Consent Receipt

Consent Receipts must be structured for automated parsing, typically using JSON or JWT formats conforming to the Kantara Initiative specification. This enables integration with Policy-as-Code Enforcement systems and Right to Explanation APIs.

• Uses a defined schema with mandatory fields like purpose, dataController, and subjectId.
• Allows automated validation against a Purpose Limitation Controls registry.
• Facilitates bulk auditing without manual document review.

To serve as a definitive legal record, the receipt must provide Cryptographic Non-Repudiation. This is achieved by digitally signing the receipt payload using the data controller's private key.

• Proves the receipt was generated by a specific entity and has not been altered.
• Often combined with Secure Timestamping (RFC 3161) to prove the exact time of agreement.
• Enables verification of authenticity during an audit without relying on a central authority.

A valid receipt explicitly records the specific, granular purpose for which consent was granted, moving beyond vague blanket authorizations. This is critical for Purpose Limitation Controls.

• Records the purpose field as a machine-readable URI or controlled vocabulary term.
• Links the purpose to the specific dataCategories involved.
• Prevents function creep by providing a definitive boundary for data usage that can be checked during Continuous Compliance Monitoring.

The receipt must be stored as an append-only record within an Immutable Audit Trail. This ensures the record of consent cannot be overwritten or deleted, preserving the Chain of Custody.

• Stored on WORM Storage or a Distributed Ledger Technology (DLT).
• The receipt's hash is often anchored in a Merkle Tree Hashing structure for efficient verification.
• Provides a verifiable Decision Provenance for any subsequent automated processing based on that consent.

A Consent Receipt is not a static document; it must track the lifecycle of the authorization, including its current state (e.g., 'active', 'withdrawn', 'expired').

• Records a validUntil timestamp for time-bound consent.
• Logs a Human-in-the-Loop Override event if consent is manually modified or revoked.
• Integrates with Data Subject Rights Automation to trigger data deletion or processing cessation when the state changes to 'withdrawn'.

The receipt must contain a verifiable link to the exact privacy notice or consent form presented to the user at the time of agreement. This establishes Decision Provenance.

• Includes a cryptographic hash of the specific notice text (noticeHash).
• Records the noticeUrl or a Content-Addressable Storage identifier for the notice.
• Proves that the user was informed of specific data practices before consenting, which is essential for defending against claims of misleading interfaces.

Technical measures that enforce data minimization and prevent the repurposing of data in AI training beyond the scope defined in the original Consent Receipt. These controls act as a gatekeeper, comparing a processing activity's purpose against the consented purposes before allowing execution.

• Validates processing intent against the receipt's purpose field
• Blocks unauthorized secondary use of training data
• Implements policy-as-code for GDPR Article 5(1)(b) compliance

The technical fulfillment of privacy requests, including access, rectification, and erasure, which relies on the Consent Receipt as the root record. When a user invokes the right to withdraw consent, the system uses the receipt's consent receipt ID to cascade the revocation across all downstream processing systems.

• Links withdrawal requests to specific consent events
• Enables automated data deletion workflows tied to consent expiration
• Provides auditable proof of rights fulfillment

A chronological record of system events that cannot be altered or deleted, providing verifiable proof of what occurred, when, and by whom. Consent Receipts are stored as immutable records within this trail, ensuring that the exact state of consent at the time of data collection is permanently preserved for legal scrutiny.

• Uses Merkle Tree Hashing for tamper-evident storage
• Captures the full context of consent authorization
• Supports cryptographic non-repudiation of data subject agreements

A documented, unbroken record of the sequence of entities that have handled a piece of data or evidence, preserving its integrity for legal and audit scrutiny. The Consent Receipt serves as the initiating artifact in this chain, establishing the lawful basis before data moves through processing pipelines.

• Establishes the legal origin point for data provenance
• Links to Data Lineage Graphs for end-to-end traceability
• Critical for demonstrating compliance to supervisory authorities

The practice of defining and automatically enforcing regulatory and organizational rules through machine-readable code. Consent Receipts are consumed by policy engines to make real-time authorization decisions—if a receipt is missing, expired, or lacks the required purpose, the processing request is denied automatically.

• Validates consent scope before every processing operation
• Integrates with OPA (Open Policy Agent) and XACML architectures
• Ensures every decision point is compliant by default