# ConsentBus — Atomic cross-SDK consent propagation with cryptographic audit \[Swift Package, patent pending\]

**URL:** <https://forums.swift.org/t/consentbus-atomic-cross-sdk-consent-propagation-with-cryptographic-audit-swift-package-patent-pending/88635>\
**Category:** Related Projects\
**Tags:** cryptography\
**Created:** [July 29, 2026, 7:27pm UTC](https://forums.swift.org/t/consentbus-atomic-cross-sdk-consent-propagation-with-cryptographic-audit-swift-package-patent-pending/88635 "2026-07-29T19:27:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![divyaravitech](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/divyaravitech/32/45524_2.png) [@divyaravitech](https://forums.swift.org/u/divyaravitech)\
**Post date:** [July 29, 2026, 7:27pm UTC](https://forums.swift.org/t/consentbus-atomic-cross-sdk-consent-propagation-with-cryptographic-audit-swift-package-patent-pending/88635/1 "2026-07-29T19:27:37Z")

</div>

Hi Swift community,

First time sharing this publicly after months of building.

The problem I was trying to solve: in any iOS app with  
multiple SDKs, when a user revokes GDPR consent there's  
no standard runtime mechanism to:

1. Propagate the change atomically to all SDKs
2. Collect proof that each SDK actually applied it
3. Generate an audit trail suitable for regulatory review

Each SDK has a completely different consent API —  
Firebase's Analytics.setConsent(), Meta's  
Settings.setDataProcessingOptions(), AppsFlyer's  
anonymizeUser() — with different threading models  
and silent failure modes.

ConsentBus is my attempt to solve this:

Architecture:

- Swift global actor as the consent broker (serial  
execution, no race conditions)
- Normalized ConsentAdapter protocol that any SDK  
can implement
- HMAC-SHA256 hash-chained audit ledger where each  
entry incorporates per-SDK propagation receipts
- ComplianceAttestationReport — exportable JSON with  
coverage score and chain proof

Three-way outcome classification: APPLIED / FAILED /  
NOT\_SUPPORTED — the last one is excluded from the  
coverage score denominator, which I think is an  
important semantic distinction.

Links:

- GitHub: [GitHub - divyaravitech/ConsentBus: Atomic, cryptographically verifiable consent propagation across heterogeneous mobile SDKs · GitHub](http://github.com/divyaravitech/ConsentBus)
- Paper: [doi.org/10.2139/ssrn.7087439](http://doi.org/10.2139/ssrn.7087439)
- Patent pending: US 64/087,949

Run the demo: swift run ConsentBusDemo

Looking specifically for Swift concurrency feedback  
on the global actor approach — and contributors  
willing to wire up real SDK adapters for Meta,  
AppsFlyer, or Mixpanel (stubs exist, just need the  
real API calls).

Happy to answer any questions about the design.