Best Practices for Configuring and Managing Consents in cidaas

Introduction

Consents are a central component of modern identity and access management systems. They enable the targeted collection and management of user approvals while complying with legal requirements such as the GDPR. cidaas provides powerful features for configuring and managing consents. In cidaas, the data structure of consents follows a hierarchical model: there are consent groups, beneath which are the actual consents, and further below are the respective versions. For example, a group could be Terms & Services, while the related consents could include individual touchpoints' Terms of Service or country-specific Terms of Service. This guide describes how to efficiently create, configure, and integrate consents into user registration and user profiles.

Setting Up Consents in cidaas

1. Grouping Consents: Group related consents (e.g., marketing or privacy-related consents) to improve the user experience.
2. Clarity in Consent Definitions:Define clear and understandable descriptions for each consent so that users know what they are agreeing to. Examples include: newsletter subscription, data sharing for analytical purposes, or personalized advertising.
3. Unique Identifiers: Use unique identifiers for each consent (e.g., "newsletter_consent" or "analytics_opt_in") to simplify management.
4. Versioning: Leverage the versioning feature in cidaas to differentiate between the acceptance of historical and current versions of consent terms.

Mapping Consents through Registration Fields

Integration into Registration Fields

After creating consents, they should be mapped through registration fields. This allows for seamless integration into an application's registration process:

1. Consent as a Registration Field:
   • Add the consent as a new field in the cidaas registration configuration.
   • Configure in the app settings whether the field is optional or required, depending on legal or business requirements.
2. Dynamic Display:
   • Implement mechanisms to dynamically display consent fields in your user interface based on regional legal requirements or user roles.

Optimizing the User Experience

1. Display easy-to-understand texts and links to the relevant consent terms (e.g., privacy policies) during the registration process.
2. Ensure users have a clear option to make their choices before completing the registration.

Managing Consents in the Central User Profile

Consent Management in the User Profile

cidaas allows managing consents through the central user profile, providing users with the flexibility to change their approvals at any time:

1. Updating Consent Status:
   • Users can change their approval or rejection through the standard user update call.
   • This should be easily accessible in the user interface, such as via a Consent Management section in the profile.
2. Transparent Overview:
   • Display an overview of all active consents to the user, including the date and version
   • Provide clear options for acceptance or withdrawal.
3. Automatic Updates:
   • Synchronize consent status data with cidaas to ensure that all changes are updated in real time.

History and Traceability

1. cidaas stores consent changes with a timestamp to maintain a legally compliant history.
2. Provide this data to users upon request, e.g., through an export.

Practical Tips and Recommendations

1. Considering Legal Requirements
   • Align the consent texts with your legal department to ensure compliance with local laws (e.g., GDPR or CCPA).
   • Update consent terms promptly when legal regulations change.
2. Ensuring User-Friendliness
   • Keep the user interface for consent management intuitive and simple.
   • Inform users about changes to consents and provide clear instructions for re-approval.

Conclusion

The efficient configuration and management of consents in cidaas are essential for delivering a positive user experience and complying with legal requirements. By integrating consents into registration fields and managing them in the user profile, you can ensure maximum flexibility and transparency. Leverage the outlined best practices to optimally integrate consents into your applications while meeting both user needs and legal obligations.