Consent Certificates — Quickstart
An AdPriva consent certificate is independent, tamper-evident evidence that a specific consent was given on a specific form, at a specific moment. You add one script tag to your site and one attribute to your form. There is no backend integration, no SDK, and no change to how your form already works.
1. What you get
For every submission of a marked form, AdPriva witnesses the consent event in the browser, seals it server-side with an HMAC signature, and issues a certificate that you or a third party can look up and verify independently — through a verification page or a public API, without an AdPriva account.
The certificate is evidence about the consent event. It is not the consent mechanism itself, and it does not replace your consent banner or your CRM.
2. Who this is for
French loi n° 2025-594 (art. 13) takes effect on 11 August 2026. From that date:
- Unsolicited B2C telephone marketing is prohibited without the consumer’s prior explicit consent. The old opt-out logic ends.
- Bloctel, the French opt-out register, disappears on the same date — so “the number was not on Bloctel” stops being a defence.
- The burden of proof sits with the caller. If you call, you must be able to show the consent.
- Liability reaches the principal — the company on whose behalf the call is made — even when lead generation is subcontracted to a third party.
- Sanctions reach €375,000, doubled for repeat breaches.
The law is B2C only. The most exposed sectors are insurance, lead generation, and credit and real-estate brokers — anyone who collects a phone number through a web form and later calls it, or buys leads from someone who did.
Consent certificates are designed to help you evidence consent: to produce, on demand, a verifiable record of what a person was shown and what they agreed to.
3. Install the tag (2 minutes)
Place this snippet in <head> or just before </body> on the pages that carry your forms:
<script async src="https://cdn.adpriva-ads.com/tag.js"></script>
That is the whole snippet. There is no site key and no attribute to configure — your site is identified by its hostname, which we provision for you before your first capture.
If your site runs on WordPress, install the AdPriva plugin from the WordPress.org plugin directory instead; it injects the same tag automatically. You still need to mark your form as described in the next section.
4. Mark your consent form
Capture is opt-in per form. A form is only ever witnessed if you explicitly mark it. Unmarked forms on the same page are ignored.
| Attribute | Goes on | Required | Fallback if omitted |
|---|---|---|---|
data-adpriva-consent | the <form> element | Yes | none — without it the form is ignored |
data-adpriva-consent-text | the element that holds your consent wording | No | the whole form’s visible text is used |
data-adpriva-consent-checkbox | the opt-in <input type="checkbox"> | No | the form’s first checkbox is used |
The two optional markers are worth adding when a form contains more than one checkbox, or more text than the consent wording itself — they remove any ambiguity about which wording and which box the certificate refers to.
A complete example:
<form action="/devis" method="post" data-adpriva-consent>
<label for="nom">Nom</label>
<input id="nom" name="nom" type="text" required>
<label for="telephone">Téléphone</label>
<input id="telephone" name="telephone" type="tel" required>
<p data-adpriva-consent-text>
J'accepte d'être contacté par téléphone par Assurances Exemple au sujet de ma demande
de devis, ainsi que par ses partenaires courtiers.
</p>
<label>
<input type="checkbox" name="optin" data-adpriva-consent-checkbox>
Je donne mon consentement explicite.
</label>
<label>
<input type="checkbox" name="cgu" required>
J'accepte les conditions générales d'utilisation.
</label>
<button type="submit">Envoyer ma demande</button>
</form>
Here the second checkbox (terms of use) is deliberately not the consent checkbox — the marker on the first one is what keeps the certificate unambiguous.
5. What is captured — and what never leaves the page
| Captured and sent | Never sent |
|---|---|
| SHA-256 hash of your consent wording | the consent wording itself, in raw form |
| the consent checkbox state (checked / not checked) | any value the visitor typed |
the form’s field labels (for example Téléphone) | the contents of those fields |
| the form URL | cookies — none are set or read |
| a timestamp and a one-time nonce | any advertising or cross-site identifier |
The consent wording is whitespace-normalised and hashed in the browser. Only the hash is transmitted, so AdPriva never holds the text of your form — but because the hash is deterministic, the wording you published can later be shown to match the certificate.
Reliability. The listener is registered in the capture phase and is passive — it never
calls preventDefault(), so your form’s own submit proceeds exactly as before. The whole capture is
wrapped so that an error inside it cannot break your form. Delivery is fire-and-forget using fetch
with keepalive (which survives the page unloading on submit) plus a single retry. If AdPriva is
unreachable, the visitor’s form still submits normally. Capture never sits in the critical path of
your lead.
The server-side seal. On receipt, AdPriva computes an HMAC signature over the canonical set of
fields: the site, the form URL, the consent-wording hash, the checkbox state, the timestamp, and the
nonce. The signature is what makes the record tamper-evident: change any sealed field afterwards and
the signature no longer matches. Submissions are rejected if the timestamp is more than 10 minutes
old or more than 60 seconds in the future (401), or if the nonce has already been used
(409) — so a captured event cannot be replayed or back-dated.
6. Verify a certificate
Each certificate is addressed by its signature. Two ways to check one:
Verification page. Open https://adpriva.com/certificate/<signature>. It renders a verification
badge and offers the full audit bundle as a downloadable JSON file — the artefact to hand to a
lawyer, an auditor, or a lead buyer. Visiting https://adpriva.com/certificate with no signature
gives you a paste box for checking a signature you were sent.
Public API. No authentication and no account:
curl https://api.adpriva.com/public/certificates/<signature>
The endpoint is rate-limited to 60 requests per minute. An unknown signature returns a uniform
404, so the endpoint cannot be used to probe for which signatures exist.
Because both surfaces are open, the party relying on the evidence — your client, your auditor, the buyer of a lead — can check it without going through you and without an AdPriva login.
During your pilot, AdPriva sends you verification links for your captured events, so you can see each certificate resolve end-to-end without waiting on any integration work.
7. How this fits with your CMP and your CRM
Consent certificates work alongside the tools you already run — they replace nothing.
- Your consent banner / CMP governs whether and how consent is collected, and manages preferences. AdPriva does not touch that decision. Running a CMP already is a good sign: it means the consent moment is well-defined, which is exactly what gets witnessed.
- Your CRM or lead platform stores the lead and the customer relationship. AdPriva stores no lead — it stores evidence about the consent event, keyed by a signature you can attach to your own record.
The distinction that matters: a CMP and a CRM both record consent as your own systems saw it. A certificate is evidence a third party can verify without trusting your systems — which is the part that carries weight when the burden of proof is on you.
8. Honest limits
We would rather you know these up front:
- A certificate is evidence of the consent event as observed in the browser — what wording was on screen, whether the box was ticked, on which page, at what time.
- It does not identify the person. There is no cookie and no cross-site identifier, and the field values are never captured, so a certificate cannot on its own tell you who submitted the form. Binding the certificate to an identity is done in your own systems, from your own record.
- It does not by itself make you compliant with loi 2025-594 or the GDPR. It helps you evidence consent — one part of an obligation that also covers how you collect, what you disclose, and how you honour withdrawal.
- The seal is a cryptographic signature held by AdPriva today. On-chain anchoring of certificate batches is in progress, which will additionally place each batch beyond our own reach.
9. Getting started
Onboarding for design partners is concierge — we do the setup with you rather than handing you a console:
- Send us your domain. That is the only detail we need to begin.
- We provision it so captures from that hostname are recognised.
- You add the snippet and the form attribute — the two changes described in sections 3 and 4.
- We confirm your first test capture together, on a live call: you submit the form, we send you the verification link, and you watch the certificate resolve on the public lookup.
From that point every marked form on your site produces certificates automatically.
Reach us at hello@adpriva.com to start.