Designing an event taxonomy that survives a consent reset

A consent reset is not a pause. It is a new session that is not allowed to remember the last one. If your taxonomy treats user_id, email_hash, or a durable device token as “optional enrichment,” those fields tend to sneak back in the next release because a chart looked empty.

Freeze the verbs, version the properties

We ask teams to freeze object–action names. checkout_started stays checkout_started when consent flips. What changes is the property bag. Consented events may carry account_id after sign-in. Declined events may carry surface, build, locale, and a coarse duration bucket. They may not carry anything that would stitch to yesterday.

Version the property bag in the schema file, not in Slack. When a property is retired, leave it in the document as retired, with the date and the reason. Engineers otherwise re-add it “temporarily” during a fire.

What should never return

Anything derived from a phone number, national ID, advertising identifier, or precise GPS belongs on a never-return list after decline. Approximate city is a product decision; we usually refuse it for guest declined sessions because Bangkok districts plus timestamps re-identify too easily in small apps.

Crash payloads are a frequent leak. A kit that attaches the last search query to a crash after decline is still a measurement event. Treat it as one in critique.

Empty charts are a teaching tool

When declined funnels look thin, product often asks to “just bring back the id for internal use.” That sentence is how taxonomies rot. The thinner chart is the honest one. Annotate it. Do not refill it with memory.

Event Schema Craft spends three weeks on naming. Consent-Aware Funnels spends four on the split. If you only have time for one, start with the split if you already have too many verbs. Start with naming if your warehouse is a synonym swamp. The flagship studio does both, in that order, on purpose.