---
id: dsr-consent-and-cookie-banner
prd: docs/work/prds/dsr-consent-and-cookie-banner.prd.md
title: DSR + consent abstraction + cookie consent banner — Epic B of ADR-025
type: epic
status: in-progress
features:
  [
    core-shared,
    core-consent,
    core-dsr,
    core-ui,
    core-eslint,
    core-testing,
    core-api,
    auth,
  ]
created: 2026-05-19T12:00:00Z
updated: 2026-05-19T20:39:14.972Z
---

## Goal

Ship the user-rights surface end-to-end: DSR endpoints that walk Epic A's PII tags to export/delete/rectify/restrict any subject's data, per-use-case consent gates with audit-logged proof, and a compliant cookie consent banner with EU-prominence defaults.

## Why

Epic A delivered declarative PII inventory + retention + sub-processors. Epic B closes the remaining gaps: GDPR Arts. 15–18 + 20 DSR endpoints, Art. 7 demonstrable consent with structural lint enforcement, and a CNIL-compliant cookie consent banner that downstream consumers can drop in without forking legal-compliance logic.

## Stories

- [x] [01 — Subject-linkage types in core-shared](01-subject-linkage-types/_story.md)
- [x] [02 — Audit action enum amendment (ADR-018)](02-audit-enum-amendment/_story.md)
- [x] [03 — core-consent foundation: types + brand + withConsent + conformance + ESLint rule](03-core-consent-foundation/_story.md)
- [x] [04 — core-consent implementation: Payload impl + DI + migration helpers + tRPC router](04-core-consent-implementation/_story.md)
- [x] [05 — core-consent React subpath: ConsentProvider + useConsent()](05-core-consent-react/_story.md)
- [x] [06 — core-dsr: scaffold + interfaces + Payload impls + handlers + dsrRouter](06-core-dsr/_story.md)
- [ ] [07 — core-api router composition: dsrRouter + consentRouter into appRouter](07-core-api-router-composition/_story.md)
- [ ] [08 — core-ui scaffold](08-core-ui-scaffold/_story.md)
- [ ] [09 — CookieConsentBanner component in core-ui](09-cookie-consent-banner/_story.md)
- [ ] [10 — auth signUp anonymous consent migration](10-auth-signup-migration/_story.md)
- [ ] [11 — Documentation: DSR guide + consent guide + glossary + CLAUDE.md](11-documentation/_story.md)