Access Level Model Explained
|
Applies to: All users This article explains the Access Level consent model used across both interfaces. |
Overview
Cookie Compliance uses a three-level consent model called Access Levels. When a visitor interacts with your consent banner, they choose one of these levels. Each level controls which categories of scripts and trackers are allowed to run.
The Three Access Levels
| Access Level | Visitor Action | What It Allows | Internal Value |
|---|---|---|---|
| Private | Reject / Decline | Basic Operations only — only essential scripts required for the site to function (Category 1) | 1 |
| Balanced | Chooses the middle level (named Balanced unless you renamed it) | Basic Operations + Content Personalization + Site Optimization (Categories 1, 2, 3) — no ad tracking | 2 |
| Personalized | Accept All | All purpose categories enabled, including Ad Personalization (Categories 1, 2, 3, 4) — full tracking and personalization | 3 |
How Access Levels Map to Script Categories
Each tracker on your site is assigned to one of four consent categories:
- Basic Operations — essential for your site to function (always allowed)
- Content Personalization — personalizes content for visitors
- Site Optimization — measures traffic and performance (e.g., analytics)
- Ad Personalization — enables targeted advertising
When a visitor selects an access level, all script categories up to and including that level are permitted. A visitor choosing Balanced (level 2) allows categories 1–3 but blocks category 4 (Ad Personalization).
Two-Choice Mode vs. Three-Choice Mode
You can configure your banner to present either two or three choices to visitors:
Three-Choice Mode (Default)
The banner displays three buttons, one for each access level:
- Private (Reject) — Basic Operations only
- Balanced (Accept) — Essentials + performance, no ads
- Personalized (Accept All) — everything enabled
This mode gives visitors granular control and is recommended for GDPR compliance, as it allows visitors to accept analytics without accepting ad tracking.
Two-Choice Mode
The banner displays two buttons:
- Private (Reject) — Basic Operations only
- Personalized (Accept) — all purposes enabled
The Balanced level is excluded. This is a simpler experience but offers less granularity. In two-choice mode, if the current default consent level is set to Balanced (2), it automatically resets to Private (1).
How to Configure Choice Mode
The number of consent choices is configured in the Hu-manity.co portal:
- Log in at app.hu-manity.co.
- Navigate to Configuration → Behavior.
- Find the Consent Choices setting.
- Select 2 choices (Private + Personalized) or 3 choices (Private + Balanced + Personalized).
- Click Publish Now.
Customizable Labels
The display names for each access level can be customized in the portal. The default labels are “Private,” “Balanced,” and “Personalized,” but you can change them to match your brand voice. For example:
- “Reject All” instead of “Private”
- “Accept Essentials” instead of “Balanced”
- “Accept All” instead of “Personalized”
Custom labels are configured in the portal under Configuration → Content in the consent level text fields.
Default Consent Level
You can set a default consent level that determines the visitor’s access level before they interact with the banner. This is the level applied if the visitor has not yet made a choice. The configurable default is set in the portal under Configuration → Behavior.
How Consent Modes Use Access Levels
Consent Mode integrations (Google Consent Mode v2, Facebook, Microsoft) map each signal to a purpose category, not to an access level. A signal is granted once the visitor allows its category:
- Content Personalization — granted at Balanced or Personalized, or when the visitor allows it under Customize
- Site Optimization — granted at Balanced or Personalized, or when allowed under Customize (a visitor can allow one of these two without the other)
- Ad Personalization — granted at Personalized, or when allowed under Customize
Only Google’s security_storage can also be set to Basic Operations, which grants it for every visitor. The old “Always” option is gone: a signal still stored that way shows Always — not applied (change this) and is denied at every level. The same options apply in two-choice mode.
These signal mappings are configured in the Admin Portal on Configuration → Consent Signals, and in the WordPress admin in the Consent Signals panel (Cookie Consent → Laws, languages & signals → Consent signals, or the Consent signals button on the Overview tab).
Access Levels in the Cookie Consent setting cards
The compliance setting cards on the Cookie Consent tab show which compliance settings are active and which laws they satisfy. Several settings interact with access levels:
- Refuse button — on Banner Only sites, adds a refuse button; on connected sites, visitors refuse by choosing Private. Required by GDPR, UK PECR, LGPD, PIPEDA, and POPIA.
- Update consent — floating widget that lets visitors change their access level after initial selection.
- Accept on scroll / click / close — records consent at the current default Access Level (not automatically Personalized). These are flagged as non-compliant for strict opt-in laws and should stay off under GDPR, UK PECR, LGPD, and POPIA.