PrivacyProbe Blog
Consent Mode v3 Should Be an Open Privacy Manifest
Published May 2026 · 7 min read
Google Consent Mode v2 changed the privacy conversation. It made consent feel less like a banner setting and more like a live technical signal: analytics allowed, advertising denied, personalisation restricted, user data controlled.
That was an important shift. But it also exposed the next problem.
Modern websites are not made of one consent system. They are made of CMPs, tag managers, Shopify apps, embedded videos, analytics libraries, payment widgets, advertising pixels, chat tools, A/B testing platforms, plugins, and vendor scripts. Each one has its own language for consent. Each one has its own database, category model, implementation guide, and edge cases.
Consent Mode v2 helped standardise how Google tags receive consent. The next step should be bigger: a neutral middle layer that lets every platform declare what it does, how it maps to consent, and whether reality matches the declaration.
That is the idea behind the Privacy Manifest.
What Consent Mode v2 Started
Consent Mode v2 set an important precedent: consent should be machine-readable and operational. It is not enough for a website to say “we use cookies.” The site needs to pass structured consent states to the systems that act on them.
Google’s consent signals, including ad_storage, analytics_storage, ad_user_data, and ad_personalization, pushed the industry toward a more technical model of consent. CMPs such as Usercentrics and CookieYes now provide integrations that map user choices into those signals.
That is progress. But it is still centred on one ecosystem. It does not, by itself, explain every cookie, every iframe, every Shopify app, every vendor script, every route, or every pre-consent network request.
The Missing Middle Layer
Today, consent compliance often depends on database hunting. A CMP has a vendor database. A scanner has a cookie database. A platform has an app registry. A tag manager has a container. A developer has partial knowledge. A legal team has a policy.
None of those views is complete on its own.
The Privacy Manifest is designed to sit in the middle. It is a small, public, machine-readable file that says:
- which vendors and components are used
- which storage items may appear
- which scripts and endpoints are involved
- which consent categories apply
- how those categories map to Google Consent Mode, Shopify privacy permissions, CMP categories, or other systems
- what was observed in a real browser scan
In other words: not just “what does the banner say?”, but “what does the website actually do?”
What This Looks Like in Reality
The winning version is not a long specification that a merchant has to understand. It is a quiet workflow that happens around the tools they already use.
A Shopify merchant installs a reviews app, analytics pixel, or marketing tool. The app has its own vendor manifest. Shopify or the app exposes what it may store, what endpoints it talks to, and which privacy permissions it needs.
A CMP such as Usercentrics or CookieYes reads that information, maps it to its own categories, and applies the right consent controls. Google Consent Mode receives the Google-specific signals. Shopify receives the Shopify-specific privacy permissions. The website publishes one site-level Privacy Manifest that ties it together.
Then PrivacyProbe scans the live site. It checks the declaration against observed browser behaviour: cookies, local storage, iframes, scripts, network requests, consent-state transitions, and route-specific differences.
The result is a practical loop:
- Declare what should happen.
- Map it into the systems that need to act.
- Observe what actually happens.
- Flag the difference.
That is what “small manifest, generated automatically, validated visually, mapped to platforms, and compared against live evidence” means. The user does not write JSON. The ecosystem generates it, and the browser proves it.
Shopify, CMPs, and Vendors
Shopify already has the concept of customer privacy permissions. Google already has Consent Mode. CMPs already have category mappings. Vendors already know what their own scripts do. The problem is that these systems do not share one neutral disclosure layer.
A Privacy Manifest could help each group:
- Shopify apps could declare storage, scripts, endpoints, and required privacy permissions.
- CMPs could import declarations instead of relying only on database matching and manual configuration.
- Vendors could publish one reusable vendor manifest for each component they ship.
- Website operators could publish one site-level manifest showing the actual deployed stack.
- Scanners and auditors could compare declarations against live evidence.
This does not replace CMPs. It gives CMPs, platforms, and auditors a common language.
Why It Matters
The privacy web is still too opaque. A user sees a banner. A marketer sees a dashboard. A developer sees scripts. A lawyer sees policy text. A regulator sees outcomes. None of them has a single source of truth.
Consent Mode v2 proved that structured consent signals can move the market. A vendor-neutral Privacy Manifest could take that idea further: from consent signalling to consent transparency.
If Consent Mode v2 was the moment consent became operational, the next step should make consent observable, portable, and verifiable.
That is why we think “Consent Mode v3” should not just be another platform-specific mode. It should be an open manifest layer for the whole privacy stack.
Try the Draft
PrivacyProbe has published an experimental Privacy Manifest and Privacy Vendor Manifest draft. You can read the spec, validate a manifest, or run a live scan to compare what a website says against what the browser observes.
Note: “Consent Mode v3” is used here as a forward-looking industry idea, not as an announced Google product.