Consent Management

The Vendo JavaScript SDK has built-in consent handling so you can keep tracking compliant with GDPR, CCPA, and similar regimes. You can set consent yourself with the API, or let the SDK detect and sync with a consent-management platform (CMP) automatically.

Consent groups are attached to every event at context.consent, so downstream destinations and the warehouse always know what the visitor agreed to at the moment the event was captured.

The consent Init Option

Configure consent at initialization with the consent option:

vendo('init', 'YOUR_WRITE_KEY', {
  host: 'https://track.yourdomain.com',
  consent: {
    groups: { analytics: true, marketing: false },
    waitForConsent: true,
    requiredGroups: ['analytics'], // default
  },
});

Gating is opt-in. Consent enforcement applies only when waitForConsent: true. With the default waitForConsent: false, the SDK never holds or drops events — consent groups are simply stamped onto each event at context.consent.

waitForConsent Behavior

waitForConsent controls whether the SDK sends events before the visitor has made a consent decision.

• waitForConsent: false (default) — Consent is treated as resolved immediately. Events flow as soon as they are tracked, and the current consent groups are stamped onto each event. No enforcement happens in this mode.
• waitForConsent: true — The SDK holds all events in a queue and sends nothing until at least one required group becomes granted (requiredGroups, default ["analytics"]). The moment that happens — via setConsent() or a CMP signal — the SDK flips to resolved and flushes everything it was holding.

Two important enforcement details while waiting:

• Reject-all purges the queue. If the visitor’s decision grants none of the required groups (e.g. “Reject all”), the SDK resolves as denied, purges every held event, and sends nothing.
• necessary: true alone never opens the gate. necessary is always granted by CMPs, so it is deliberately not a required group by default — a necessary-only decision counts as a rejection and purges the held events.

Use waitForConsent: true when your legal basis requires an explicit opt-in before any data leaves the browser.

API

setConsent(groups)

Merge new consent values into the current state. Values you pass overwrite the matching groups; groups you omit are left unchanged. The updated consent is attached to every subsequent event at context.consent, and any registered listeners are notified.

vendo.setConsent({ analytics: true, marketing: true });

If the SDK was initialized with waitForConsent: true and has not yet resolved, granting one of the required groups here flips it to resolved and flushes the queued events. A decision that grants none of the required groups resolves as denied and purges the held events.

getConsent()

Return a copy of the current consent groups.

vendo.getConsent(); // → { analytics: true, marketing: true }

Automatic CMP Detection

If you already run a consent-management platform, the SDK can detect it and keep its own consent state in sync — no manual setConsent() wiring required. The following CMPs are supported out of the box.

OneTrust

The SDK reads OnetrustActiveGroups, hooks OptanonWrapper, and listens for the consent.onetrust event. The default group mapping is:

Usercentrics

The SDK listens for the UC_UI_CMP_EVENT event and interprets ACCEPT_ALL, DENY_ALL, and consent_status signals.

CookiePro

CookiePro is built on OneTrust, so the SDK uses the same OneTrust integration and additionally listens for the OTConsentChanged event.

CookieFirst

The SDK listens for the cf_consent event and maps CookieFirst categories to Vendo groups:

Custom Mappings

If your CMP uses different category names, or you run a CMP that isn’t listed, you can supply your own mapping so its categories translate to Vendo consent groups. Combine this with setConsent() to bridge any CMP.

Related

• JavaScript SDK — Full method and configuration reference
• API Reference — /collect endpoint and the context.consent field