#Browser consent, identity storage, and data-minimization (T1.14)

Status: ready for test (implement attestation 2026-08-12)
Purpose: Lock the client-browser policy for @cx-orbit/browser: consent gate, anonymous ID storage, attribution-window alignment with the event dictionary, and what the browser must not send.
Implementation: T2.13 (P1). This file is the spec T2.13 must implement. It does not ship the SDK.
Product contract: identity rules in ../simiaroom-cx-v5.md ID-01; envelope in MVP-EVENT-SCOPE.md / SDK-AND-DATA-INGESTION.md §7 (T0.4); staff UI access in PRIVACY-ACCESS-MATRIX.md (T1.11 — different audience).

This is a documentation/spec lock. It does not change collector ingest, @cx-orbit/node, or P0 backend instrumentation.

#1. How to read this doc

#1.1 What this task is / is not

Named security/product sign-off of this policy is residual (same class as T1.8 / T1.11). Do not invent a sign-off. T4.10 reviewed this file on 2026-08-12 even though @cx-orbit/browser is not shipped (SECURITY-REVIEW-T4.10.md §5).

#1.2 Capacity guardrail

P0 is the backend decision loop (collector + @cx-orbit/node + authoritative outcomes). The P0 backend path is not consent-gated. This policy must not delay or add a consent check to server write keys or P0 backend events.

Browser SDK remains P1. Missing @cx-orbit/browser does not block T2.2 / T2.2a / T2.2b. Authoritative conversion spine stays backend-proved (ADR 0002).

#1.3 Audiences (do not mix)

T1.11 identifier class (user_id, anonymous_id, device_id) still applies after events land in Orbit. This file limits what the browser is allowed to emit; T1.11 limits which staff roles may view those identifiers.

#2. Consent gate (browser SDK)

Normative for T2.13. Collector server-key paths ignore this gate.

#2.1 Default deny

MVP has one Orbit-relevant flag: analytics. Do not invent marketing, ads, or “necessary cookies” categories in the SDK. Simiaroom’s own cookie banner / legal copy is out of this repo; the product app calls cx.setConsent after its own flow.

setConsent is the only grant path. Loading the SDK script is not consent.

#2.2 Required SDK behavior

Public API already sketched in SDK-AND-DATA-INGESTION.md §6: cx.setConsent(consent), cx.reset().

T2.13 Test Agent gate (preview, not this task): consent off → no events; consent on → flush works.

#2.3 What consent does **not** control

• @cx-orbit/node / outbox / CDC / CSV / webhooks
• Collector accept of server-key batches
• Staff Orbit UI cookies (ADR 0001 Auth.js sessions)
• T5.10 outbound contact consent (user_consent on INT contact attempts)
• Identity merge (T2.3 job). The browser never merges accounts.

#2.4 Product owns the banner

Orbit does not ship a CMP or cookie banner. Simiaroom web must:

1. Show whatever notice legal requires
2. Call cx.setConsent({ analytics: true }) only after a clear affirmative
3. Call cx.setConsent({ analytics: false }) or cx.reset() on withdraw

If the product never calls setConsent, the SDK stays silent. That is correct.

#3. Anonymous ID storage rules

Applies only when analytics consent is granted. Keys are first-party to the Simiaroom site that loads the SDK.

#3.1 Identifiers

Envelope identity object is T0.4 / SDK §7.2:

"identity": {
  "anonymous_id": "string|null",
  "user_id": "string|null",
  "session_id": "string|null"
}

device_id is not inside identity. It is an allowlisted property (T1.12 identifier class), matching AUTH-01 fixtures.

#3.2 Generation and format

• anonymous_id and device_id are SDK-generated UUIDs (string). Suggested prefixes anon_ / dev_ for operability; not required for uniqueness.
• Do not use canvas, WebGL, audio, font, or IP fingerprinting to build device_id.
• Do not use email, phone, national ID, or user-agent as anonymous_id.
• New IDs are created only after consent grant if none exist (or after reset()).

#3.3 Cookie / storage attributes (when using cookies)

No __Host- requirement. No cross-subdomain cookie until security approves a short-lived, integrity-protected cross-domain identifier (SDK §9). Default: same origin only.

#3.4 Logout, reset, shared device

#3.5 Queue persistence

Ingestion §8.3 allows “optional consent-compatible persistence” for the browser queue. Rule: persist the queue only while analytics consent is granted, and never persist payloads that violate §5. On withdraw, delete the persisted queue.

#4. Attribution window alignment (event dictionary ID-01)

Source: simiaroom-cx-v5.md §5 ID-01. Runtime constants: packages/identity/src/constants.ts (T2.3). This policy must not invent different windows.

Dictionary J-01 notes that also bind this policy:

• IP alone never connects anonymous_id → user_id.
• Ghost-to-login conversion counts only in-window, deterministic links. Out-of-window or low-confidence links are not conversion.

#4.1 Why storage TTL is 30 days

The longest browser-relevant deterministic window is same-device 30 days. Cookie / localStorage TTL of 30 days (sliding) keeps ghost history eligible for that path and lets IDs expire when ID-01 would refuse the link anyway.

Cross-device 7-day and assisted 14-day paths do not require a longer browser cookie. They use backend-verified evidence.

#4.2 Browser does not emit AUTH-04

identity_link_created (AUTH-04) is a backend / Orbit identity job event (simiaroom_auth / T2.3). The browser must not send AUTH-04, AUTH-01, or other authoritative P0 outcomes.

After product login, the browser may identify(user_id) so subsequent behavioral events carry identity.user_id and the existing anonymous_id. Linkage of past anonymous events is T2.3, using ID-01 windows — not a client-side rewrite of raw events (SDK §9).

#4.3 Envelope vs dictionary

T0.4 requires nested identity on every event. Browser events may send anonymous_id with user_id: null until identify (MVP-EVENT-SCOPE identity rules). Authoritative P0 backend outcomes still require identity.user_id. That split is unchanged.

#5. Minimization — what the browser must NOT send

Allowlist per event contract (SDK §12, T1.12). If a field is not on the approved browser contract, do not send it.

#5.1 Never — any browser event

#5.2 Never — event **classes** from the browser

Browser is behavior and intent only (ADR 0002). Producer-of-record for outcomes is backend.

Do not emit from @cx-orbit/browser:

• Authoritative P0 slice: authentication_succeeded, identity_link_created, assessment_completed, therapist_selected, booking_confirmed, booking_cancelled, payment_succeeded, payment_failed, session_completed, session_no_show_recorded, therapy_pause_declared, treatment_completed, internal_case_resolved
• Other backend-owned P0 outcomes in SOURCE-OWNERSHIP.md / SOURCE-EVENT-MAPPING.md
• Orbit-derived types (unplanned_gap_detected, SYS-01, churn state events)

T2.13 may instrument selected P1/behavioral types only, matching the mapping defer list (ASM-02, ASM-04, THR-01, THR-02, BKG-01, BKG-05, BKG-06, PAY-04, SES-04, RET-01) — still under this denylist for properties.

Collector (when T2.13 ships) rejects other classes on the browser write key (EVENT_CLASS_NOT_PERMITTED, ingestion §11 / ADR 0001 origin/rate/class limits). That check is defense in depth; the SDK must not send them.

#5.3 Allowed (when consented and allowlisted)

source must be cx_orbit_browser (or the locked producer ID in SOURCE-OWNERSHIP). Do not spoof simiaroom_booking / simiaroom_auth.

#5.4 Privacy classes (T1.12) — browser default

This is stricter than T1.11 staff grants: even ops may see financial in Orbit UI from backend payment events; the browser still must not originate those fields.

#6. P0 backend path is not blocked

Staging collector and the 12-event backend slice can ship without a cookie banner, without @cx-orbit/browser, and without this policy being enforced in code.

When T2.13 exists, a leaked browser key must still be unable to emit P0 outcomes or read storage (ADR 0001).

#7. Alignment with T0.4, ADR 0001, ADR 0002

#8. Alignment with T1.11 (do not conflict)

T1.11 is in flight / ready_for_test as a staff access matrix. This file does not change roles, screen grants, support 360 allowlists, or payment-secrets policy for the timeline.

If a T1.11 sentence still says “T1.14 not done”, treat this file as the T1.14 deliverable; do not reopen T1.11’s matrix to encode cookie rules.

#9. T5.10 handoff (contact consent)

T5.10 (SET-07) versions outbound contact policy: channel, user_consent, attempt caps, quiet hours. That is not cx.setConsent({ analytics }).

Handoff rule for T5.10: do not use analytics-cookie grant as permission to email/SMS a client. Do not use contact opt-out to silently disable backend P0 events. No silent bypass of either flag.

#10. In-repo review (T1.14)

This is the security/product review evidence, not a fabricated stakeholder sign-off.

Cross-checked in this pass (pointers, not a Test Agent result):

Approve Agent may still require named humans. This pack must not be treated as that sign-off. T4.10 reviewed this policy without a live SDK (SECURITY-REVIEW-T4.10.md).

#11. Out of scope / residuals

#12. References

• ../simiaroom-cx-v5.md — ID-01 identity + attribution windows
• MVP-EVENT-SCOPE.md — T0.4 envelope identity refs
• SDK-AND-DATA-INGESTION.md — §7 envelope, §9 identity, §12 privacy, §8.3/§8.5 browser delivery
• PRIVACY-ACCESS-MATRIX.md — T1.11 staff access (do not conflict)
• SOURCE-EVENT-MAPPING.md / SOURCE-OWNERSHIP.md — browser vs backend producers
• adr/0001-stack-hosting-auth.md — browser keys; minimization
• adr/0002-collector-sdk-outbox.md — collector ingress; backend proves outcomes
• workflows/dod/month-1.md — T1.14 DoD
• workflows/dod/month-2.md — T2.13 DoD
• workflows/dod/month-4.md — T4.10 DoD
• workflows/dod/phase-5.md — T5.10 DoD