Consent and Privacy Management
Nevis ID provides built-in consent management for terms and conditions: versioned terms are presented to users during registration or login as a step in the authentication flow, acceptance is explicit (a checkbox per document) or implicit, and every acceptance is recorded per user with the terms version and acceptance date. Terms attach to applications, so each application maintains its own consent requirements, and the default policy prompts every end user out of the box; when terms change, users are asked to accept the current version again at their next login. Consent records are available in the management console and over the REST API for audits and compliance purposes such as GDPR, and the terms documents themselves are served from your own URLs per language, so the legal content stays under your governance. Nevis ID is the identity provider that records and enforces acceptance; dedicated consent-and-preference-management (CPM) platforms remain an integration adjacency, and the OAuth consent screen for third-party applications is a separate mechanism covered under Federation and SSO.
Also known as
consent and preference management, consent lifecycle, terms and conditions acceptance, privacy preferences, GDPR consent records, DSAR, privacy compliance, data minimization.
At a glance
| Capability | Details |
|---|---|
| Terms and conditions acceptance | Versioned terms presented during registration or login; the acceptance step runs inside the authentication flow, with explicit (checkbox per document) or implicit (continue) acceptance |
| Per-application terms | Terms attach to applications, and one application can carry several terms documents; the default policy assigns the Main.terms role to every end user, so all end users are prompted out of the box |
| Consent records | Each acceptance is recorded as a consent object with the terms identifier, the accepted terms version, and the acceptance date; visible per user in the management console and queryable over the REST API as audit evidence |
| Versioning and re-acceptance | Terms carry a version and an active flag; after a change, users are prompted for the current version again at next login; silent acceptance is configurable per terms object |
| Localization | Each terms object links its content per language: a URL per language code pointing to the document you host, so the legal text stays under your governance |
| Self-service privacy controls | In the self-service app end users can download all personal data held on their account, delete their account, correct their profile details, and manage their devices and sessions |
| Data classification | Attribute-level classification of personal and sensitive data returned with property and user reads over the REST API; see also Registration, Onboarding, and Identity Verification |
| Data subject requests | Fulfilled self-service by the end user (data download, account deletion, profile correction) or over the API (per-user data reads, consent listings, account archiving and deletion); operational assistance is covered under Deployment, Architecture, and Data Residency |
| Consent evidence and audit | Consent records serve as audit evidence; admin-action history, log and event export, and SIEM integration are covered under Reporting, Analytics, and Audit |
| CPM integration | Preference centers, cookie consent, and purpose taxonomies live in dedicated consent-and-preference-management platforms, which connect over the APIs; Nevis ID records and enforces terms acceptance natively |
| OAuth consent | The OAuth 2.0 consent screen and persisted scope consents are a separate mechanism; see Federation and SSO |
Concepts
- Data model: how terms and conditions attach to the Main application, and why every end user is prompted out of the box
- User management APIs: the API section covering users, credentials, and terms and conditions, including how these APIs are exposed
How-to Guides
- Terms and Conditions with Consent Management: managing terms in the console and the end-user consent experience, explicit and implicit
- Onboarding with passkey: consent capture inside a live registration flow
- Self-service profile management: account deletion and the other self-service data controls
- Console usage terms: the terms governing your team's use of the management console itself, not end-user consent
References
- Terms and consent APIs: Terms and Conditions / Consents, with List pending terms, Create a consent, List all consents, and Create a terms object
- Acceptance pattern: nevisIDM Terms & Conditions Acceptance and its explicit or implicit acceptance setting
- User data lifecycle APIs: Archive a user, Delete a user