Agreely Docs
FR EN

Verify a proof

The /verify page

The bilingual public page https://cdn.agreely.ca/verify (also available at https://app.agreely.ca/verify/cookies) lets anyone (a visitor, an auditor, a regulator) look up the proof of a cookie consent decision without needing an Agreely account. This page is served by Agreely: what it shows can be cross-checked against the public chain, as described below.

Enter a consent identifier (consentId) to get:

  • The recorded decision (action, categories granted or refused, timestamp, banner language).
  • The configuration version and hash of the banner that was displayed.
  • The Merkle inclusion path in the corresponding chain epoch.
  • The epoch root and the on-chain anchoring transaction on the Base chain (transaction hash, chain id, Basescan link, anchoring time).

Decisions are anchored in batches. Until a decision's epoch is anchored, the proof carries the status pending: the decision and its commitment are shown, and the transaction is added once the anchoring is done.

The equivalent public API: GET https://cdn.agreely.ca/e/v1/proof/{consentId}

With ?recompute=1, the response also reveals the salt, which lets anyone recompute the commitment (commitment) from the decision. This data is withheld, with its reason in recomputeWithheld, when the decision binds visit data (a truncated IP address or a user agent, if the site turned it on) that the salt would disclose, when retention has destroyed the salt, or when it cannot be prepared.

The consentId

The consentId is a server-minted opaque identifier echoed in the visitor's browser agreely_consent cookie after their decision. It uniquely identifies a consent submission. It is never derived from visitor attributes.

A visitor can find their consentId by inspecting the agreely_consent cookie value on the relevant website.

What the on-chain anchoring proves

The anchoring on the Base chain (via the CookieConsentRootAnchored event) is an integrity proof: any tampering becomes detectable. It proves that the decision was recorded and has not been altered since. More precisely:

  • The decision (categories granted/refused, timestamp, configuration version) was included in a per-site hash chain block.
  • That block was folded into a per-site epoch Merkle root.
  • That Merkle root was anchored in a Base chain transaction (Ethereum L2), verifiable by anyone with a node or a public explorer.
  • The Merkle inclusion path lets you recompute the root with your own tools and compare it with the one in the transaction.

What the anchoring does not prove:

  • It does not prove that the banner displayed to the visitor was Law 25 compliant.
  • It does not prove that all cookies emitted by your site were handled according to the decision.
  • It does not prove the legal validity of consent for your own purposes (that is the responsible party's accountability).
  • It is not a compliance certificate. The precise claim is: "proof that this decision was recorded and has not been altered", never "proof of compliance".
  • It does not protect against the operator: Agreely could theoretically have recorded a decision different from the one presented to the visitor. The anchoring proves non-alteration since recording, not the fidelity of the initial capture. This is why the visitor's own check, with their own consentId, is the complementary trust layer.

Retention and data reduction

After the retention window (36 months, set by Agreely for the whole platform: your organization does not configure it), the readable fields of the decision (categories, banner language, truncated IP address, user agent) are emptied and the cryptographic salt is destroyed in the live database, which makes the commitment impossible to reopen there. An encrypted copy of the salt remains in the backups until they leave their retention window (see the honest boundary). Rows are never deleted. The per-site chain, epoch roots, and on-chain anchors remain verifiable indefinitely.

For a decision reduced this way, the verification report states that the recompute data is withheld because the salt was destroyed.

Honest framing. Agreely helps you document and demonstrate your consent approach. It does not substitute for your organization's accountability under Law 25.