# ConsentTheater

> Plain-language reference handbook on GDPR, ePrivacy and the UK PECR — written for developers, DPOs and engineers who need to get cookie consent and tracking right. Topic-organised, current-state, no marketing.

For one-shot ingestion of every handbook entry and law article in a single document, fetch [https://consenttheater.org/llms-full.txt](https://consenttheater.org/llms-full.txt).

## Project pages

- [About](https://consenttheater.org/about.md): What ConsentTheater is, what it is not, and how the project is run.
- [Methodology](https://consenttheater.org/methodology.md): How trackers are classified by category and consent burden under GDPR.
- [Privacy policy](https://consenttheater.org/privacy.md): How the site itself handles visitor data. Short version: no analytics, no cookies, no trackers.
- [License](https://consenttheater.org/license.md): AGPL-3.0-or-later licensing terms for the project.
- [Acknowledgements](https://consenttheater.org/acknowledgements.md): Open-source projects ConsentTheater is built on, with licenses and links.
- [Browser extension](https://consenttheater.org/extension.md): Free Chrome/Firefox extension for live pre-consent tracker auditing.
- [UK GDPR & PECR mapping](https://consenttheater.org/law/uk-gdpr-and-pecr.md): How UK GDPR and PECR map onto the EU GDPR and ePrivacy Directive articles, regulated by the ICO.

## Consent & banners

- [Global Privacy Control — what it is and how to turn it on](https://consenttheater.org/handbook/global-privacy-control.md): GPC is a browser-level signal that automatically tells every website "do not sell or share my data". A plain-language guide to what it does, where it is legally binding, and step-by-step instructions to enable it on every major browser — desktop and mobile.

## Tracking & cookies

- [Strict-necessary cookies — what actually qualifies](https://consenttheater.org/handbook/strict-necessary-cookies.md): The "strictly necessary" exemption is the most-misused phrase in cookie compliance. This article walks through the legal text, the EDPB's interpretation, and concrete examples of what does and does not qualify — including the popular myths.
- [Tracking pixels — what they are and what consent rules apply](https://consenttheater.org/handbook/tracking-pixels.md): "We don't use cookies, just pixels" is one of the most common compliance myths. This article walks through what a pixel actually is technically, why it's still in scope of EU consent rules, and how the picture shifts under UK and California law.

## Privacy tools

- [DNS sinkholes — taking your privacy back at the network level](https://consenttheater.org/handbook/dns-sinkholes.md): Browser-level defences only protect the browser. A DNS sinkhole blocks trackers across every device on your network — phones, TVs, IoT junk, and apps that ignore your ad blocker. This article explains how DNS blocking works, what it cannot fix, and walks through the practical options (NextDNS, ControlD, Pi-hole, AdGuard Home).
- [Privacy-friendly browsers — what is built in and where extensions help](https://consenttheater.org/handbook/privacy-friendly-browsers.md): Some browsers ship with anti-tracking, fingerprint resistance, and Global Privacy Control already on. Others give you a clean slate that you have to harden yourself. An honest look at the spectrum, where each major browser sits, and what extensions still add value on top.

## Law references

- [GDPR Article 5 — Principles relating to processing of personal data](https://consenttheater.org/law/gdpr/art-5.md): The six core principles every controller must satisfy: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and integrity. Plus the accountability rule.
- [GDPR Article 6 — Lawfulness of processing](https://consenttheater.org/law/gdpr/art-6.md): The six legal bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests.
- [GDPR Article 7 — Conditions for consent](https://consenttheater.org/law/gdpr/art-7.md): What it means to "have consent" under the GDPR — burden of proof, plain language, the right to withdraw, and freely-given conditions.
- [GDPR Article 17 — Right to erasure ("right to be forgotten")](https://consenttheater.org/law/gdpr/art-17.md): When a data subject can require erasure, what exceptions apply (free expression, public interest, legal claims, archiving for research), and how it interacts with public publication.
- [GDPR Article 89 — Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://consenttheater.org/law/gdpr/art-89.md): The research-and-archiving carve-out that lets datasets like ours preserve historical observations under appropriate safeguards, even when other rights would otherwise apply.
- [ePrivacy Directive Article 5 — Confidentiality of the communications](https://consenttheater.org/law/eprivacy/art-5.md): The "cookie article" — the rule that storing or accessing information on a user's terminal device requires prior informed consent, with a narrow strictly-necessary exemption.