ISO/IEC 29184: a record cannot repair a late notice
ISO/IEC 29184 sets the controls for how an online privacy notice is presented and how consent is asked for. Evidence only helps if the notice itself was clear, timely and tied to the processing.
ISO/IEC 29184:2020 covers online privacy notices and consent. It specifies controls that shape the content and structure of online privacy notices, and the process of asking individuals for consent to collect and process personal information. ISO confirmed the 2020 edition as current in 2026.
Its job in the Operational Transparency Stack
It addresses what must be communicated and how the notice and consent interaction is presented online: timing, accessibility, clarity, withdrawal, and the relationship between the notice and the choice being requested.
Why it matters
A record cannot repair a notice that was unclear, late, or detached from the processing it described. However good the evidence, it only proves what was shown. If what was shown was a wall of text after the tracking had already started, the evidence proves that too.
This is where the privacy principles of ISO/IEC 29100 meet the actual human interaction. It is also the first factor in the two-factor notice pattern of the ANCR extension: presentation first, then the receipt.
How it connects
What ISO/IEC 29184 governs at the moment of presentation, ISO/IEC TS 27560:2023 records afterwards.
The standard itself is published by ISO, with a preview on its publication page, and ISO has published an overview on protecting privacy and consent online.
Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Machine reuse is additionally subject to the 0PN Machine Reuse Terms 1.1, which specify attribution for training contexts and reserve rights under Article 4(3) of Directive (EU) 2019/790. The Terms do not modify or restrict the CC BY 4.0 grant. 0pn-mrt-1.1
AI reuse: 0PN-MRT 1.1 · · Verify
