Consent & Privacy Model
AdPriva checks whether traffic is human without following people around the web. This page explains what the tag collects, what AdPriva keeps, what is made public, and how consent evidence works.
What the tag does and does not do
- It sets no cookies and uses no cross-site identifier. It does not try to recognise a returning visitor.
- It keeps aggregate counts while the page is open: foreground dwell time, scrolls, clicks, pointer speed and automation hints. About one second after the page loads, it sends the counts so far, with a low-detail device snapshot, the page path and the referrer. That is the only request for a page view.
- It never records keystrokes, form values or absolute pointer positions. Each object it sends has a fixed list of allowed fields, and the tag’s tests fail if anything else is emitted.
- It shows no consent prompt. It can wait for the consent the publisher’s own banner collects: in the
tcformanualconsent mode it observes and sends nothing until the visitor consents, and it stops at once when consent is withdrawn. The only exception is a consent form the publisher opts in to record-only evidence (below). Inoffmode it starts at page load; a missing mode also meansofftoday, so publishers should always set one. Publishers can also load the tag only after consent, so that not even the script download reaches AdPriva before it.
The full field list is on the AdPriva Tag page.
What AdPriva keeps, privately
| Data | Why | How long |
|---|---|---|
| Proof record: page URL, referrer, timestamps, validity score, verdict | Verification and the publisher’s console reports | Kept with the proof |
| IP address and user agent of the request | Scoring, and to derive a country, device class, browser and OS | Raw values emptied after 30 days; hashes kept |
| Scoring signals (the values the scoring service used for a verdict) | Reviewing and retraining the scoring models | Emptied after 180 days |
Pseudonymous copies of proof records (hashed IP address and user agent, country, device class, browser, OS) and their scores and scoring signals are also exported to a private storage bucket that is used to train and test the scoring models. Raw IP addresses, user agents, page URLs and referrers are not exported.
A publisher sees only its own organization’s proofs, in the signed-in console.
What is public
- The Explorer and the public API show a proof’s opaque id, type, timestamps, status, Merkle data, validity score and verdict.
- They never show the publisher, site, page URL, referrer, IP address, user agent or any visitor reference.
- Only Merkle roots, which are hashes, are written to the blockchain.
Consent evidence
For publishers that need to prove a visitor’s consent, the tag can witness consent forms.
- The publisher marks a form with
data-adpriva-consent, or declares a registered Legal Bundle on it withdata-adpriva-bundle. - When the form is submitted, the tag records a hash of the consent wording, the checkbox states and the form’s page URL, plus a few signals about how the form was filled in. It never records what the visitor typed, and it never blocks or changes the form.
- The server seals this as a certificate and anchors it on Horizen.
- The publisher, or anyone it gives the certificate to, can check it later. The public certificate lookup contains no personal data.
Without consent, a form the publisher marks data-adpriva-record-without-consent is still recorded, but as a record only: the consent wording’s hash, the Legal Bundle, the checkbox states, the page URL and the time, with no signals about how the form was filled in, no device details and no subject reference. Its certificate says the interaction assessment is not available. See record-only evidence.
If the form carries data-adpriva-subject-ref with the publisher’s own user id, the tag sends a site-scoped SHA-256 hash of that id, never the id itself. The publisher can then list one person’s certificates to answer an access request.
Roles, retention and subject access for consent certificates are covered in Data-Processor Posture.
Shadow mode
Verdicts are recorded and published, but they do not block any visitor or any proof. See Proofs of Engagement.