Practise vocabulary for consent management systems: consent signals, consent platforms, consent propagation, and preference centres.
0 / 10 completed
1 / 10
A ___ Platform (CMP) collects, stores, and propagates user consent decisions for cookies and data processing.
A Consent Management Platform (CMP) — examples: OneTrust, Cookiebot, TrustArc — presents consent choices to users, records their decisions, and distributes signals to all systems that need to respect them.
2 / 10
Under GDPR, consent must be ___ — meaning the user must take a positive action such as clicking an opt-in checkbox; pre-ticked boxes are not valid.
GDPR Article 7 requires active (unambiguous) consent. Pre-ticked boxes, opt-out mechanisms, and bundled consent are not valid under GDPR. Each processing purpose needs a separate, freely given opt-in.
3 / 10
___ propagation ensures that when a user withdraws consent in one system, the decision is reflected across all connected data processors and sub-systems.
Consent signal propagation is the technical challenge of distributing a user's consent decision to every system that processes their data. This requires an event-driven architecture or an API-based consent service that all systems query.
4 / 10
A consent ___ centre is a UI where users can review and update their data processing preferences at any time.
A preference centre (or privacy centre) gives users ongoing control over their consent choices. GDPR requires that withdrawal of consent be as easy as giving it — the preference centre implements this right.
5 / 10
'Purpose limitation' in consent means data collected for one stated purpose ___ be used for a different, incompatible purpose.
Purpose limitation (GDPR Article 5) means data collected for one purpose (marketing) must not be used for an incompatible purpose (credit scoring) without new consent. It's a core GDPR principle that constrains secondary use of data.
6 / 10
Alex from the Legal team just commented on your PR: 'Regarding our use of Google Analytics for user behavior tracking – are you leveraging a CMP to explicitly obtain and manage consent? We need to ensure compliance with GDPR.' What is Alex primarily asking about?
Alex is focusing on the core requirement of GDPR – obtaining explicit consent. While data analytics and security are important, the direct question revolves around using a CMP to handle consent requests related to Google Analytics, specifically regarding cookie usage. The incorrect options represent tangential concerns that don't directly address the legal obligation.
7 / 10
You are drafting a PR description for your new feature which includes sending push notifications to users. The notification content mentions 'personalized recommendations'. In relation to Consent Management Language (CML), what is the MOST appropriate phrasing to use?
The correct answer demonstrates a clear statement of consent. It highlights that users have 'opted-in' to receive recommendations – the foundational element of CML. The other options are misleading; they don't reflect the user's active agreement to data processing for personalization. Using phrases like 'targeted advertising' can be problematic without explicit consent.
8 / 10
Sarah (Product Manager) sends you the following Slack message: 'Hey team, just confirming – we're using ConsentLayer to handle cookie consent. It's crucial that every new feature integrates with it seamlessly.' What does Sarah primarily emphasize?
Sarah's message highlights the critical role of integrating with the Consent Management Platform (CMP), specifically ConsentLayer. This demonstrates that the CMP is not just a technical component but an integral part of the development workflow – ensuring compliance and proper consent management across all features. The other options represent broader product considerations, rather than the direct integration requirement.
9 / 10
You receive the following API response from a Consent Management System (CMS): {
status: 'success'
consent_data: {'cookies': true, 'analytics': false}}
What does this response primarily indicate?
This response indicates a specific level of consent. The key element is that `consent_data['cookies']` is set to 'true', meaning the user has given permission for cookies. 'analytics' being false means they have not consented to data tracking. This demonstrates how CMS responses provide granular information about user preferences.
10 / 10
During a standup meeting, your team lead asks: 'Has anyone updated the consent flow for the new e-commerce checkout process?' What aspect of Consent Management Language (CML) is this question most directly addressing?
This question specifically focuses on *legal compliance*. The core purpose of CML is to ensure that all data processing activities – in this case, collecting user consent during a checkout process – adhere to regulations like GDPR and CCPA. While performance and design are important considerations, they are secondary to the fundamental requirement of obtaining valid consent.
What will I practice in "Consent Management Language"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.