Categories and Services
The consent manager works in two layers: categories a visitor chooses between, and services that belong to them.
Where to find it
Architect Panel → Security:
- Cookie Consent — categories, services, cookies, scans and records
Categories
Each has a name, a friendly name, a description, and several flags: whether it is required, whether it defaults to on, whether it emits consent-mode signals, whether the browser’s Global Privacy Control applies to it, and whether it is hidden.
Keep the set small and conventional
Strictly necessary, functional, analytics and marketing covers nearly everything and is what visitors expect. A bespoke set of nine categories is a set nobody reads before clicking accept.
Required means genuinely required
A category marked required cannot be declined, so it must contain only things the site genuinely cannot work without — the session cookie, the consent record itself, security tokens.
Marking analytics as strictly necessary is the single most common bad-faith configuration, and it is exactly what an investigation looks for.
Default-on needs care
In an opt-in jurisdiction, non-essential categories must start off. Default-on belongs to opt-out jurisdictions, where the visitor has the right to refuse rather than the right to be asked.
Global Privacy Control
Some browsers send a signal that the visitor objects to sale or sharing of their data. Categories can be marked as respecting it, which means those visitors are treated as having declined without being asked.
Respecting it is legally required in some places and is good practice everywhere.
Services
Each third party you load is registered as a service in a category, with its provider, purpose, privacy policy address, retention period and where the data goes.
Crucially it also carries how it is loaded — a script address, inline script or attributes — and the patterns used to block it until consent is given.
The blocking patterns are the mechanism
They are what actually stops the third party loading. A service registered with a purpose and no blocking pattern is documented but not controlled, which is the worst of both.
Record the purpose honestly
Purpose, retention and data location are what you publish to visitors and what you rely on if asked. "Analytics" is not a purpose; "counts page views to see which content is used" is.
Review what is registered
Services accumulate. Anything nobody is reading should be removed rather than continuing to collect with a documented purpose.
Worked example
A site uses four categories with only session and security cookies marked required, analytics and marketing both defaulting to off and both respecting the browser privacy signal. Each third party is registered with a real purpose sentence and blocking patterns, verified by checking nothing loads before agreement.
Recommendations
- Four conventional categories, not nine bespoke ones.
- Required means the site breaks without it.
- Always set blocking patterns — the purpose alone controls nothing.
- Respect the browser privacy signal.