Prove it is actually gone.
Most vendors will honour an erasure request. Almost none can tell you what happened to the copy in the profile store, the search index and the caches. SegmentHub owns every store it writes to, so an erasure reaches all of them in one pass and comes back with a signed receipt naming each one.
Deletion receipt
Signature verified
Consent per purpose
Analytics, advertising, personalization, email, SMS and push are decided separately, recorded with evidence, and enforced independently. Not one cookie banner checkbox standing in for six different lawful bases.
Access on request
One API call returns everything held about a data subject — the visitor record, the linked customer profile, every consent decision with its evidence, and their position on the suppression list.
Erasure with a receipt
Queued, audited, and fanned out across every store in the platform. The artefact that matters is not the API response — it is the signed receipt saying which stores were reached and when.
Consent decides what is collected, not just what is sent
A consent record that only gates the newsletter is a record that arrives too late. Enforcement can start at the moment an event is received.
Off
The default for every account. Nothing about your ingestion changes, and consent is recorded and reportable without gating anything until you decide otherwise.
Pseudonymise
The event still counts, but identifiers are stripped and the visitor id is replaced with a value that rotates daily. The day's events stay joinable to each other, and to nobody.
Drop
The event is discarded before it reaches any store. The tracking tag still receives a success response, because a tag told to retry would spend the day re-sending an event it is not allowed to send.
Evidence, not a boolean
Each decision is stored with its source, timestamp, the wording that was shown, the notice version and the originating address — kept in a durable ledger that outlives the behavioural profile it describes. "Never asked" is a distinct state from "said no", because treating them alike is how a platform ends up processing data nobody consented to.
Biased towards not processing
A newer decision wins, an older one never overwrites a newer one, and a withdrawal is never lifted by a grant arriving from a bulk import or an inference. Only a deliberate act — a consent management platform, an SDK call, a TCF string or a panel action — can re-grant.
Where an erasure actually reaches
A subject is a person, not a row. Erasing a visitor also erases the customer profile it is linked to, and erasing a profile reaches every visitor record pointing at it — because leaving half behind leaves somebody identifiable and re-linkable.
Deleted
- • Every visitor- and profile-shaped record across all profile-store shards
- • Saved cart state and recent-activity membership
- • Both search indices, refreshed immediately so the panel stops returning the subject
- • The shared caches that hold "seen since the last cycle"
- • The consent ledger rows for that subject
Deliberately kept
- • The suppression entry, anonymised. Deleting it would silently re-enable messaging that person the moment they were seen again — the opposite of what they asked for.
- • The audit trail. Append-only, and the evidence of what the platform did, including this erasure.
- • Your own event archive. It is your bucket under your retention policy, and the privacy report says so rather than implying otherwise.
A partial erasure is reported, never retried quietly. A failure is terminal and surfaces with its reason, because an erasure that half-succeeded and re-ran forever is worse than one an operator was told about. Before each record goes, every purpose on it is written to denied — so a subject who is seen again starts from no permission rather than from whatever a stale integration last asserted.
The privacy report is the answer to the questionnaire
Every store named alongside what happens to it on erasure, so the security reviewer reads it instead of interviewing you.
The consent position for the account: how many subjects granted, denied or were never asked, per purpose.
Every receipt, re-verified on load. The report checks each signature rather than trusting a stored flag — a green tick that was never checked is worse than no tick at all.
A declared data region per account for the residency conversation, alongside the single-tenant and on-premise deployment options already on the security page.
IAB TCF v2.2 strings are read directly, so a consent management platform already on your site can drive all of this without a second integration.
Consent by purpose
Consent is mirrored onto the profile as an ordinary attribute, so an audience can target "consented to advertising" through the normal rule builder. The gates themselves always read the record, never the mirror. Illustrative interface values.
Turn the compliance conversation into a sales asset.
Consent, access and erasure are built into the same platform that runs your profiles and activations — which is exactly why it can prove what happened.
Walk through the privacy report