Why are we doing this?

Problem statement

The Consent Receipt v1.1 from Kantara was frozen in 2017 and has seen substancial interest as it can bring efficiency, compliance, and user control. The original receipt was primarily aimed at personal information and, to a large extent, driven by upcoming regulations (at the time) such as EU's GDPR.

The proposers have identified a high impact application to Consent Receipts: the case of Web consent. This scenario should be extremely familiar.  Every day and just in Europe, many millions of people access websites multiple times per day. On landing on a page, users are asked to consent with data collection. Control of any consent action in a website is typically lost as soon as, e.g., a cookie banner is dismissed as it is difficult, if not impossible, to review the Consenting action or keep track of past actions.

Web consent receipts (WCRs) offer a promising approach: whenever a consent action is taken, a consent receipt is generated.

We will not anticipate how such receipts will be used, as this should be allowed to evolve organically through adoption, but immediate applications are in user-controlled tracking of personal data or demonstration of consent for websites.

This project will specify an interoperable and (potentially) extensible architecture, based on web and browser technologies so to allow web users, by means of a browser agent (such as an extension), to generate WCRs automatically and non-intrusively, directly in the browser.

Impact of this problem

Significant: no current and structured means exist for individuals to keep track of their consents in the real-time web.

How do we judge success?

We will

• Publish a set of open specifications
• Publish best-practices guides
• Create an open-source software implementation reference (if resources are available)
• Organise hackathons for implementers and user-testers