13", "generatedAt": "2026-10-14T07:50:35.332Z", "frozenAtPublication": "Frozen at publication. This corpus is the record as it stood on its asOf date. Corrections are published as new dated versions at their own URL, and nothing here is edited in place.", "engineVersion": "7.12", "scope": { "statement": "Assessments apply one standard. No information is stored on or read from a visitor's device for a non-essential purpose, and no tracking data is sent, before the visitor consents. A refusal is honoured, and no such tag fires before the consent banner is answered. In the EU and the EEA this standard rests on Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive), as amended by Directive 2009/136/EC and transposed into member states' national laws, read with the General Data Protection Regulation. In the United Kingdom it rests on Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which transposed Article 5(3), read with the UK GDPR, and the regulator is the Information Commissioner's Office. The grade is computed once, by the same rules, wherever a site is served. The Data (Use and Access) Act 2025 amended PECR to allow some storage and access without consent for limited purposes where its conditions are met. The grade does not reflect that change, so a UK site relying on it is still recorded as storing or sending before consent. Transfer findings read a destination's adequacy from the EU position. The methodology does not assess the CCPA/CPRA, the LGPD or any other regime. A finding is a departure from the standard above and is not a finding that any law was breached." }, "scoring": { "dimensions": [ { "key": "consent", "name": "Technical Consent Controls", "weightFull": 0.4, "weightFree": 0.5 }, { "key": "jurisdiction", "name": "Cross-Border Data Transfers", "weightFull": 0.2, "weightFree": null }, { "key": "cookieStorage", "name": "Pre-Consent Data Leakage", "weightFull": 0.15, "weightFree": 0.2 }, { "key": "tagManagement", "name": "Governance Controls", "weightFull": 0.15, "weightFree": 0.15 }, { "key": "thirdPartyVolume", "name": "Third-Party Exposure", "weightFull": 0.1, "weightFree": 0.15 } ], "weightSets": { "full": { "consent": 0.4, "jurisdiction": 0.2, "cookieStorage": 0.15, "tagManagement": 0.15, "thirdPartyVolume": 0.1 }, "free": { "consent": 0.5, "cookieStorage": 0.2, "tagManagement": 0.15, "thirdPartyVolume": 0.15 } }, "gradeBandMidpoints": { "A": 95, "B": 85, "C": 72, "D": 52, "F": 22, "I": 0 } }, "gates": [ { "code": "F1", "band": "F", "gradeCeiling": "F", "label": "Personal data found in tracking requests" }, { "code": "F2", "band": "F", "gradeCeiling": "F", "label": "Tracking active with no consent controls" }, { "code": "F3", "band": "F", "gradeCeiling": "F", "label": "Data collection starts before consent" }, { "code": "F4", "band": "F", "gradeCeiling": "F", "label": "Tracking fires on a fresh page load after consent was rejected, or cookies persist" }, { "code": "F5", "band": "F", "gradeCeiling": "F", "label": "Consent signals are contradicting each other" }, { "code": "D1", "band": "D", "gradeCeiling": "D", "label": "Consent platform not blocking all tracking" }, { "code": "D2", "band": "D", "gradeCeiling": "D", "label": "Post-reject tracking continues, but Consent Mode v2 downgrades the signal" }, { "code": "D3", "band": "D", "gradeCeiling": "D", "label": "Consent banner did not render - visitor had no opportunity to consent" }, { "code": "D4", "band": "D", "gradeCeiling": "D", "label": "Tracking was still sent to this vendor after the visit was rejected. The requests carry markers showing they continued an activity already under way before the rejection, rather than new collection started after it. This is recorded as a failure. The vendor was running before any consent decision was made - see the pre-consent finding above." }, { "code": "D5", "band": "D", "gradeCeiling": "D", "label": "An infrastructure vendor kept sending after the rejection; no advertising or analytics vendor did" }, { "code": "C1", "band": "C", "gradeCeiling": "C", "label": "Rejecting consent is harder than accepting it" }, { "code": "C2", "band": "C", "gradeCeiling": "C", "label": "Data sent outside EU/UK/DPF-adequate jurisdictions without safeguards visible to an external scan" }, { "code": "C3", "band": "C", "gradeCeiling": "C", "label": "Vendor consent signal contradicts user rejection" }, { "code": "B1", "band": "B", "gradeCeiling": "B", "label": "Some tracking before consent, but in restricted mode" }, { "code": "B2", "band": "B", "gradeCeiling": "B", "label": "Tag manager fires before consent, but tracking is gated" }, { "code": "B3", "band": "B", "gradeCeiling": "B", "label": "Self-managing consent tool active before consent platform" }, { "code": "B4", "band": "B", "gradeCeiling": "B", "label": "Non-tracking widgets load pre-consent" }, { "code": "B5", "band": "B", "gradeCeiling": "B", "label": "Google-hosted fonts loaded before consent (third-party data transfer)" }, { "code": "B6", "band": "B", "gradeCeiling": "B", "label": "Collection call before consent to a first-party endpoint" }, { "code": "B7", "band": "B", "gradeCeiling": "B", "label": "Collection call before consent to an endpoint outside the site's own domain" }, { "code": "B8", "band": "B", "gradeCeiling": "B", "label": "Cookieless Consent Mode pings continued after Reject" } ], "crossBorderTransfers": { "adequateJurisdictions": [ "EU", "UK" ], "effectiveSafeRatioWeights": { "usDpfAdequacy": 0.7, "euHostedProcessorWithContractualSafeguards": 0.9, "contractualSafeguardOnly": 0.5, "unknownJurisdiction": 0.25 }, "note": "Each weight is the fraction of a destination counted as safe when computing the effective safe ratio. A destination in an adequate jurisdiction counts in full; one with no jurisdiction on record counts a quarter, because unknown sits closer to unsafe than to safe." }, "consentStates": [ { "token": "pre", "label": "No choice recorded", "meaning": "The page loaded and the banner was never touched. No decision has been recorded. This is the state a first-time visitor is in for as long as they read the page.", "howReached": "Load the URL and do nothing.", "reachability": "Measurable on any surface, including one whose consent platform the harness cannot drive. It is the pre-consent state by construction." }, { "token": "none", "label": "Consent refused", "meaning": "Every optional category rejected through the banner, and the rejection recorded by the consent platform. A recorded rejection is an explicit denial, which is a different state from an untouched banner and often produces different behaviour.", "howReached": "Load, then decline all.", "reachability": "Only where the consent platform can be driven." }, { "token": "all", "label": "Consent granted", "meaning": "Every category accepted and recorded.", "howReached": "Load, then accept all.", "reachability": "Only where the consent platform can be driven." }, { "token": "performance", "label": "Performance granted", "meaning": "Performance and analytics accepted, advertising rejected.", "howReached": "Granular banner interaction.", "reachability": "OneTrust and CookieYes today. Refused elsewhere rather than approximated." }, { "token": "targeting", "label": "Targeting granted", "meaning": "Advertising accepted, performance rejected.", "howReached": "Granular banner interaction.", "reachability": "OneTrust and CookieYes today. Refused elsewhere rather than approximated." }, { "token": "functional", "label": "Functional granted", "meaning": "Functional accepted, performance and advertising rejected. Measured only where a specification declares it, because only a consent platform that offers a functional category can reach it.", "howReached": "Granular banner interaction.", "reachability": "Only where the consent platform declares a functional category and the specification declares the state. Not part of the five every run is measured against." } ], "consentExemption": { "rule": "A vendor is exempt from the consent gates only when its own registry record satisfies all three conditions below. Two of three is not an exemption.", "conditions": [ { "id": "pre-consent-permissible", "predicate": "isPreConsentPermissible", "requirement": "The vendor's own registry record affirmatively declares that it may load before consent. An unstated declaration reads as false." }, { "id": "eprivacy-strictly-necessary", "predicate": "isEprivacyStrictlyNecessary", "requirement": "The registry classifies the vendor's storage or access as strictly necessary under ePrivacy Art 5(3). This is deliberately not the GDPR Art 6 basis: a vendor can rely on legitimate interest under Art 6 and still require consent on the device." }, { "id": "cited-provenance", "predicate": "hasCitedPreConsentProvenance", "requirement": "The registry holds both an authority for the assertion and the date it was last verified. An exemption carrying neither, or only one, is withheld rather than granted, and is omitted from the exempt set entirely." } ], "absenceRule": "A vendor the registry has never characterised returns false from every condition. Absence is unknown, and unknown never exempts - a coverage gap must not launder a real pre-consent leak into a clean grade.", "notPublishedHere": "The per-vendor exemption grants, with the authority and verification date behind each, are held in the registry and are not published in this corpus." }, "advancedConsentMode": { "statement": "Google Consent Mode v2 downgrades a signal; it does not stop a tag. A Google tag type in Google Tag Manager showing a consent setting of notSet means the container applies no ADDITIONAL consent checks - it does not mean the tag is ungated. The Google tag types awud, awct, gaawe, googtag and flc carry built-in consent checks of their own. Reading notSet as ungated produces a false finding of the most serious kind. Gate D2 exists precisely because the downgrade is real: tracking that continues after a recorded rejection while Consent Mode v2 downgrades what is sent is graded D rather than F, because something did enforce - and it is not clean, because the request was still made.", "gate": "D2" }, "omits": [ "Per-vendor consent obligations, exemption grants and detection signatures. The registry holds them; this corpus publishes the rule, not the roll.", "The corrections log. The changelog on the methodology page names each version and what it changed.", "Any regime the scope does not name. The methodology does not assess the CCPA/CPRA, the LGPD or any other regime, and the scope states the one standard the grade applies and the law it rests on in the EU, the EEA and the United Kingdom." ] }