Visitor Consent

The Atribu tracker keeps one consent state for each visitor, and it enforces it: when a visitor says no, the tracker stops saving what they said no to, and Atribu never sends their conversions to ad platforms.

The two kinds of consent

The event itself is still recorded in Atribu, so your own dashboard keeps counting the visit and any sale. Every event carries the consent state it was sent under.

Telling the tracker

atribuTracker.setConsent({ analytics: true, ads: false });
// npm: import { setConsent } from "@atribu/tracker";

• Only the keys you pass change — setConsent({ ads: true }) keeps an earlier analytics answer.
• marketing is accepted as the older name for ads (Shopify's theme embed sends it).
• Google's two extra fields can be passed too: ad_user_data, ad_personalization.
• The decision is remembered on the device (remembering a choice is not tracking), and survives reset().
• atribuTracker.getConsent() returns what the next event will carry.

Revoking consent mid-visit removes what the tracker had saved: analytics: false deletes the visitor id, session and stored visit history; ads: false removes the click ids from the stored visit. Cookies that belong to someone else — a _fbp your Meta Pixel created — are left for that tool's own consent handling.

Consent mode

Each profile has a Visitor consent setting under Settings → Tracking:

• Off (default) — nothing changes for sites that never asked for it. The tracker only holds back when your site calls setConsent(...) with a denial.
• Required — nothing consent-gated happens until the visitor accepts. Until then: no saved identifiers, no ad cookies, no saved click ids, no bridges, no export. Google Consent Mode and IAB TCF answers are enforced automatically. If you use the combined snippet with the Meta Pixel, it also starts the Pixel in fbq('consent', 'revoke'); call fbq('consent', 'grant') when your banner grants ads consent.

The mode rides the tracker snippet (window.ATRIBU_CONSENT_MODE = "required"), so re-install the snippet after changing it. The server enforces "Required" on its own too: a browser event that arrives without a real ad grant — from an old cached snippet, say — is never exported.

With the npm package: init({ trackingKey, consentMode: "required", consent: { analytics: true, ads: false } }). A consent passed at init applies before the first identifier is written.

Google Consent Mode v2

If your site uses Google Consent Mode (through a CMP, Google Tag Manager or gtag('consent', 'default' | 'update', {...})), the tracker reads it from window.dataLayer — no extra code.

A default restricted to a region is ignored, because the tracker cannot know the visitor's region — under "Required" that means denied until an update.

In Off mode Consent Mode is recorded (and forwarded to Google) but not enforced. In Required mode it is enforced.

IAB TCF v2.2

If a TCF CMP is on the page (window.__tcfapi), the tracker listens with addEventListener and reads the purpose consents once the CMP has loaded or the visitor has chosen:

When GDPR does not apply (gdprApplies: false), TCF says nothing and the next source decides. Vendor consents are not read.

Which answer wins

1. setConsent(...) (or consent at init / window.ATRIBU_CONSENT)
2. IAB TCF
3. Google Consent Mode
4. The profile's mode: Off → granted, Required → denied

Google uploads

Every Google conversion upload carries Google's consent fields from the event: ad_user_data and ad_personalization as the page's Consent Mode / TCF / setConsent recorded them. A conversion with no browser consent record (a CRM stage change, a payment) is sent as granted, as before; one marked "never export" by your server (consent: { marketing: false } on POST /api/v1/events) is never uploaded at all.

Shopify

Nothing changes on Shopify. The theme embed only loads the tracker once Shopify's customer-privacy API allows analytics, marketing and sale of data, and passes that answer on through setConsent. The Shopify Web Pixel runs inside Shopify's own privacy sandbox, so its events count as consented.

Chile — Ley 21.719

Ley 21.719 (Chile's personal-data law, aligned with the GDPR) requires a lawful basis — usually consent — before personal data is processed for advertising, and lets a person withdraw it at any time, as easily as they gave it. What Atribu does to help you meet that:

• Required mode makes consent the precondition: until it is given, nothing that identifies the visitor is stored on their device and nothing is sent to ad platforms.
• Withdrawal takes effect on the next event, deletes what the tracker saved, and stops every later export of that visitor's conversions.
• The consent state is stored with each conversion the tracker records, so you can show what a visitor had agreed to when it happened.

You remain responsible for your banner's wording and for collecting consent itself; Atribu enforces the answer you pass it.