Fingerprint Consent Enforcement

Configure and enforce user consent for 1Key fingerprint biometric across enrollment and Windows login. Set up unified or separate biometric consent, manage consent versioning, bulk-import records, and

1Kosmos now enforces user consent for fingerprint biometric (1Key) during enrollment via Auth Manager and authentication via the Credential Provider. When enabled at the community level, Auth Manager retrieves the consent configuration and the latest consent document from CaaS and validates the user's consent status via AuthN using the scope fingerprint-consent.

Fingerprint consent is tracked separately from LiveID (face) consent. Administrators can configure unified consent (one acceptance covers all biometrics) or separate consent (each modality requires its own).

When the user is prompted for consent

The user is prompted for consent when:

• No consent record exists.

• The user has previously denied consent.

• The stored consent version does not match the latest consent document (based on the consentId received from CaaS).

Accept and decline behavior

• Accept — Enrollment or authentication proceeds.

• Decline — The flow is blocked. During enrollment, the user cannot proceed. During Windows login, the Credential Provider directs the user to contact IT or re-enroll via Auth Manager.

Enable enforcement

Consent enforcement does nothing until it is enabled at the community level. In Settings > Consent Management, turn on Require consent before biometric enrollment. Until this is enabled, users are not prompted and enrollment or authentication proceeds without a consent check.

Configure consent handling

In the AdminX UI, administrators configure how biometric consent is captured under Settings > Consent Management. For more information, see Consent Management.

• Unified consent — One acceptance covers all biometrics.

• Separate consent — Each modality (for example, fingerprint and LiveID) requires its own acceptance.

Consent versioning

Consent is version-controlled using consentId (stored as ipfsHash). Any update to the consent document requires users to re-consent.

Bulk import of consent records

A bulk import API is available to ingest out-of-band consent records for users who consent through a separate process. Use it to prevent lockouts when enforcement is enabled.

Events

• E_FINGERPRINT_CONSENT_ACCEPTED

• E_FINGERPRINT_CONSENT_DECLINED