# Consent concepts and product boundaries

Consent Pro manages consent choices and configured blocking behavior. A scan or a completed checklist does not establish legal compliance. Consent requirements depend on jurisdiction, purpose, technology, and implementation.

## Categories and Google consent types

| Consent Pro category | Google consent signals                             |
| -------------------- | -------------------------------------------------- |
| Essential            | `security_storage`                                 |
| Analytics            | `analytics_storage`                                |
| Marketing            | `ad_storage`, `ad_user_data`, `ad_personalization` |
| Personalization      | `functionality_storage`, `personalization_storage` |

Consent Pro maps granted categories to `granted` and other categories to `denied`. Classify a tracker by its actual purpose. A friendly tag name or a stored review status does not prove enforcement.

## Consent defaults and returning visitors

An opt-in banner starts non-essential categories denied. Opt-out and informational configurations can pre-enable categories. Configure the intended banner and region defaults explicitly; a banner's visual presence is not a guarantee that tags are blocked.

The runtime restores valid stored choices from its consent cookie. Region changes can invalidate saved choices. Cookie lifetime and cross-domain sharing are configuration settings; browsers and domain rules can limit persistence. Test a fresh browser and a returning visitor separately.

The runtime emits `consent-updated` dataLayer events after applied choices, including rejection. This is a notification, not evidence that analytics or marketing is granted. The category `*-activated` dataLayer events fire once per page when their corresponding category becomes active. See [Events](/runtime/events).

## Withdrawal and blocking limits

Visitors can reopen preferences and change their choices. Consent updates adjust Google consent signals and configured tracker cleanup. An already executed third-party script cannot generally be unexecuted, and previously transmitted data cannot be recalled by a CMP. Do not assume changing preferences unloads every integration; inspect its subsequent network requests and its own shutdown APIs.

Consent Pro's script, image, and embed blocking depends on supported configuration and markup. Code injected outside the configured blocking path needs separate verification. For an image inside a cross-origin iframe, control the parent embed rather than attempting to modify the iframe's document. See [Script loading](/runtime/script-loading) and [Image trackers](/runtime/image-trackers).

## Global Privacy Control

Consent Pro checks `navigator.globalPrivacyControl`. In the current runtime, GPC applies to opt-out and Do Not Sell banners that pre-enable categories. It can supersede earlier stored grants; a later explicit visitor choice can override an already observed signal. Switching the signal off does not itself grant consent. Browser APIs do not expose the signal's activation timestamp. See [GPC behavior and limitations](/runtime/gpc).

## Evidence and unknowns

Use runtime version, published configuration, and browser observations when assessing behavior. Scan absence does not prove a tracker stopped, tag names do not establish purpose, and an automated review cannot prove how arbitrary custom GTM code behaves. Verify missing vendor information, retention periods and actual browser behavior before relying on them.

## Reviewed references

- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en): EU consent concepts; does not define every jurisdiction's requirements.
- [Google Consent Mode overview](https://developers.google.com/tag-platform/security/concepts/consent-mode): Google tag behavior and basic versus advanced implementations.
- [Global Privacy Control specification](https://globalprivacycontrol.github.io/gpc-spec/): browser signal semantics.

Reviewed against the current runtime on 2026-10-06. External references explain their own scope; they do not certify a Consent Pro installation.