Services, consent categories and legal bases

A service is any third party your site loads — Google Analytics, Meta Pixel, Intercom, YouTube. The Services tab of the Builder decides what the banner blocks, what it declares, and under which legal basis. Every service comes from a maintained catalog, so its cookies, detection patterns and Google Consent Mode signals follow along automatically.

Consent categories

Each service belongs to one of four categories, which are what the visitor accepts or refuses granularly:

• Essential — needed for the site to work; no consent required.
• Analytics — audience measurement.
• Marketing — advertising and retargeting.
• Preferences — remembering visitor choices.

Adding services

Three paths, all ending in the same configuration:

• The catalog — the Add services modal lists every available service with search and category filters; popular services are flagged. Toggle a card to activate it.
• Automatic detection — scan a URL, or paste your page's HTML, and FlowConsent maps what it finds to catalog services.
• The initial scan — when a banner is created from your site URL, detected services are pre-filled.

Once active, a service exposes its configuration: paste the complete script for services you inject, or — for iframes like YouTube — add the data-service="…" attribute to the embed so the banner can gate it. Services that arrive from an external channel (like a tag manager) have an auto-detection toggle with the URL patterns the banner watches for.

Canonical IDs: aliases are merged

The catalog historically accumulated duplicates — google-analytics-4 alongside google-analytics, linkedin-insight-tag alongside linkedin-insight. These duplicates were dangerous because they were silent: the alias entry carried no cookies, so a banner using it displayed an empty cookie list for GA even though listing them is mandatory.

Aliases now carry a canonical ID and every write path resolves them: activating google-analytics-4 records google-analytics, with its real cookies and Consent Mode signals. Existing banners that used an alias keep working — the resolution redirects them.

Legal bases

Consent is the default, but not everything rests on consent. Each catalog service carries a legal basis, and the Builder shows a badge only when it differs from consent — the exception deserves attention, not the rule:

• Consent — the general case; no badge.
• Legitimate interest — e.g. Sentry: error tracking serves the security and stability of the service. No consent required, but the service must appear in your privacy policy with a right to object, and the interest belongs in your record of processing activities.
• Contract — services necessary to deliver what the visitor asked for; typically the essential category.
• CNIL exemption possible — audience measurement that can run without consent under strict conditions, below.

The CNIL exemption checklist

French supervisory authority CNIL exempts audience measurement from consent (deliberation 2020-091) only if every condition is met. For services flagged CNIL exemption possible, the Builder displays the checklist:

1. Purpose strictly limited to audience measurement, on behalf of the publisher exclusively.
2. No cross-referencing with other processing, and no cross-site tracking.
3. No transfer of the data to third parties.
4. IP address anonymized before any processing.
5. Tracker lifetime ≤ 13 months, data retained ≤ 25 months.

Services the banner cannot block

Some processing is triggered from your server — GA4 Measurement Protocol, CRM sync, attribution cookies set by your backend. A banner running in the browser can't block any of it; it can only provide the decision. Cover that path with the server SDK.

Next steps

• Check the resulting cookie declaration
• Prove the blocking works with a refusal scan