Consent and banner
Categories, regions, Global Privacy Control, and hosted privacy choices.
Last updated on
Essential cookieless analytics is always on. The banner is shown only when enhanced analytics is enabled for the project, and only for a visitor who still needs to choose.
Edit it at Dashboard, Consent. Accept, Reject, and Customize use one button style. The enhanced category starts unchecked.
Categories
| Category | Required | What it covers |
|---|---|---|
| Essential cookieless analytics | yes, always on | Path, content id, country, and device class. No cookie and no personal data. |
| Enhanced analytics | no, starts unchecked | Referring site, utm_source, utm_medium, utm_campaign, and the goal event. |
The default enhanced label is Enhanced analytics. The default banner text says essential cookieless analytics is always on and that enhanced analytics stays off unless the visitor accepts it. Leave the text empty in the dashboard to keep that default.
There is no advertising category in the tracker. An outside consent adapter is not built.
Where the banner shows
Two regions are saved on the project.
EU, EEA, UK, Switzerland, and Canada (eu_uk_ca). This is the default. The country codes are Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Iceland, Liechtenstein, Norway, the United Kingdom, Canada, and Switzerland. An unknown country is asked. Everyone else is not asked and stays cookieless. California visitors are not prompted and stay cookieless. They can still open Privacy choices.
Everywhere. Every visitor sees the banner until they choose, except a browser that sends Global Privacy Control or Do Not Track.
Global Privacy Control
Global Privacy Control is honored everywhere, including when the region is Everywhere. The banner stays hidden and enhanced analytics stays off. The same is true for Do Not Track (DNT: 1 or navigator.doNotTrack === "1").
The tracker treats navigator.globalPrivacyControl === true as an opt-out before it paints the banner. The Worker treats Sec-GPC: 1 and DNT: 1 as an opt-out even if the body says analytics was granted. A stored choice is written as denied for the current consent version.
What asks again
The choice is localStorage on the customer site, under databob.consent.<siteId>:
{ "v": 1, "enhanced": false, "source": "databob" }These edits bump the consent version and ask again:
- Banner text
- Privacy policy URL
- Enhanced label
- Region
- Enhanced analytics on or off
Colors and position do not bump the version. Default colors are #111111, #f4f4f5, and #f4f4f5. A banner that still has those defaults follows the visitor's light or dark setting. Custom colors do not.
Position is bottom or top. The privacy policy link is rendered only when the URL is https and has no username or password. Anything else is published as a blank policy URL.
Hosted privacy choices
Privacy choices opens https://databob.dev/c/<siteId>. The page uses the same neutral theme as the app, with its own light and dark toggle, and it does not load the tracker.
The page cannot be framed (Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY) and it sends Referrer-Policy: no-referrer. After it has read the nonce and the return URL, it removes both from the address bar.
Before the tracker opens that page, it stores a single-use nonce in sessionStorage under databob.nonce.<siteId>. The page echoes the nonce in a #databob= hash on an allowed return URL, or in a postMessage when it was opened as a popup. The message type is databob-consent. The tracker accepts the choice only when the nonce matches, then deletes the nonce. A hash or message without that nonce does not grant enhanced analytics. The page never posts to *.
The enhanced box starts from the stored choice for the current version, or unchecked. A ?enhanced=1 link does not pre-tick it. If the page cannot see an allowed return origin, it says the choice was saved in that browser and to choose again from the site.
A consent beacon is a separate point: action granted, denied, or changed, category enhanced, the version, and source. It has no path, country, address, or visitor id. The dashboard Consent page shows granted, denied, and changed counts for 7 days and 28 days from the daily snapshot. It does not store one row per visitor.
Consent settings take up to about a minute to apply.