AutoCore Consent Architecture and Categories
Explains necessary, functional, analytics, and marketing consent behavior.
The web consent platform stores a policy-versioned receipt reference in a SameSite cookie and posts a minimized receipt to the API. Necessary processing is always available; optional provider activation follows the selected categories.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Categories | Necessary is always allowed; functional, analytics, and marketing are explicit optional categories. |
| Providers | Google Analytics, Google Tag Manager, and Meta Pixel are registered only when configuration and consent allow them. |
| Locale | The current web flow records the active locale, with Turkish as the default product locale. |
| Scope | Consent categories do not authorize unrelated processing or replace policy publication. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.