Explainer

What is a consent journey?

A consent journey maps how consent is requested, renewed, revoked, and recorded over time.

Definition

A consent journey maps consent from the first request through renewal, revocation, and expiry. It treats consent as a series of choices, not a single checkbox.

A well-built journey issues a receipt for each choice and logs every change, so a person can prove what they agreed to and when.

Consent counts only where refusing is possible. A person who cannot get the service without agreeing has not chosen the system, and the cost of leaving it belongs in the journey map.

A hypothetical case. A health data app asks for consent at sign-up and asks again every 90 days. A person can revoke it in one click and download a receipt.

In the glossary: Consent journey.

Mechanism, drawn

Consent is a sequence of explicit, auditable choices across changing contexts — never a one-time checkbox at onboarding.

The single-checkbox trap (static fallacy) Onboarding checkbox "I agree to all 48 pages" Perpetual presumed consent regardless of context drift Model retrained · Data shared with third parties · Revocation buried behind dark patterns Continuous lifecycle architecture 1. Request Explicit scope Bounded purpose 2. Grant + receipt User-held receipt Signed timestamp 3. Context shift? Model/policy change Shift detected Re-consent checkpoint Prompt user with diff before applying change No shift Active governed state Auditable consent log; 90-day renewal cycle User revokes 1-click revoke & purge Immediate revocation · Verifiable deletion receipt

In practice

What to look for

Every consent state, mapped

List each state: requested, granted, renewed, revoked, expired. Say what moves a person from one to the next, and give them a receipt for each move.

Asking again when the purpose changes

Most programs ask once and never again. Ask again when the purpose, the model, or the parties the data is shared with change.

Proof that revocation works

Publish how long a revocation takes to take effect, how many renewals are completed, and the consent history an auditor can check.

Where the standards use it:

  • Ethotechnics for agents (standard). Apply consent checkpoints to an agent's permissions, its escalation paths, and a person's route to challenge it.
  • STD-02 evidence pack. Keep consent receipts and review clocks with the evidence on challenges.

Common questions

How often should consent be renewed?

More often for riskier data. A sensitive data flow needs a shorter renewal window and a clear reminder.

What makes a consent journey auditable?

A log that ties each change to its scope, its purpose, and the owner who approved it. A receipt alone shows what the person chose, not what the system did with the choice.