Agreely
FR EN

Verify a proof

The /verify page

The bilingual public page https://cdn.agreely.ca/verify lets anyone - a visitor, an auditor, a regulator - verify a cookie consent decision proof without needing an Agreely account.

Enter a consent identifier (consentId) to get:

  • The recorded decision (categories granted or refused, timestamp, language).
  • The configuration version and hash of the banner that was displayed.
  • The Merkle inclusion path in the corresponding chain epoch.
  • The epoch root and the on-chain anchoring transaction on the Base chain (block number, transaction hash, Basescan link).

The equivalent public API: GET https://cdn.agreely.ca/e/v1/proof/{consentId}

The consentId

The consentId is a server-minted opaque identifier echoed in the visitor's browser agreely_consent cookie after their decision. It uniquely identifies a consent submission. It is never derived from visitor attributes.

A visitor can find their consentId by inspecting the agreely_consent cookie value on the relevant website.

What the on-chain anchoring proves

The anchoring on the Base chain (via the CookieConsentRootAnchored event) is tamper evidence: it proves that the decision was recorded and has not been altered since. More precisely:

  • The decision (categories granted/refused, timestamp, configuration version) was included in a per-site hash chain block.
  • That block was folded into a per-site epoch Merkle root.
  • That Merkle root was anchored in a Base chain transaction (Ethereum L2), verifiable by anyone with a node or a public explorer.
  • The Merkle inclusion path lets you recompute the root and confirm membership without trusting Agreely.

What the anchoring does not prove:

  • It does not prove that the banner displayed to the visitor was Law 25 compliant.
  • It does not prove that all cookies emitted by your site were handled according to the decision.
  • It does not prove the legal validity of consent for your own purposes (that is the responsible party's accountability).
  • It is not a compliance certificate. The precise claim is: "proof that this decision was recorded and has not been altered", never "proof of compliance".
  • It is not "operator-proof": Agreely could theoretically have recorded a decision different from the one presented to the visitor. The anchoring proves non-alteration since recording, not the fidelity of the initial capture. This is why independent verification by the visitor (via their own consentId) is the complementary trust layer.

Retention and coarsening

After the configurable retention window (36 months by default, set by your organization as the responsible party), the readable columns of the decision (categories, language) are nulled and the cryptographic salt is destroyed, making the commitment a one-way orphan. Rows are never deleted. The per-site chain, epoch roots, and on-chain anchors remain verifiable indefinitely.

The verification report clearly indicates whether a row has been coarsened.

Honest framing. Agreely helps you document and demonstrate your consent approach. It does not substitute for your organization's accountability under Law 25.