# Services, consent categories and legal bases

How the FlowConsent service catalog works: categories, detection, canonical IDs, legal bases and the CNIL audience-measurement exemption checklist.

> Canonical: https://www.flowconsent.com/en/doc/services-and-legal-basis
> Last updated: 2026-07-30
A service is any third party your site loads — Google Analytics, Meta Pixel, Intercom, YouTube. The **Services** tab of the Builder decides what the banner blocks, what it declares, and under which legal basis. Every service comes from a maintained catalog, so its cookies, detection patterns and Google Consent Mode signals follow along automatically.

## Consent categories

Each service belongs to one of four categories, which are what the visitor accepts or refuses granularly:

- **Essential** — needed for the site to work; no consent required.
- **Analytics** — audience measurement.
- **Marketing** — advertising and retargeting.
- **Preferences** — remembering visitor choices.

## Adding services

Three paths, all ending in the same configuration:

- **The catalog** — the *Add services* modal lists every available service with search and category filters; popular services are flagged. Toggle a card to activate it.
- **Automatic detection** — scan a URL, or paste your page's HTML, and FlowConsent maps what it finds to catalog services.
- **The initial scan** — when a banner is created from your site URL, detected services are pre-filled.

Once active, a service exposes its configuration: paste the complete script for services you inject, or — for iframes like YouTube — add the `data-service="…"` attribute to the embed so the banner can gate it. Services that arrive from an external channel (like a tag manager) have an **auto-detection** toggle with the URL patterns the banner watches for.

## Canonical IDs: aliases are merged

The catalog historically accumulated duplicates — `google-analytics-4` alongside `google-analytics`, `linkedin-insight-tag` alongside `linkedin-insight`. These duplicates were dangerous because they were **silent**: the alias entry carried no cookies, so a banner using it displayed an empty cookie list for GA even though listing them is mandatory.

Aliases now carry a **canonical ID** and every write path resolves them: activating `google-analytics-4` records `google-analytics`, with its real cookies and Consent Mode signals. Existing banners that used an alias keep working — the resolution redirects them.

## Legal bases

Consent is the default, but not everything rests on consent. Each catalog service carries a **legal basis**, and the Builder shows a badge only when it differs from consent — the exception deserves attention, not the rule:

- **Consent** — the general case; no badge.
- **Legitimate interest** — e.g. Sentry: error tracking serves the security and stability of the service. No consent required, but the service must appear in your privacy policy **with a right to object**, and the interest belongs in your record of processing activities.
- **Contract** — services necessary to deliver what the visitor asked for; typically the essential category.
- **CNIL exemption possible** — audience measurement that can run without consent under strict conditions, below.

> [!NOTE]
> The legal basis comes from the catalog and describes the *plausible* basis for the service's standard use. Assessing whether it holds for **your** use remains your responsibility as the site publisher.

## The CNIL exemption checklist

French supervisory authority CNIL exempts audience measurement from consent (deliberation 2020-091) **only if every condition is met**. For services flagged *CNIL exemption possible*, the Builder displays the checklist:

1. Purpose strictly limited to audience measurement, on behalf of the publisher exclusively.
2. No cross-referencing with other processing, and no cross-site tracking.
3. No transfer of the data to third parties.
4. IP address anonymized before any processing.
5. Tracker lifetime ≤ 13 months, data retained ≤ 25 months.

> [!IMPORTANT]
> The checklist is informative: the banner cannot verify your analytics configuration for you (e.g. Matomo running in its exempt mode). If any condition fails, the service remains subject to consent — leave it in its current category.

## Services the banner cannot block

Some processing is triggered from your **server** — GA4 Measurement Protocol, CRM sync, attribution cookies set by your backend. A banner running in the browser can't block any of it; it can only provide the decision. Cover that path with the [server SDK](/en/doc/server-sdk).

## Next steps

- [Check the resulting cookie declaration](/en/doc/cookie-declaration)
- [Prove the blocking works with a refusal scan](/en/doc/compliance-verification)