From consent-management-skills
Architecture guide for consent preference centers with DB schema, API design, UI specs, GDPR Article 7(3) withdrawal, audit trails, TCF v2.2 integration. For privacy compliance.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin consent-management-skillsThis skill uses the workspace's default tool permissions.
A consent preference center is the centralized interface through which data subjects manage their consent choices across all processing purposes. Under GDPR Article 7(3), withdrawal of consent must be as easy as giving it, making a well-designed preference center critical for compliance. The IAB Europe Transparency and Consent Framework (TCF) v2.2 provides a standardized approach for advertisin...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
A consent preference center is the centralized interface through which data subjects manage their consent choices across all processing purposes. Under GDPR Article 7(3), withdrawal of consent must be as easy as giving it, making a well-designed preference center critical for compliance. The IAB Europe Transparency and Consent Framework (TCF) v2.2 provides a standardized approach for advertising-related consent that integrates with this architecture.
The consent preference center requires four core data entities:
Consent Purpose Registry Stores all processing purposes for which consent is the lawful basis.
| Field | Type | Description |
|---|---|---|
| purpose_id | UUID | Unique identifier for the processing purpose |
| purpose_name | VARCHAR(256) | Human-readable purpose name |
| purpose_description | TEXT | Plain-language description (Flesch-Kincaid grade 8 or below) |
| legal_basis | ENUM | "consent" or "explicit_consent" |
| data_categories | JSONB | Array of personal data categories processed |
| recipients | JSONB | Array of named third-party recipients |
| retention_period | VARCHAR(128) | Data retention period for this purpose |
| tcf_purpose_id | INTEGER | Mapped IAB TCF v2.2 purpose ID (1-11) if applicable |
| is_active | BOOLEAN | Whether this purpose is currently offered |
| created_at | TIMESTAMP | When the purpose was registered |
| updated_at | TIMESTAMP | Last modification timestamp |
Consent Text Version Immutable records of consent text presented to users.
| Field | Type | Description |
|---|---|---|
| version_id | UUID | Unique version identifier |
| purpose_id | UUID | FK to purpose registry |
| consent_text | TEXT | Exact text displayed to the user |
| text_hash | CHAR(64) | SHA-256 hash of consent_text |
| effective_from | TIMESTAMP | When this version went live |
| effective_until | TIMESTAMP | When this version was superseded (NULL if current) |
| approved_by | VARCHAR(256) | Name of DPO or legal reviewer who approved |
Consent Decision Records each consent decision made by a data subject.
| Field | Type | Description |
|---|---|---|
| decision_id | UUID | Unique decision identifier |
| subject_id | UUID | Data subject identifier |
| purpose_id | UUID | FK to purpose registry |
| version_id | UUID | FK to consent text version shown |
| decision | ENUM | "granted" or "withdrawn" |
| mechanism | VARCHAR(64) | "checkbox_tick", "toggle_switch", "api_call" |
| timestamp | TIMESTAMP | ISO 8601 UTC timestamp |
| ip_address | INET | IP address at time of decision |
| user_agent | TEXT | Browser user agent string |
| source | VARCHAR(64) | "signup_flow", "preference_center", "cookie_banner", "api" |
Consent Propagation Log Tracks downstream system notifications after consent changes.
| Field | Type | Description |
|---|---|---|
| propagation_id | UUID | Unique propagation event ID |
| decision_id | UUID | FK to consent decision that triggered this |
| target_system | VARCHAR(256) | Name of downstream system notified |
| status | ENUM | "pending", "delivered", "acknowledged", "failed" |
| sent_at | TIMESTAMP | When notification was dispatched |
| acknowledged_at | TIMESTAMP | When downstream system confirmed receipt |
GET /api/v1/consent/preferences/{subject_id} Returns current consent state for all purposes for a given data subject.
Response:
{
"subject_id": "usr_7f3a9b2e-41d8-4c76-b5e3-9a8d1c2f4e60",
"preferences": [
{
"purpose_id": "pur_analytics_001",
"purpose_name": "Service Improvement Analytics",
"decision": "granted",
"granted_at": "2026-01-15T10:30:00Z",
"version_id": "ver_a1b2c3d4"
},
{
"purpose_id": "pur_marketing_002",
"purpose_name": "Product Update Emails",
"decision": "withdrawn",
"withdrawn_at": "2026-02-20T14:45:00Z",
"version_id": "ver_e5f6g7h8"
}
],
"last_updated": "2026-02-20T14:45:00Z"
}
PUT /api/v1/consent/preferences/{subject_id} Updates consent for one or more purposes. Triggers downstream propagation.
Request:
{
"decisions": [
{
"purpose_id": "pur_marketing_002",
"decision": "granted",
"mechanism": "toggle_switch"
}
]
}
GET /api/v1/consent/history/{subject_id} Returns full consent history for audit purposes per Article 7(1).
GET /api/v1/consent/receipt/{decision_id} Returns a single consent receipt in Kantara Initiative Consent Receipt format.
The IAB Transparency and Consent Framework v2.2 (released September 2023) requires:
The preference center interface at CloudVault SaaS Inc. follows these design principles:
Layout:
Per-Purpose Toggle:
Consent History:
Withdrawal Flow:
Every consent text change creates a new version record. The preference center always displays the current version but retains all historical versions. Audit queries can reconstruct: