Hi @kyle_rosenlof
I can confirm this is happening and I fully agree that this behavior clearly mentioned in the documentation.
My assumption is that this is happening by design, connecting the consent payload to your specific ECID, since we are talking about Web SDK, and with every new / private window you will have to reconsent anyway.
This will give you a potentially different set of consent, and your website is rather handling analytics and marketing pixel consent, but not marketing channel consent like emails, push or SMS.
I think the channel-specific consent would rather have to be an onboarded from the CRM as dataset that may contain additional channels a cookie consent banner might not know about.
-------------------------------------------------------------
[UPDATE] @kyle_rosenlof this is what I got back from Adobe. This should hopefully answer your question.
1. Why is the consent sent via Web SDK showing as idSpecific (ECID-bound) rather than channel-level?
This behavior is expected. When consent is sent from a browser via the Web SDK, it is tied to the ECID generated for that session/device. This means the consent is scoped to that specific browser instance (i.e., “idSpecific”) because the Web SDK works within the identity context available at the time — which is typically just the ECID unless other declared identities (e.g., email, CRM ID) are passed and resolved.
2. Does channel-level consent only apply through backend methods like CMP source connectors?
Yes, channel-level (or global) consent is generally handled through backend ingestion methods like CMP source connectors, where identity mapping (e.g., hashed email, phone) is explicit. This allows the platform to apply consent broadly across all profiles and datasets associated with that identifier, not just a single ECID.
Implications for data activation:
Web SDK: Consent applies to the ECID and is limited to that session/browser. Returning via incognito or another device will generate a new ECID, hence requiring new consent unless identity stitching is implemented.
Backend ingestion (e.g., CMP): Consent applies to all merged profiles with matching identity values, ensuring broader enforcement (e.g., across all email-based activities).
3. Why Consent 1.0 is still available:
Consent Standard 1.0 provides basic yes/no control, typically suited for simpler use cases. Standard 2.0 introduces granularity (channel-/field-level), but is most effective when used with full identity context — which is often only available via system-onboarded datasets or backend ingestion.