Skip to content

Delete Edge Cookie and KV store entry when user withdraws consent #466

Closed

Description

@ChristianPavilonis

User story

As a publisher, I want existing EC cookies and KV store entries to be deleted when a user revokes consent, so that tracking stops immediately upon withdrawal.

Acceptance criteria

  • If consent is not given AND an EC cookie is present → delete the cookie value AND delete the corresponding KV store entry
  • Revocation is acted on in the same request where lack of consent is detected
  • After revocation, subsequent requests with no consent and no cookie result in no action (do nothing)

Affected area

Core (synthetic IDs, cookies, GDPR), Fastly runtime

Proposed approach

  1. After decoding consent (per the TCF/GPP decoding issue), check for the revocation scenario: has_consent == false && edge_cookie.is_some().
  2. If triggered:
    • Set the EC cookie to expire (clear it from the response).
    • Delete the corresponding entry from the Fastly KV store.
  3. If has_consent == false && ssc_cookie.is_none(), do nothing — no cleanup needed.
  4. This check runs on every request as part of the consent evaluation pipeline.

Additional context

Sub-issue of #54. Related to #312, PR #380.
Handles the consent withdrawal / revocation case required by GDPR Article 7(3) and US state privacy laws.

Activity

  1. changed the title [-]Delete SSC cookie and KV store entry when user withdraws consent[/-] [+]Delete Edge Cookie and KV store entry when user withdraws consent[/+] on Mar 17, 2026
  2. added a commit that references this issue on Mar 18, 2026
    eac321c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions