ATT statuses and CMP consent strings are useful enums: authorised, denied, not determined, vendor purposes allowed or not. Consent-aware app analytics needs those enums at the wrapper gate. It does not need the underlying identifier stored beside checkout_started.
We still see schemas where idfa, gaid, or a vendor device graph sits on “anonymous” events because a downstream job once asked for it. That copy is a leak. If marketing later needs a hashed identifier under a separate basis, that is a different event class with its own gate — not a silent extra property on the product bus.
Parse once
Read the CMP / ATT interface in one module. Translate to an internal basis record: purpose, timestamp, source (ATT, CMP, in-app notice). Persist that record. Every tracker consults the record, not the vendor SDK. Fan-out to pixels happens only for purposes that the record allows, and only after the wrapper has initialised those pixels.
When the CMP is dark — timeout, crash, first launch offline — the default is deny, not “last known allow.” Last-known-allow across reinstalls is how stale consent becomes a new collection.
In-app browsers
Thai consumer apps often open LINE or other WebViews. Those surfaces may have their own cookies and pixels. Your native basis record does not automatically cover them. Document the WebView as a separate processing context or keep marketing scripts out of it. CMP Bridges spends a week on this fan-out diagram.
What to log
Log the enum and the timestamp, not the advertising identifier. If you must prove a decision to counsel, the basis record is the artefact. Dumping IDFA into analytics “for the audit trail” recreates the identifier you were trying not to process.
This topic sits in week five of Consent Architecture and in the shorter CMP Bridges bench. For the wider definition, see the practice page.