Consent for children, biometrics and pseudonyms
An ordinary consent record assumes one named adult and ordinary data. Essence has separate records for young people, confidential reports and biometrics, each built by leaving out what would cause harm.
A standard consent record makes three quiet assumptions. The person consenting is an adult who controls their own account. Their name belongs on the record. And the data involved is ordinary.
The most sensitive situations break at least one of them. A young person may need a record kept from the adults who normally oversee their vault. Someone reporting wrongdoing may need to stay unnamed. Biometric data, such as a face compared with a passport photo, is special-category data under Article 9 of the GDPR and calls for explicit consent.
In our October release, Essence added a separate consent record for each of these cases. Each starts from the harm it has to avoid and leaves out whatever would cause it.
A young person's confidential record
Essence supports supervised vaults, where a guardian holds a standing proxy over a young person's vault. Say a 15-year-old receives treatment and wants that record kept from the adults on their vault. The new record lets the young person consent to it being withheld from every guardian with a standing proxy.
Three details carry the weight:
- The list of excluded guardians never comes from the request. It comes from the vault service, which has already withheld the record from everyone on the roster. A caller who could write the list could leave someone off it.
- Notifications are always suppressed. This is fixed, not a setting. Telling a guardian that "a consent was granted", even with no detail, would tell them a record exists. The event the system emits carries no guardian and no category, so there is nobody to notify and nothing to say.
- The record itself never passes through the consent service. It is written under the young person's own keys. The consent service holds references, a category code, who acted and when.
The software records the young person's decision faithfully. Whether a particular young person can give that consent remains a legal and clinical judgement for the people treating them.
A report without a name
An organisation that receives a whistleblowing report has to let an investigator read the case, and must never record who made it. An ordinary consent names the person who granted it, which is the one thing that must not be stored here.
The pseudonymous grant replaces the person with an opaque pseudonym and holds no user identifier at all, so there is nothing to join back to a person. A "pseudonym" shaped like a platform user identifier is refused, so nobody can slip one in.
It is also honest about whose decision it records. The reporter is not consenting to an investigator reading the case. The organisation provides that access under its duty to investigate, and the record states that basis rather than borrowing the language of consent. Three more rules apply:
- It must end. Every grant has an expiry no more than 366 days away, and an expired grant reads as expired without any clean-up job having to run.
- The investigator is named. It is the reporter who is pseudonymous. The investigator is the person an organisation must be able to audit.
- Revocation reasons are codes, not free text. A free-text box on a confidential case is a place where a reporter's identity can leak.
Biometric consent that holds no biometrics
The third record is for explicit consent to biometric processing, such as matching a selfie against the photo on an identity document. Under Article 9, that consent has to exist, and be provable, before any such processing takes place.
The record is tied to a single proofing session, because consent to one attempt is not consent to the next. It holds who consented, the session, the purpose and the four facts of the notice they saw: the processor, the retention statement, the notice version and the lawful basis.
What it leaves out matters as much. It stores no image, no biometric template and no match score. A consent record is evidence that a person agreed, and it has no reason to hold the most sensitive data the agreement is about. Kept that way, it can be retained as evidence for as long as needed without becoming a store of biometric data.
What this means for your organisation
For public bodies and organisations that work with young people, confidential reports or identity checks, these are consent records built for the hard cases rather than an ordinary form stretched to fit them. If those cases are part of your service, we would be glad to show you how the records would fit it.
Published 3 November 2026