AutoCore Consent Receipts, Withdrawal, and Privacy
Describes minimized consent receipts, expiry, withdrawal, and provider reconciliation.
Consent receipts are intentionally privacy-minimized. They record a consent identifier, policy version, selected categories, source, locale, decision time, and optional expiry; they do not model IP address, user agent, browsing history, or an account identifier.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Receipt | The API accepts a throttled public receipt submission and records the selected categories and policy version. |
| Withdrawal | The client clears optional provider effects, writes the new choice, and posts the updated decision. |
| Expiry | A policy-version mismatch or expired receipt returns the client to the consent decision flow. |
| Operations | Admin reporting exposes aggregate counts and cleanup controls rather than raw browser history. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.