This glossary covers the terms you'll see when researching or implementing cookie consent. Each definition is written for website owners and marketers, not lawyers.
A
Ad Storage — One of Google Consent Mode's consent types. Controls whether Google can set cookies for advertising purposes (remarketing, conversion tracking). Must be explicitly granted by EEA visitors before Google Ads tracking works.
Analytics Storage — Another Google Consent Mode consent type. Controls whether Google Analytics can set cookies to track user behavior. Denied by default for EEA visitors until they consent.
C
CCPA (California Consumer Privacy Act) — California's privacy law, updated by CPRA in 2023. Uses an opt-out model: businesses can track by default but must offer a "Do Not Sell or Share My Personal Information" mechanism. Different from GDPR's opt-in model.
CMP (Consent Management Platform) — The software that manages cookie consent on your website. It shows the banner, collects choices, blocks scripts until consent, logs consent records, and sends consent signals to ad platforms. CookieBeam is a CMP. A simple JavaScript popup is not.
Consent Mode (v2) — Google's protocol for communicating consent state between your CMP and Google's tags (GA4, Google Ads, Floodlight). Version 2 added ad_user_data and ad_personalization signals. Required for EEA advertising since March 2024.
Consent Record — The stored evidence that a visitor gave (or denied) consent. Includes: timestamp, what was consented to, the banner version shown, and a unique ID. GDPR requires you to be able to demonstrate consent was valid.
Cookie Category — A group of cookies organized by purpose. Standard categories: Necessary (always allowed), Analytics (tracking behavior), Marketing (advertising/retargeting), Preferences (language, theme). Visitors consent per category, not per individual cookie.
Cookie Scanner — A tool that crawls your website to detect all cookies, scripts, and tracking technologies in use. Essential because websites accumulate tracking over time (marketing adds a pixel, a plugin drops a cookie) and manual auditing misses things.
Cookie Wall — Blocking access to a website unless the visitor accepts cookies. Illegal in most EU countries because consent isn't freely given if the alternative is losing access.
Core Web Vitals — Google's page experience metrics (LCP, INP, CLS) that affect search rankings. A heavy or poorly implemented consent banner can impact these, but a well-built one (async loading, overlay pattern) has negligible effect.
CPRA (California Privacy Rights Act) — The 2023 update to CCPA that added rights around sensitive personal information, data minimization, and the California Privacy Protection Agency. Often referenced together as CCPA/CPRA.
D
Dark Pattern — A user interface design that tricks or pressures visitors into a specific choice. In cookie consent: making Reject harder to find than Accept, using confusing toggle defaults, or coloring the Accept button and graying out Reject. Illegal under GDPR and being regulated in more jurisdictions.
Data Controller — The entity that decides why and how personal data is processed. Usually the website owner. Responsible for ensuring consent is properly collected.
Data Processor — The entity that processes personal data on behalf of the controller. Your CMP, your hosting provider, and your analytics tool are processors. A Data Processing Agreement (DPA) defines the relationship.
DPA (Data Processing Agreement) — A contract between a data controller and processor that specifies how personal data is handled, stored, and protected. Required under GDPR when you use third-party services that process visitor data.
DSAR (Data Subject Access Request) — A formal request from a person to see, correct, or delete their personal data. Under GDPR, you have 30 days to respond. Under CCPA, 45 days.
E-G
ePrivacy Directive — The EU directive that specifically governs cookies and electronic communications. Often called the "Cookie Law." It's what requires consent before setting non-essential cookies. Each EU member state implements it slightly differently.
Enhanced Conversions — Google's feature that lets you send hashed first-party data (email, phone) with conversion events for better attribution. Requires ad_user_data consent under GDPR.
GDPR (General Data Protection Regulation) — The EU's comprehensive data protection law. Requires explicit opt-in consent before processing personal data (including setting tracking cookies). Fines up to 20 million euros or 4% of global turnover.
GPC (Global Privacy Control) — A browser signal that communicates "do not sell or share my personal information." Legally binding in California (CCPA/CPRA) and Colorado (CPA). A compliant CMP should detect and honor it automatically.
I-L
IAB (Interactive Advertising Bureau) — The trade body that created the TCF standard for communicating consent to advertising vendors.
ITP (Intelligent Tracking Prevention) — Safari's feature that limits third-party cookie lifetimes and restricts tracking. First-party cookies set by JavaScript are capped at 7 days. Server-set first-party cookies are unaffected.
LGPD (Lei Geral de Protecao de Dados) — Brazil's data protection law, similar to GDPR. Requires consent for data processing and gives individuals rights over their data.
Legitimate Interest — A legal basis for processing data under GDPR that doesn't require consent. Can apply to some analytics use cases, but the bar is high and it doesn't override the ePrivacy Directive's cookie consent requirement. You can't use legitimate interest to skip the cookie banner.
O-S
Opt-In — The GDPR model. No tracking until the visitor actively clicks Accept. Default state: everything denied.
Opt-Out — The US model (CCPA). Tracking runs by default. The visitor can choose to stop it via a "Do Not Sell" mechanism.
PECR (Privacy and Electronic Communications Regulations) — The UK's implementation of the ePrivacy Directive. Requires consent for non-essential cookies, enforced by the ICO.
Server-Side GTM (sGTM) — Running Google Tag Manager on a server you control instead of in the visitor's browser. Improves tracking reliability (ad blockers can't block it), extends cookie lifetimes (server-set cookies bypass ITP), and improves page speed.
Strictly Necessary Cookie — A cookie that's essential for the website to function. Login sessions, shopping carts, CSRF tokens, and load balancer cookies qualify. These don't need consent. Analytics, marketing, and preference cookies do NOT qualify.
T-Z
TCF (Transparency and Consent Framework) — The IAB's standard for communicating consent to advertising vendors in programmatic advertising. Version 2.2 is current. Required if you run programmatic ads in the EEA (AdSense, header bidding). Not needed if you only run direct Google Ads.
Third-Party Cookie — A cookie set by a domain different from the one the visitor is on. Google, Facebook, and ad networks use these for cross-site tracking. Browsers are phasing them out. Google's Privacy Sandbox is the planned replacement on Chrome.
Vendor List — In TCF, the Global Vendor List (GVL) is the IAB's registry of advertising vendors that can process data under TCF consent. Your CMP lets visitors choose which vendors to consent to.