The popup, the policy, and the receipt live with the pixel. A later identification is allowed only while the latest receipt is an acceptance of the current policy.
append-only ledger
The policy is generated from the controller, the purposes, and the named parties.
Accept, customize, cancel, or withdraw. A policy change reopens the bar.
Each choice is signed. The log can filter it and check the signature.