Consent Management

The Vendo JavaScript SDK has built-in consent handling so you can keep tracking compliant with GDPR, CCPA, and similar regimes. You can set consent yourself with the API, or let the SDK detect and sync with a consent-management platform (CMP) automatically.

The SDK attaches consent groups to every event at context.consent. Downstream destinations and the warehouse then always know what the visitor agreed to when the SDK captured the event.

The consent Init Option

Configure consent at initialization with the consent option:

vendo('init', 'YOUR_WRITE_KEY', {
  host: 'https://track.yourdomain.com',
  consent: {
    groups: { analytics: true, marketing: false },
    waitForConsent: true,
    requiredGroups: ['analytics'], // default
  },
});

Gating is opt-in. Consent enforcement applies only when waitForConsent: true. With the default waitForConsent: false, the SDK never holds or drops events. It only adds the consent groups to each event at context.consent.

waitForConsent Behavior

waitForConsent controls whether the SDK sends events before the visitor has made a consent decision.

• waitForConsent: false (default): Consent is treated as resolved immediately. Events flow as soon as they are tracked, and the current consent groups are stamped onto each event. No enforcement happens in this mode.
• waitForConsent: true: The SDK holds all events in a queue and sends nothing until at least one required group becomes granted (requiredGroups, default ["analytics"]). When that happens (through setConsent() or a CMP signal), the SDK changes to resolved and flushes everything it was holding.

Two important enforcement details while waiting:

• Reject-all purges the queue. If the visitor’s decision grants none of the required groups (for example, “Reject all”), the SDK resolves as denied, purges every held event, and sends nothing.
• Denied consent drops later events. After the SDK resolves as denied, it drops every later event. It does not hold them. The SDK sends events again only after a setConsent() call or a CMP signal grants a required group.
• necessary: true alone never opens the gate. necessary is always granted by CMPs, so it is deliberately not a required group by default. A necessary-only decision counts as a rejection and purges the held events.

Use waitForConsent: true when your legal basis requires an explicit opt-in before any data leaves the browser.

API

setConsent(groups)

Merge new consent values into the current state. Values you pass overwrite the matching groups. Groups you omit stay unchanged. The SDK attaches the updated consent to every later event at context.consent.

vendo.setConsent({ analytics: true, marketing: true });

If the SDK was initialized with waitForConsent: true and has not yet resolved, granting 1 of the required groups here resolves it. The SDK then flushes the queued events. A decision that grants none of the required groups resolves as denied and purges the held events.

getConsent()

Return a copy of the current consent groups.

vendo.getConsent(); // → { analytics: true, marketing: true }

Known issue: The self-hosted snippet does not have setConsent or getConsent before the SDK loads. If you use the self-hosted snippet, call these methods only after the SDK loads.

Automatic CMP Detection

If you already run a consent-management platform, the SDK can detect it and keep its own consent state in sync. You do not need to call setConsent() yourself. The following CMPs are supported out of the box.

OneTrust

The SDK reads OnetrustActiveGroups, hooks OptanonWrapper, and listens for the consent.onetrust event. The default group mapping is:

Usercentrics

The SDK listens for the UC_UI_CMP_EVENT event and interprets ACCEPT_ALL, DENY_ALL, and consent_status signals.

CookiePro

CookiePro is built on OneTrust, so the SDK uses the same OneTrust integration and additionally listens for the OTConsentChanged event.

CookieFirst

The SDK listens for the cf_consent event and maps CookieFirst categories to Vendo groups:

Custom Mappings

The SDK does not have an option for custom CMP category mappings. If your CMP uses different category names, or is not listed, call setConsent() from your CMP’s consent callback. Pass the matching Vendo consent groups.

Related

• JavaScript SDK: Full method and configuration reference
• API Reference: /collect endpoint and the context.consent field