What's happening under the covers

Signed in as	—
Kirana Cart's id for you	—
Consent tag's device id	—
Choices the tag is applying	—
Can we prove who you are?	—

1. Kirana Cart authenticates you. Its own login, its own user table. Consentra is not involved and never sees a password.

2. Kirana Cart's server asks for a short-lived token. It sends the API key we issued it, and its own opaque id for you. The key is a secret and lives only on their server — in a web page, any visitor could read it and mint a token claiming to be anyone.

3. The page hands that token to the tag. CMP.identify(accountId, token). Now the claim "this visitor is account X" is something we can check rather than something we have to believe.

Without it, anyone could type any account id into the tag. Two things follow, and both are bad: consent could be filed under someone else's account, and a person's choices could be read by anyone who guessed their id.

So by default we ignore the claim entirely — which is exactly why, before this work, choices did not follow anyone to a new device. The token is what makes it safe to believe, and therefore what makes cross-device possible.

Clearing cookies gives you a fresh banner. If an anonymous visitor wipes their cookies, we do not go looking for an old record to reinstate. We could — but silently restoring a choice the person has just erased would be evidence of a decision they did not make.

No fingerprinting. There is no attempt to re-identify a browser by any other means. The cookie is the identifier; if it is gone, the visitor is new.