Hi Swift community,
First time sharing this publicly after months of building.
The problem I was trying to solve: in any iOS app with
multiple SDKs, when a user revokes GDPR consent there's
no standard runtime mechanism to:
- Propagate the change atomically to all SDKs
- Collect proof that each SDK actually applied it
- Generate an audit trail suitable for regulatory review
Each SDK has a completely different consent API —
Firebase's Analytics.setConsent(), Meta's
Settings.setDataProcessingOptions(), AppsFlyer's
anonymizeUser() — with different threading models
and silent failure modes.
ConsentBus is my attempt to solve this:
Architecture:
- Swift global actor as the consent broker (serial
execution, no race conditions) - Normalized ConsentAdapter protocol that any SDK
can implement - HMAC-SHA256 hash-chained audit ledger where each
entry incorporates per-SDK propagation receipts - ComplianceAttestationReport — exportable JSON with
coverage score and chain proof
Three-way outcome classification: APPLIED / FAILED /
NOT_SUPPORTED — the last one is excluded from the
coverage score denominator, which I think is an
important semantic distinction.
Links:
- GitHub: GitHub - divyaravitech/ConsentBus: Atomic, cryptographically verifiable consent propagation across heterogeneous mobile SDKs · GitHub
- Paper: doi.org/10.2139/ssrn.7087439
- Patent pending: US 64/087,949
Run the demo: swift run ConsentBusDemo
Looking specifically for Swift concurrency feedback
on the global actor approach — and contributors
willing to wire up real SDK adapters for Meta,
AppsFlyer, or Mixpanel (stubs exist, just need the
real API calls).
Happy to answer any questions about the design.