Defines a governed cookie and browser-storage inventory, purpose classes, default behavior, consent linkage, scope, lifetime, deletion, change review, and automated verification by regional policy.
Package status: reference context ready for human review. The contract and test scenarios are complete, but no claim is made that an adopting implementation has passed them.
Decision
Register every cookie or equivalent browser-storage item before release. Resolve whether it is strictly necessary or optional under the applicable policy; block optional writes until the required decision and make revocation remove future access plus eligible stored values.
Scope
- Cookie/storage registry, purpose, owner, domain/path, attributes, lifetime, first/third party, consent mapping, deletion, regional policy, scanning, and release gates.
- HTTP cookies, local storage, SDK identifiers, and similar terminal-equipment storage.
- Technical evidence and governance, not a jurisdiction-universal legal opinion.
Outside this block
- Declaring an item necessary because it is convenient for analytics or advertising.
- Assuming deleting one cookie completes downstream personal-data deletion.
Contract
- The registry names item, technology, purpose, owner, data class, issuer, domain/path, lifetime, attributes, applicable policy, and deletion behavior.
- Necessary classification requires a documented service dependency and review; optional items do not write before the required choice.
- Cookies use the narrowest Domain and Path plus Secure, HttpOnly, and SameSite attributes appropriate to their purpose.
- Expiry is bounded to purpose; renewal does not silently create indefinite storage.
- Withdrawal prevents new optional writes, invokes SDK disablement, and removes accessible optional values according to the registry.
- Unknown cookies or storage keys found by automated scans fail or quarantine the release according to policy.
Implementation guidance
- Centralize first-party creation behind a registry-aware API and load third-party tags through a consent-aware loader.
- Scan clean profiles across routes and choice states, recording initiator and network evidence.
- Keep server Set-Cookie responses in the same inventory as client storage.
- Version policy and registry so evidence reproduces what rules applied at a release.
Failure handling and safeguards
- If the consent service is unavailable, optional storage remains disabled under the conservative profile.
- If a third-party script writes before authorization, disable the integration and treat it as a release incident.
- If a cookie cannot be deleted because of domain/path mismatch, correct the exact scope and verify removal.
Verification and operations
- Measure unknown items, pre-choice optional writes, stale registry entries, excessive lifetimes, missing security attributes, and revocation deletion failures.
- Run automated clean-browser scans and targeted manual network review.
- Have qualified privacy/legal review determine applicable categories and notices.
The executable-looking examples in this package are fixtures and acceptance contracts. Run
python tools/validate.py from the collection root to check package structure and metadata; then
implement and execute the scenarios in the target repository.
Adoption assumptions
- Names and numeric values in
example.yamlare an adoption profile, not universal defaults. - The adopting team must map actors, data classes, error vocabulary, and ownership to its system.