Consent and the Web SDK

Consent and the Web SDK

The consent workflow

1. Visitor arrives at site
2. Consent banner shows
3. Visitor clicks "Accept" or "Reject"
4. You call setConsent()
5. Web SDK honors choice
6. Data sent only if consented

Implementing consent

Step 1: Get consent

Your site's consent banner captures choice:

// User clicks "Accept Analytics"
const consentString = generateIABConsentString();

Step 2: Set consent in Web SDK

alloy("setConsent", {
  consent: [{
    standard: "IAB TCF",
    version: "2.0",
    value: consentString
  }]
});

Step 3: Send event

alloy("sendEvent", {
  xdm: { ... }
});
// If consented: sent to Adobe
// If rejected: collected but not sent

Consent states

In (consented)

• Visitor agreed to analytics
• Data is sent to Adobe
• Full tracking enabled

Out (rejected)

• Visitor declined analytics
• Data is collected locally but NOT sent
• Web SDK still functional (for consented purposes)

Pending

• Visitor hasn't decided yet
• Data collected but held
• Once decided, retroactively sent or deleted

IAB TCF (Trust and Consent Framework)

Standard format for consent:

• "IAB TCF" = used in EU
• Vendor ID 565 = Adobe Analytics
• Purposes: 1 (storage), 7 (measurement)

Adobe provides a consent string builder. Use it.

Best practices

1. Ask specifically for analytics

- Don't: "Accept all cookies" - Do: "Allow us to measure your visit"

1. Make rejecting easy

- Reject button = same size as Accept - Not hidden, not small

1. Honor changes

- If visitor changes mind, update consent - Visitor: "Disable analytics" → respected

1. Document your policy

- Privacy policy explains what you measure - How long you keep data - How to opt-out

---

Next: Practical safeguards