Configuration & Storage

The consent framework works with no configuration. Every signal reader is on, stored decisions never expire, and nothing needs to be set up. The options below are there for when a source needs something different.

Options

Option	Type	Default	What it does
tcf	boolean	true	Read IAB TCF from window.__tcfapi.
gpp	boolean	true	Read IAB GPP from window.__gpp.
gpc	boolean	true	Read Global Privacy Control from the browser.
enabled	boolean	true	Master switch. false ignores every CMP and browser signal, discards the stored decision, and stops storing new ones. Your own setConsent calls still apply for the current page view.
maxAgeDays	number	not set	Throw away a stored decision once it is older than this many days, so consent is collected again instead of restored indefinitely.
resetToken	string	not set	Change this value to invalidate every stored decision for the source at once.

The readers are on unless set to false, because a missing setting should never mean a shopper's valid opt-out is ignored.

maxAgeDays

The age is measured from when the shopper's decision last changed, not from when it was last seen. When a stored decision has expired, the SDK discards it and goes back to reading your CMP, which normally still holds the shopper's current choice.

A value of zero, a negative number or a non-number is ignored rather than treated as "expire everything".

resetToken

Each stored decision records the resetToken in force when it was written. If a later page view finds a different token in your configuration, the stored decision is discarded. Use this to recover from a misconfigured CMP or banner that recorded the wrong decisions, without turning the framework off.

enabled: false

This is an emergency switch. It's for when consent signals on a source are causing a problem and need to be bypassed while it's fixed. While it's off, every shopper on that source is treated as granted unless your own setConsent call says otherwise.

Where to set them

wave.js tag

For wave.js sources, the options live in your source's remote configuration under consentConfig, and Surfside applies them for you. Ask your Surfside account team to change them.

{
  "consentConfig": {
    "tcf": true,
    "gpp": true,
    "gpc": true,
    "maxAgeDays": 395,
    "resetToken": "2026-10-reset"
  }
}

The tag starts the readers straight after the tracker is created and before the first page view, so a shopper who opted out on an earlier visit is honoured from the very first event.

edge.js snippet

Call enableConsentSignals once, straight after newTracker and before the first trackPageView:

surf('newTracker', 'digital', '//col.surfside.io', { /* … */ });

surf('enableConsentSignals', {
  tcf: true,
  gpp: true,
  gpc: true,
  maxAgeDays: 395
});

surf('trackPageView');

Readers only start when you call enableConsentSignals

With the edge.js snippet, stored decisions and your own setConsent calls are always enforced, but the TCF, GPP and GPC readers don't start until you call enableConsentSignals. Call it with {} to use the defaults.

npm SDK

Add SurfsideCommercePlugin to the tracker, then call enableConsentSignals once, straight after newTracker:

import { newTracker, trackPageView } from '@surfside/browser-sdk';
import { SurfsideCommercePlugin, enableConsentSignals } from '@surfside/surfside-events';

newTracker('digital', '//col.surfside.io', {
  appId: 'digital',
  plugins: [SurfsideCommercePlugin()],
});

enableConsentSignals({ tcf: true, gpp: true, gpc: true });

trackPageView();

Readers only start when you call enableConsentSignals

Stored decisions and your own setConsent calls are always enforced, but the TCF, GPP and GPC readers don't start until you call enableConsentSignals. Call it with {} to use the defaults.

The first enableConsentSignals call on a page view sets the policy (enabled, maxAgeDays, resetToken). Later calls on the same page don't change it.

What is stored on the device

Key	Where	What it holds
surf_consent	localStorage	The resolved decision, the decision from each source, and when it last changed
surf_uid2	localStorage	The UID2 token from setSurfId. Deleted when identity is denied or the shopper logs out.

surf_consent is written even when consent is denied. Remembering an opt-out is strictly necessary: an opt-out that isn't remembered would be broken on the very next page view.

It is protected against tampering. If the stored value has been edited, truncated or written by something else, the SDK discards it and reads your CMP again rather than enforcing it. That's why editing it by hand in developer tools has no effect; use setConsent instead.

The raw TC and GPP strings are not stored on the device. They're sent to Surfside on the consent change event only.

If localStorage isn't available (for example, it's blocked or full), consent is still enforced for the current page view; it just isn't remembered on the next one.