ContactSign up
Looking for Clickio Advertising (publisher monetization)? Click here
GLOSSARY

Consent & privacy,
term by term

Thirty terms that come up in every consent project, from TC strings to dark patterns, explained in plain language, with links to the Clickio features that put them into practice.

Start free trial Contact us
Google Certified Publishing Partner Google Certified CMP Partner, Gold Tier IAB Europe Transparency & Consent Framework Validated CMP

Trusted by 2,000+clients worldwide

Jump to a term

CMP Consent string IAB TCF Global Vendor List Google Additional Consent Google Consent Mode v2 GPP GDPR ePrivacy Directive UK GDPR & PECR CCPA / CPRA GPC LGPD Consent Legitimate interest Opt-in vs opt-out First layer / second layer Granular consent Consent rate Consent record Cookie Cookie wall / Consent or Pay Cookie policy Cookie scanner Tag orchestration / prior blocking dataLayer Personal data / PII Profiling DPO Dark patterns
CMP (Consent Management Platform)
Software that presents a consent dialog, records visitor choices, blocks trackers until allowed, and signals the result to ad and analytics vendors. Clickio Consent is a Google-certified, IAB TCF-registered CMP.
The compact encoded record of a visitor's TCF consent choices, created by the CMP and read by ad-tech vendors via the __tcfapi interface. "TC" stands for Transparency & Consent.
IAB TCF (Transparency & Consent Framework)
The IAB Europe standard defining how consent for ad-tech vendors is collected and signaled across the programmatic ecosystem. The current version is TCF 2.4.
Global Vendor List (GVL)
The IAB-maintained registry of TCF-participating vendors, their purposes and legal bases. It is the source list a CMP's vendor screen draws from.
Google Additional Consent (ATP list)
Google's companion mechanism covering ad-tech providers not registered in the TCF, signaled alongside the TC string as an "additional consent" string.
Google's mechanism for telling its tags (GA4, Google Ads) what a visitor consented to. Required for personalized ads in the EEA/UK since March 2024; v2 added the ad_user_data and ad_personalization signals.
GPP (Global Privacy Platform)
The IAB's multi-jurisdiction signaling framework, carrying consent and opt-out signals for multiple regions (notably the US state privacy laws) in one structure.
GDPR
The EU General Data Protection Regulation (2018), the world's reference privacy law. Requires a lawful basis for processing personal data; for tracking cookies that basis is consent. Fines reach €20M or 4% of global turnover.
ePrivacy Directive
The EU "cookie law" that actually mandates consent for storing or reading information on a user's device. GDPR defines what valid consent means; ePrivacy says when you need it.
UK GDPR & PECR
The UK's retained version of GDPR plus PECR, its ePrivacy implementation, enforced by the ICO. Functionally similar to the EU regime; formally separate.
CCPA / CPRA
California's privacy law (as amended by CPRA): an opt-out regime where consumers can opt out of the sale/sharing of personal information, signaled on the web via GPP; a Global Privacy Control (GPC) signal counts as a valid opt-out request.
GPC (Global Privacy Control)
A browser-level signal expressing a user's opt-out preference, legally recognized under California and other US state laws. CMPs must detect and honor it where required.
LGPD
Brazil's Lei Geral de Proteção de Dados, a GDPR-style law protecting people in Brazil, enforced by the ANPD with fines up to 2% of Brazil revenue (R$50M cap).
Under GDPR-family laws: a freely given, specific, informed and unambiguous indication of agreement. Pre-ticked boxes, bundled consent and "continue means agree" all fail the test.
Legitimate interest
An alternative lawful basis where processing is necessary for interests not overridden by the data subject's rights. Heavily restricted for tracking; TCF v2.2 (2023) removed it for advertising personalization purposes.
Opt-in vs opt-out
Opt-in regimes (GDPR, LGPD, KVKK) require consent before processing; opt-out regimes (US state laws) allow processing until the consumer objects. Multi-regulation CMPs serve each model to the right visitors.
First layer / second layer
The two stages of a consent dialog: the initial banner with headline choices (first layer), and the detailed preferences screen with purposes and vendors (second layer).
Consent collected per purpose (and per vendor) rather than as one all-or-nothing agreement. It is a validity requirement under GDPR-family laws.
The share of visitors who consent (fully or partially) when shown a dialog: the KPI connecting consent UX to advertising revenue and data quality.
The stored evidence of a specific consent decision: what was presented, what was chosen, and when. GDPR-family laws put the burden of demonstrating valid consent on the controller.
A small piece of data a website stores in the browser. First-party cookies belong to the site itself; third-party cookies belong to other domains embedded in the page, the classic cross-site tracking vehicle.
Making site access conditional on consent. Blanket walls are widely considered invalid; the "Consent or Pay" model (a paid, tracking-free alternative) is the variant European regulators are currently assessing, with conditions.
The disclosure document listing the cookies a site uses, their purposes, durations and vendors. Kept accurate automatically with a scanner plus an embedded, self-updating cookie list.
A crawler that visits your pages like a browser and records the cookies, storage entries and trackers that fire on the pages it crawls: the empirical basis for accurate dialogs and policies.
Tag orchestration / prior blocking
Ensuring tags don't run before consent: natively for TCF and Consent Mode vendors, and via script-attribute gating or tag-manager triggers for everything else.
dataLayer
The JavaScript structure tag managers read events from. CMPs push consent state into it (Clickio: clickio_consent_update events) so tags can fire on the visitor's choice.
Personal data / PII
Any information relating to an identifiable person. In web contexts this includes cookie IDs, device identifiers and IP addresses, which is why tracking falls under privacy law at all.
Profiling
Automated processing that evaluates personal aspects (interests, behavior, location), typically to target advertising. Draws heightened consent requirements across regulations.
DPO (Data Protection Officer)
The person responsible for overseeing an organization's data-protection compliance. The role is mandatory for certain controllers under GDPR and analogous laws.
Dark patterns
Interface designs that push visitors toward consenting: hidden decline options, misleading buttons, nagging. Regulators increasingly treat consent obtained this way as invalid.

Want the practice, not just the vocabulary? Clickio Consent implements all of it, with a 14-day free trial on every paid plan.

Explore features
From glossary to live

Put the terminology to work: set up certified consent in minutes.

Start free trial