Consent and bot detection: where the lines are

This is a product-design explainer, not legal advice. Consent requirements depend on your jurisdiction and use case; review them with counsel.

Bot detection and tracking get conflated, and the confusion is understandable: both look at a session and draw conclusions. But they are different activities with different data, and the difference is what lets a detection layer sit alongside a privacy programme instead of fighting it.

Detection versus tracking

Tracking follows a person across sites and builds a profile over time. Detection asks a narrower question about a single session: does this look like a human, an agent, or a bot? You can answer that with on-site signals, and avoid the identifiers that make tracking tracking.

Design choices that keep the boundary

• On-site only. Signals come from the pages where collection is enabled — not from other sites.
• No cross-site identifiers. Nothing designed to recognise a visitor between unrelated sites.
• Hashed IP addresses in product records, rather than raw addresses.
• Short retention. Raw scores purged after 30 days; longer-lived data is aggregate.
• Fingerprint signals off by default, turned on only as an explicit workspace choice.
• Operator-enabled collection. Nothing is collected from a page until the integrating site deploys the collector there.

What the integrating site still has to do

Detection is one processing activity among several on your site, and you remain the controller of your visitors' data. That means informing visitors about what is collected, and obtaining consent where law or policy requires it, before capture. Detection being on-site and minimal lowers the weight; it does not remove those obligations.

The test to apply

A useful question for any detection tool: could you describe what it collects, why, and for how long, in a sentence a visitor would understand? If the answer is a tangle of third-party identifiers, the design is doing more than detection needs. If it is "timing and integrity signals on our own pages, hashed, for 30 days", you are somewhere you can put in writing.