The Court of Justice held in C-604/22, on 7th March 2024, that a TCF consent string is personal data where it can reasonably be associated with an identifier such as an IP address, and that a body which determines how the framework processes it is a joint controller. A consent platform cannot produce that record about itself. Code agents and release automation change tracking surfaces faster than a manual review cycle covers them. When a regulator asks who authorised a tag, the answer has to name a person and a date. Obscurity gives boards and data protection officers the independent, timestamped evidence that demonstrates ongoing control of what a site ships.
Governance Posture Review and Retainer
An engagement usually starts with a Governance Posture Review, which sets down in writing, on a date, what your tracking does. Beyond that, an Obscurity Governance Retainer operates the measurement layer month after month under one named contact. Reviews, retainers and fixed-fee work are quoted in writing within two working days of a 30-minute scoping call.
What a retained month contains
A retained month is continuous work. After each release your journeys are run again through their consent states - accept, reject, and the partial states in between. A change that alters what a page sends is caught while the release is still fresh.
Every tag change we make is staged as a version in your own container and published on your side, under your change process. The record says what changed and why. When something breaks, the evidence is captured as it happens - what fired, on which page, under which consent state - rather than reconstructed afterwards.
A written report goes out each month covering what ran, what changed and what is still open. The report names the person who ran the month.
Scope of service
- Included
- We find what your sites are sending and remediate the tags and the containers behind it. We quantify it from the analytics data we can reach, and document it so the finding stands up on its own. This work runs under the agreed scope, without waiting for a request each time.
- On request
- We brief your data protection officer, your legal team or your board on what we found, and we present the record in person. We supply the factual material and the method behind it to support a response to a regulator. Preserving or extracting data from the systems we can reach falls here too, as does an analysis deeper than the month called for. On your written instruction, we scope and quote this work separately from routine measurement work.
We do not decide whether it is notifiable. A finding is only useful to your DPO if the people who produced it had no interest in the answer.
Professional indemnity insurance is held. Your exit pack is the copy you keep. You build it yourself from the reports page, in an open format, and it verifies offline with the script it carries. The pack's link expires after 30 days, and the pack can be rebuilt.
Security and due diligence questions are answered on the ConsentMark security page.
How we deliver
Every engagement starts with a ConsentMark scan of your digital properties. ConsentMark provides the evidence layer: automated scans, each kept as a record.
Regulated industries with complex digital properties
We work in sectors where a supervisory authority can ask what a website measures and expect a documented answer.
Every engagement is led by the principal who signs the report. The work turns on technical detail and regulatory context at the same time, and on the judgement to say what a finding means for a compliance posture.
ConsentMark, our own scanning and monitoring platform, carries the measurement. It runs on a daily schedule, so the time goes on reading what a scan found rather than on collecting it.