Consent Evidence — Integration

Consent Evidence certificates (cert_v: 1, and the record-only cert_v: 2) sit on top of your existing consent form or CMP. The AdPriva tag observes the form; it never blocks or changes it, and it never reads what people type.

A Legal Bundle is the immutable set your consent binds to: the exact consent text, your policy versions, the purposes and the recipients. Register it in the console (Consent → Evidence → Register bundle) or with the API:

curl -X POST https://api.adpriva.com/legal-bundles \
  -H "Authorization: Bearer <API key or console token>" -H "Content-Type: application/json" \
  -d '{"consent_text":"I agree …","purposes":[{"id":"P1","description":"Newsletter"}],
       "recipients":["Your Company"],"policies":[]}'

You get an id such as LB-42. Bundles are never edited: a changed text is a new bundle, and old bundles stay verifiable. To register exactly what your page renders, open the page and run AdPriva.consentPreview(document.querySelector('[data-adpriva-consent-text]')) in the browser console: its text is the canonical wording.

2. Mark the form

<form data-adpriva-consent data-adpriva-bundle="LB-42" data-adpriva-evidence-field="adpriva_evidence_id">
  <div data-adpriva-consent-text>I agree … <a href="/privacy">Privacy Policy</a>.</div>
  <label><input type="checkbox" data-adpriva-purpose="P1"> Newsletter</label>
  <input type="text" name="website" data-adpriva-honeypot tabindex="-1" autocomplete="off" aria-hidden="true">
  …your fields and submit button…
</form>
  • data-adpriva-bundle names the bundle the page shows.
  • data-adpriva-purpose ties each checkbox to a bundle purpose. Its checked state is recorded, never its label text.
  • The optional honeypot field (hidden from people) helps tell bots apart.

With the tag’s consent mode set to tcf or manual, the tag sends nothing before the visitor consents through your banner, so a visitor who declined (or never answered) leaves no certificate for the consent form they did submit. To record that form anyway, add one attribute to the form itself:

<form data-adpriva-consent data-adpriva-bundle="LB-42" data-adpriva-record-without-consent>

The attribute is empty or "true"; any other value does not opt in. It changes nothing in off mode or once the visitor has consented, when the form gets a full cert_v: 1 certificate.

  • What is sent: the hash of the consent wording, the Legal Bundle id, the checkbox states, the page address without its query string and fragment, and the time. That is all a record of the consent itself needs, which is the scope for the ePrivacy exemption for what is strictly necessary. Whether you rely on it is your decision as the controller.
  • What is not sent: no interaction signals (no timing, honeypot or automation checks), no device details, no browser language (the page’s <html lang> is used, else und), and no subject reference: data-adpriva-subject-ref is ignored. Nothing else on the page is observed, and no view event is sent.
  • The certificate is cert_v: 2, with the interaction assessment NOT_AVAILABLE. That is not a bot verdict and not a human one, and these certificates are not counted as scored traffic. The console labels them “Interaction assessment not available (no consent)”.
  • The evidence id is exposed as usual (step 3). Store it: without a subject reference it is the only link between the certificate and your record.
  • A later withdrawal of consent does not discard a record that is still being delivered, because the record never relied on that consent.

3. Keep the evidence id with your record

This is the one obligation on your side. At submit the tag creates an evidence_id synchronously, before your own submit handler runs, and exposes it in three ways:

  • window.AdPriva.lastEvidenceId;
  • an adpriva:evidence event on the form (event.detail.evidence_id);
  • with data-adpriva-evidence-field, a hidden input submitted with your form.

Store it next to the person’s record. Without it, the certificate still proves a consent event happened, but you cannot link it to your record.

4. Confirm what you stored

From your backend, report the ids you stored:

curl -X POST https://api.adpriva.com/consent-evidence/declarations \
  -H "Authorization: Bearer <API key>" -H "Content-Type: application/json" \
  -d '{"evidence_ids":["EV-…"]}'

The console’s capture-rate card compares what you declared with what AdPriva certified. Events lost to ad blockers or failed networks show up as unconfirmed, never as silently valid.

Download a certificate and its bundle from the console (Consent → Evidence) and check them with the verifier (Verifying a Consent Evidence Certificate). You are live when all four onboarding items in the console are green. A record-only cert_v: 2 certificate needs verifier v0.2.0 or newer.

← Previous Verifying a Consent Evidence Certificate Next → Consent Certificates — Quickstart