Consent and CMPs
3x measures without consent in the default cookieless mode and upgrades when consent is
granted. Which device reads happen before and after consent is listed in
Privacy and GDPR; choose the project's mode there (cookieless, strict,
require).
What consent changes
| Before consent | After consent | |
|---|---|---|
| Session id | in memory | also in sessionStorage (<prefix>tsid) – survives reloads for 30 min |
| Screen width / touch | not read | read |
| First-touch attribution | not stored | stored when firstTouch.enabled |
_fbp, _fbc, _ttp | not read | read and sent for conversion matching |
identify() | not sent (default) | sent |
require mode | nothing measured | measurement starts |
Denying consent after granting removes the stored session id.
Telling 3x about consent
Pick whatever your banner offers – several can be combined.
1. Call the API
// after the visitor accepted
x3("consent", "granted");
// after the visitor declined or withdrew
x3("consent", "denied");With npm: import { consent } from "@3x-engine/sdk"; consent("granted");
2. A consent key in localStorage
If your banner stores its decision in localStorage, configure the key and values
(Settings → Tracking → Consent):
{ "consent": { "mode": "cookieless", "storageKey": "cookie_consent", "grantedValues": ["accepted", "all"], "deniedValues": ["declined", "necessary"] } }The SDK reads this key on start (reading the consent state is allowed without consent).
3. A window event
{ "consent": { "windowEvent": { "name": "cookieConsent", "detailPath": "", "grantedValues": ["accepted"], "deniedValues": ["declined"] } } }detailPath is a dotted path into event.detail ("" = the detail itself).
4. Built-in CMP adapters
Set consent.cmp to any of cookiebot, usercentrics, complianz, borlabs,
google_consent_mode. The adapter plugin (x3.consent.js) is loaded lazily and maps the CMP's
statistics/analytics category to 3x consent:
| CMP | Signal used |
|---|---|
| Cookiebot | Cookiebot.consent.statistics, events CookiebotOnAccept / CookiebotOnDecline |
| Usercentrics | consent for the analytics category via UC_UI events |
| Complianz | cmplz_status_change events, category statistics |
| Borlabs Cookie | borlabs-cookie-consent-saved, group statistics |
| Google Consent Mode | analytics_storage from the dataLayer consent state |
With npm, the same adapters are exported from @3x-engine/sdk/presets.
Global Privacy Control and Do Not Track
respectGlobalPrivacyControl (default on for new projects) treats navigator.globalPrivacyControl
and the Sec-GPC request header as denied. respectDoNotTrack does the same for DNT. Denied means
cookieless measurement continues; nothing is upgraded.
Strict and require modes
strict: before consent, pageviews carry no viewport or scroll data andnavis alwaysload; section reach and engaged time need consent. Clicks, custom events and video of your own elements still work. Batches without dimensions are accepted (bots are filtered by user agent).require: the SDK loads, reads the consent state, and waits. Ongrantedthe first pageview starts.
Server-side
POST /v1/projects/{project}/events and conversions from your server are independent of browser
consent; your legal basis decides (Legal basis).