Compliance glossary
Precise, plain-language definitions — hedged where the law is unsettled.
Auto-blocking
A consent-management technique that prevents non-essential third-party scripts (analytics, advertising pixels) from loading until the visitor grants consent — rather than merely displaying a banner. Robust implementations must intercept dynamically injected scripts, not just tags present in the page HTML.
CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)
California's privacy law (CCPA, 2020) as amended by the CPRA (in force 2023). Gives California residents rights over personal information, including the right to opt out of its "sale or sharing" — a definition broad enough to cover much of ad-tech. Requires honoring opt-out preference signals such as Global Privacy Control.
Consent Mode v2
Google's signaling framework through which a consent banner tells Google tags what they may do, via four signals: ad_storage, ad_user_data, ad_personalization, and analytics_storage. Required by Google for EEA/UK traffic since March 2024 for sites using Google advertising products. Commands must be pushed as gtag arguments objects — array pushes are silently ignored.
Consent record
The stored evidence of a visitor's consent choice. To be useful in a dispute, it should capture not just the choice but the context: when, on which domain, which banner configuration and categories the visitor actually saw, the locale, and the method (accept all, granular save, opt-out signal). GDPR Article 7(1) places the burden of demonstrating consent on the controller.
Cookie banner
The user interface through which a website requests consent for non-essential cookies and trackers. EU regulators require that refusing be as easy as accepting (choice symmetry), that no non-essential trackers fire before a choice is made, and that granular category choices be available.
Cookie wall
Blocking access to a site unless the visitor accepts all cookies. Rejected as invalid consent by several EU data-protection authorities, because consent obtained this way is not freely given. Distinct from "consent or pay" models, whose legality remains contested and jurisdiction-dependent.
Data Processing Agreement (DPA)
The contract GDPR Article 28 requires between a data controller and any processor handling personal data on its behalf. Defines processing scope, security measures, sub-processor rules, and audit rights. B2B buyers routinely request a vendor's DPA during procurement.
Data subject access request (DSAR)
A request by an individual to exercise rights over their personal data — most commonly access (GDPR Art. 15) or erasure (Art. 17). Controllers must generally respond within one month. A well-built consent platform lets visitors view and delete their own consent records self-serve.
ePrivacy Directive
The 2002 EU directive (amended 2009) governing electronic communications privacy. Its Article 5(3) is the legal basis for the cookie-consent requirement: storing or accessing information on a user's device requires prior informed consent unless strictly necessary. Applies alongside GDPR, which supplies the standard consent must meet.
EU AI Act (Regulation (EU) 2024/1689)
The EU's risk-based AI regulation. Its Article 50 transparency obligations — chatbots must disclose they are AI; AI-generated content must be marked — apply from 2 August 2026 and reach any business deploying generative AI toward EU users, not just AI companies.
GDPR (General Data Protection Regulation (EU) 2016/679)
The EU's comprehensive data-protection law, applying to any organization processing personal data of people in the EU, wherever the organization is based. Defines the standard for valid consent: freely given, specific, informed, and unambiguous. Maximum fines reach 4% of global annual turnover.
Global Privacy Control (GPC)
A browser-level signal (Sec-GPC header and navigator.globalPrivacyControl property) expressing a person's opt-out of the sale and sharing of their personal information. Legally binding under the CCPA/CPRA and recognized by Colorado and other US state laws; not a GDPR concept but harmless to honor in the EU.
Google Consent Mode — basic vs. advanced
Two deployment patterns. Basic: Google tags do not load at all until consent is granted — the conservative reading of EU law. Advanced: tags load regardless and send cookieless "pings" when consent is denied, enabling Google's conversion modeling; some regulators and privacy professionals question pre-consent communication with ad servers. The choice is a real trade-off, not a default.
ISO 42001 (ISO/IEC 42001:2023)
The first international, certifiable standard for an AI management system (AIMS) — the AI analogue of ISO 27001. Increasingly requested in enterprise procurement of AI vendors. Meaningful statuses short of certification include "aligned" and "in progress," honestly labeled.
Legitimate interest
One of GDPR's six lawful bases for processing. Frequently misapplied to analytics and advertising cookies — EU authorities are consistent that ePrivacy Article 5(3) requires consent for non-essential storage/access, and legitimate interest cannot substitute for it there.
NIS2 (Directive (EU) 2022/2555)
The EU's network and information security directive, applying to medium and large entities in essential and important sectors. Requires risk-management measures, incident reporting, and management accountability, with fines up to €10M or 2% of global turnover for essential entities.
Prior consent
The requirement that consent be obtained before non-essential cookies are set or trackers fire — not after, not during. The most commonly failed requirement in practice: a banner that renders while analytics already loads in the background violates it. Verifiable in any browser via the network tab.
Reject symmetry
The principle that refusing consent must be as easy as giving it — same layer, same number of clicks, comparable visual prominence. France's CNIL has fined major platforms specifically over asymmetric flows, and it remains an active enforcement priority.
Strictly necessary cookies
Cookies exempt from the consent requirement because the service the user requested cannot function without them — session state, shopping carts, security tokens, and the consent record itself. The exemption is narrow: analytics, preference, and marketing cookies do not qualify, however useful.
Subprocessor
A third party that processes personal data on behalf of a processor — cloud hosts, email providers, analytics vendors, and (increasingly scrutinized) AI model providers. GDPR requires disclosure and flow-down of contractual protections; enterprise DPAs typically require advance notice of subprocessor changes.
TCF v2.2 (IAB Transparency and Consent Framework)
The ad-industry framework through which publishers transmit consent signals to programmatic advertising vendors via a standardized API (__tcfapi). Required in practice for sites monetizing through programmatic ads; distinct from — and much heavier than — ordinary cookie consent. (ShieldPage does not implement TCF; we are not aimed at programmatic publishers.)
Trust center
A public page where a company presents its security and compliance posture — certifications, policies, subprocessors, documents (often NDA-gated), and increasingly AI governance disclosures. Its job is to answer a buyer's security questionnaire before it is sent.