User story
As a publisher, I want existing EC cookies and KV store entries to be deleted when a user revokes consent, so that tracking stops immediately upon withdrawal.
Acceptance criteria
Affected area
Core (synthetic IDs, cookies, GDPR), Fastly runtime
Proposed approach
- After decoding consent (per the TCF/GPP decoding issue), check for the revocation scenario:
has_consent == false && edge_cookie.is_some().
- If triggered:
- Set the EC cookie to expire (clear it from the response).
- Delete the corresponding entry from the Fastly KV store.
- If
has_consent == false && ssc_cookie.is_none(), do nothing — no cleanup needed.
- This check runs on every request as part of the consent evaluation pipeline.
Additional context
Sub-issue of #54. Related to #312, PR #380.
Handles the consent withdrawal / revocation case required by GDPR Article 7(3) and US state privacy laws.
User story
As a publisher, I want existing EC cookies and KV store entries to be deleted when a user revokes consent, so that tracking stops immediately upon withdrawal.
Acceptance criteria
Affected area
Core (synthetic IDs, cookies, GDPR), Fastly runtime
Proposed approach
has_consent == false && edge_cookie.is_some().has_consent == false && ssc_cookie.is_none(), do nothing — no cleanup needed.Additional context
Sub-issue of #54. Related to #312, PR #380.
Handles the consent withdrawal / revocation case required by GDPR Article 7(3) and US state privacy laws.