Consent certificates

A consent certificate seals a form submission into a tamper-evident, publicly verifiable record. It answers the regulated-lead-flow question — what exactly did this person agree to, naming whom, on what page, under which terms? — in a form a carrier, buyer, auditor, or regulator can check at a URL.

Capture requirements

• Capture MUST be pinned to the recipient: the browser Origin and the submitted page URL’s host MUST match one of the recipient’s verified domains. Certificates from unverified origins MUST be rejected.
• The certificate MUST record the verbatim disclosure text as displayed, and its SHA-256.
• The certificate MUST record the entity list — every organization named as receiving the data. This is the one-to-one requirement: consent is valid only for the entities the person actually saw.
• Field keys MUST come from the registry.
• Capture MUST be fail-open from the host page’s perspective: an evidence failure never blocks the visitor’s submission (see embed contract).

The stored record

Component	Treatment
Subject fields	Encrypted (envelope encryption; per-certificate key; AAD binds ciphertext to cert_id) — never public
Masked subject	e.g. j***@e***.com — the only subject-derived value in public surfaces
Disclosure text + hash	Public
Entities, purpose, page, origin, timestamp	Public
Technical evidence (IP, user agent)	Available to the recipient; not on public surfaces
Fingerprint	Public
Policy snapshots	Hashes + dates public; text available to the recipient

Public verification

Hubs MUST provide two no-auth verification surfaces per certificate:

1. JSON — machine-checkable: all public components above plus revocation status and the external anchor receipt.
2. A human-readable page at a stable URL. Every open of this page SHOULD itself be recorded as evidence (count, timestamp, IP, user agent, OS) — the act of verification becomes part of the record.

The subject MUST appear only masked on both surfaces.

Policy snapshots

At issuance the hub captures the origin domain’s privacy-policy and terms text — the terms as of the opt-in:

• Snapshots are keyed by domain + kind and deduplicated by content SHA-256: certificates issued while the text is unchanged share one immutable snapshot; any edit creates a new one.
• Policy-link discovery MUST prefer href path matching (/privacy, /terms, …) over anchor-text matching, and anchor text is only trusted for short link labels — page prose that merely mentions “privacy” must not be misclassified.
• Capture runs after the certificate response and MUST NOT delay it.

Revocation

Certificates carry a status (active / revoked). Revocation never deletes: the record and every hash remain, with the revocation timestamped — evidence of the original agreement and of its withdrawal.