Policystack Jurisdiction

policystack-jurisdiction

Explain what a declared jurisdictions set implies. Posture and policy-text tier are read straight from the single canonical table (the same row the policy renderer and the consent runtime read, so prose and banner always agree). Membership is frozen at 1.0.

The canonical table

• br — opt-in, equivalent policy text
• ca — opt-in, equivalent policy text
• ch — opt-in, equivalent policy text
• eea — opt-in, specific policy text
• row — opt-in, equivalent policy text
• uk — opt-in, specific policy text
• us — opt-out, equivalent policy text
• us-ca — opt-out, specific policy text, inherits us, GPC legally binding
• us-co — opt-out, equivalent policy text, inherits us, GPC legally binding
• us-ct — opt-out, equivalent policy text, inherits us, GPC legally binding
• us-va — opt-out, equivalent policy text, inherits us, GPC legally binding

How to read it

• consentModel — opt-in (EEA/UK/CH/BR/CA/ROW): no non-essential data/cookies until affirmative consent; the banner defaults off. opt-out (US and US states): lawful by default after notice; the banner defaults on, gated by Do-Not-Sell / GPC.
• policyText — specific (eea, uk, us-ca): hand-authored, jurisdiction-specific prose. equivalent: posture-correct text via the parent jurisdiction — a legitimate, shippable tier that emits the jurisdiction-generic-policy-text warning so the gap is explicit, not silent. Treat that warning as acknowledged, not failed.
• inherits — US state codes inherit text/posture from us. Any us-<state> not in the table resolves to us (opt-out); row is the conservative opt-in catch-all. A code that is neither a table entry nor a us-* tail is rejected as jurisdiction-unknown.
• GPC legally binding — true only where the Global Privacy Control signal carries legal force (the §4.2 US-state set). It is always honoured as a signal regardless.

Procedure

For each declared id: state its consent model, its policy-text tier (and the parent it borrows from when equivalent), and whether GPC is binding. Call out every equivalent id as a jurisdiction-generic-policy-text warning the user must accept. The effective posture across a multi-jurisdiction set is the most protective (any opt-in member ⇒ treat as opt-in).

Source: jamiedavenport/policystack — distributed by TomeVault.