01
Record the visitor's choice.
Retain the consent state and category preferences that were active for the delivered browser experience.
GDPR • CONSENT AND RUNTIME ACCOUNTABILITY
Make consent choices visible in the browser they are meant to govern.
Connect a visitor's consent state with the third-party resources, browser access, and destinations observed during the session—so privacy teams can investigate whether the delivered experience matches the intended choice.
FROM PRIVACY CHOICE TO DELIVERED EXPERIENCE
Turn a privacy promise into observable browser behavior.
A consent record describes what a visitor selected. Runtime evidence shows what the website and its third parties subsequently did. Bringing those two views together gives privacy, legal, and engineering teams a practical way to review discrepancies without treating browser telemetry as a complete legal assessment.
02
Observe what happened next.
Identify the third parties, downstream resources, browser capabilities, and destinations active after that choice.
03
Review meaningful differences.
Investigate unexpected activation, narrow unnecessary access where appropriate, and use the current decision and technical context in the organization's privacy workflow.
CONSENT STATE IN OPERATION
Carry a visitor's choice into the systems that act on it.
A consent interface is only the beginning of the workflow. Retain the selected categories, apply consent-based activation rules to mapped resources, and send consent signals to supported services.
CHOICE
Retain the active preference state
Preserve the categories selected by the visitor and the consent state associated with the delivered experience.
ACTIVATION
Gate mapped non-essential resources
Apply category-based activation rules to mapped resources. Configured services using consent signals may load while receiving the visitor's consent state.
SIGNAL
Propagate supported consent states
Communicate the resulting state to configured downstream systems without treating signal delivery as proof of legal compliance.
RECIPIENT AND DESTINATION VISIBILITY
Follow third-party activity beyond the vendor named in your notice.
An analytics, advertising, support, or personalization tag can introduce additional code and communicate with downstream destinations. Runtime mapping reveals those observed relationships as the visitor experiences them, helping teams validate recipient and transfer documentation.
THE PRIVACY QUESTIONS RUNTIME EVIDENCE CAN INFORM
Review purpose, minimisation, recipients, and security against live behavior.
Browser observations are most useful when they answer a defined privacy question. They can support selected GDPR activities while the controller or processor remains responsible for the underlying legal determination and complete governance record.
ARTICLE 5
Is observed access proportionate to the stated purpose?
Compare storage, page-content, device, and network access with the documented purpose, then investigate behavior that appears unnecessary or unexpected.
ARTICLE 25
Does the default experience limit non-essential activity?
Use consent-aware activation rules and reviewed browser boundaries as technical measures within a broader privacy-by-design and default program.
ARTICLE 30
Do records reflect the recipients seen at runtime?
Use observed providers, dependencies, and destinations as supporting input when validating recipients, transfers, and safeguards documented elsewhere.
ARTICLE 32
Can unexpected third-party behavior be investigated?
Use session context, findings, the current decision, and latest disposition to support ongoing review of browser-side security measures.
PURPOSE-LIMITED BROWSER ACCESS
Constrain collection paths—not just vendor names.
A provider may be approved for one purpose without needing unrestricted access to storage, page content, device features, or arbitrary destinations. Translate the reviewed purpose into narrower technical boundaries and explicit exceptions.
Zero-trust for new resources
Require newly discovered browser resources to be reviewed before they are trusted in an enforcement workflow.
Network and regional boundaries
Restrict supported outbound requests by approved domain patterns or regions where appropriate.
Granular browser capabilities
Review and control supported access to storage, DOM content, network APIs, device features, and other browser capabilities.
PRIVACY DISCREPANCY REVIEW
Investigate when consent state and runtime activity do not align.
An unexpected resource, destination, or capability creates a concrete discrepancy for privacy, security, and engineering teams to review with session context intact.
Context-rich findings
Connect a finding to its provider, resource, observed behavior, destinations, capabilities, and affected sessions.
Reviewable response context
Keep the current decision, latest disposition, and technical context considered during review available with the finding.
Configurable notification routes
Route enabled event notifications through supported email and collaboration integrations used by your response teams.
PRIVACY ACCOUNTABILITY RECORD
Preserve the path from visitor choice to runtime review.
Keep consent context, observed third-party activity, policy state, findings, and reviewer decisions connected so privacy teams can explain what was expected, what occurred, and how a discrepancy was handled.
Provider and resource context
Keep first-seen, last-seen, dependency, behavior, current status, and available provider incident context for observed browser resources.
Current policy and decision records
Keep the current policy state and targeted decisions used to govern supported browser and network access.
Exportable technical evidence
Share browser-side findings and governance records with privacy, security, legal, and audit stakeholders.
ADDITIONAL SUPPORTING EVIDENCE
Browser evidence can inform more of the GDPR conversation.
Runtime records can contribute partial technical evidence to adjacent GDPR activities. They are inputs to the wider privacy program, not complete coverage of the underlying obligation.
01
Articles 24 and 28
Provider inventory, dependencies, current policy decisions, vendor assessments, and available incident context can support controller accountability and processor or sub-processor review.
02
Article 33
Issues, affected sessions, observed destinations, timestamps, and the latest disposition can inform an organization's assessment of a suspected personal-data incident.
03
Article 35
Observed browser capabilities, third-party relationships, and data destinations can provide technical input to a DPIA led and completed through the organization's broader privacy process.
Explore the connected workflows.
Go deeper into the controls, evidence, and related use cases behind this workflow.
- Website privacy and consent assurance
Compare captured visitor choices with observed browser behavior.
- Sensitive-data exfiltration prevention
Review supported browser access and outbound destinations before applying scoped controls.
- Compliance reporting and evidence
See how browser observations and control records support assessment preparation.
- Explore browser security capabilities
See how browser discovery, investigation, policy control, and supporting evidence work together.
GDPR BROWSER GOVERNANCE FAQ
Practical answers for privacy operations teams.
Answers about consent state, runtime visibility, browser-side controls, and the limits of technical evidence within a wider GDPR program.
Which part of GDPR can browser-side governance support?
It focuses on the technical layer: consent state, third-party resources, provider relationships, destinations, supported browser capabilities, policy enforcement, and investigation records.
Browser-side support:These capabilities support accountability and evidence for selected GDPR principles and obligations at the browser layer.
Which GDPR articles can browser evidence help inform?
Browser observations and controls may be relevant to work involving Articles 5, 24, 25, 28, 30, 32, 33, and 35, depending on the organization's processing, scope, and implementation.
Browser-side support:The page separates stronger browser-side alignment from partial supporting evidence and avoids presenting either as complete article coverage.
How does runtime monitoring support data-flow review?
Runtime activity reveals scripts, supported browser access, and network destinations for comparison with processing and legal-basis records.
Browser-side support:The evidence helps privacy and security teams compare observed behavior with their data mapping, purpose, legal-basis, and transparency records.
Can runtime monitoring find downstream resources introduced by a known vendor?
Yes. Third-party scripts can load additional resources and communicate with further destinations at runtime.
Browser-side support:Provider, resource, and load-flow views reveal observed dependencies beyond the original tag.
Are permissions automatically enforced based on observed use?
No. Observed activity provides evidence for permission review; it does not automatically create or apply a production policy.
Browser-side support:Reviewers deliberately configure global, provider, or resource-level network and browser permissions.
How do browser alerts support privacy incident review?
A technical anomaly or issue supplies browser-side facts for the organization's breach assessment.
Browser-side support:The browser-side facts, affected-session context, alert record, and latest disposition can inform the organization's legal and operational assessment.
Does browser telemetry create a complete Article 30 record?
No. A complete record requires organizational details, purposes, categories of data and data subjects, recipients, transfers, retention, and safeguards beyond browser telemetry.
Browser-side support:Observed providers, destinations, dependencies, and technical controls can support validation of the browser-side portion of records maintained elsewhere.
How does consent management relate to browser-side governance?
Consent management records a visitor's choices, applies category-based activation rules to mapped resources, and sends consent signals to supported services. Unmapped resources are not blocked by category rules, and configured signal-based services may load while receiving the consent state. Browser-side observation provides a separate view of the activity that actually occurred.
Browser-side support:Comparing expected consent state with observed runtime behavior helps teams identify and investigate discrepancies alongside their lawful-basis and wider GDPR records.
VERIFY THE EXPERIENCE AFTER THE CHOICE
See whether browser behavior matches your privacy intent.
Connect consent state with observed third-party activity, investigate discrepancies, and preserve a technical record for privacy, legal, security, and engineering review.
