Developer

Consent modes

Configure Apex SDK consent gating with custom consent, OneTrust, Usercentrics, Cookiebot, CCM19, Shopify Customer Privacy, Pandectes, or CookieScript.

Consent mode lets Apex render variants while delaying persistent storage and tracking until consent is available. The SDK treats consent as required when requireConsent is true, hasConsent is provided, or consentMode.enabled is true.

Use setConsent() when your site owns consent state:

import { init, setConsent } from "@drip-apex/sdk";
 
init({
  shopId: "demo-shop",
  endpoint: "https://events.drip-apex.com",
  requireConsent: true,
  hasConsent: false
});
 
window.addEventListener("privacy:accepted", () => {
  setConsent(true);
});

When consent is denied, the SDK clears Apex visitor, goal, signal, config-cache, session, QA, and identity context storage where possible.

Provider modes

import { init } from "@drip-apex/sdk";
 
init({
  shopId: "demo-shop",
  endpoint: "https://events.drip-apex.com",
  consentMode: {
    enabled: true,
    provider: "onetrust",
    requiredGroup: "C0004"
  }
});

Provider	How the SDK reads consent	Default group
`custom`	Reads `getter` from `window` when configured, otherwise waits for `setConsent()`.	None
`onetrust`	Reads `getter` or `window.OnetrustActiveGroups`; listens for OneTrust update events.	Any non-empty value when `requiredGroup` is omitted
`usercentrics`	Calls `UC_UI.getServicesBaseInfo()` and matches service name, ID, template ID, or data processor.	`Apex`
`cookiebot`	Reads `Cookiebot.consent` category booleans. Aliases such as `analytics` map to `statistics`.	`statistics`
`ccm19`	Reads `CCM.acceptedEmbeddings` and matches embedding name or ID.	`Apex`
`shopify`	Reads only Shopify’s Customer Privacy API. The storefront script loads the API; `requiredGroup` selects `analytics`, `marketing`, `preferences`, or `sale_of_data`.	`analytics`
`pandectes`	Calls the Pandectes consent purpose methods (for example `analyticsProcessingAllowed()`), falling back to Shopify's `customerPrivacy` API. `requiredGroup` selects the purpose: `analytics`, `marketing`, `preferences`, or `sale_of_data`.	`analytics`
`cookiescript`	Calls `CookieScript.instance.currentState()` and reads the selected category. Analytics aliases map to `performance`, marketing aliases map to `targeting`, and preference aliases map to `functionality`. Custom category names remain available.	`analytics`
`borlabs`	Reads `BorlabsCookie.Consents` or calls `BorlabsCookie.checkCookieConsent()` when available.	`statistics`

ConsentModeSettings

Field	Type	Default	When to use
`enabled`	`boolean`	`false`	Turn provider-backed consent detection on.
`provider`	`"custom"`, `"shopify"`, `"onetrust"`, `"usercentrics"`, `"cookiebot"`, `"ccm19"`, `"pandectes"`, or `"cookiescript"`	Not set	Select the consent integration.
`getter`	`string`	Provider default	Dot-path on `window` for custom or OneTrust consent values.
`requiredGroup`	`string`	Provider default	Required group, category, service, or embedding identifier.

Change listeners

When consentMode.enabled is true, the SDK listens for common consent manager browser events, including OneTrust, Cookiebot, Usercentrics, CCM19, Shopify Customer Privacy (visitorConsentCollected), Pandectes (PandectesInitialized and Shopify's visitorConsentCollected), and CookieScript events. On change, the SDK rechecks consent, storage mode, project prerequisites, and tracking permission. The custom, shopify, pandectes, cookiescript, and borlabs providers also poll once per second for up to ten minutes; the event-driven providers (OneTrust, Cookiebot, Usercentrics, CCM19) never poll, even with a getter. Polling stops after consent grants tracking.

If the consent manager has not exposed its state when the script runs, the SDK starts in memory mode and keeps any stored identity. The SDK adopts that identity after consent is granted. When init later resolves with consent granted the SDK writes the consent cookie so the visitor identity survives the first navigation after consent (examples: Cookiebot, OneTrust, Usercentrics, CCM19). Only an explicit denial or Do Not Track clears the stored identity.

While consent is unknown, the SDK still assigns the visitor and renders the variant, and it keeps the assignment exposure and the first performance measurement in memory. Nothing is sent. When consent is granted later on the same page, the assignment exposure is sent, and it is also sent when the visitor leaves or backgrounds the page shortly after accepting. The performance measurement and the regular analytics stage (pageview, goals) still wait for the page-wide apply gate; a visitor who leaves before that gate opens is dropped from those events in every arm. Every arm follows the same rules, so traffic splits stay balanced on stores where most visitors accept cookies after the page has loaded.

An explicit denial discards the buffered records. If the visitor grants consent afterwards on the same page, the SDK records a fresh exposure at that time.

Custom consent

Provider modes

ConsentModeSettings

Change listeners

Counting while consent is pending

Related pages