Consent Data in Your Events

The SDK records consent in two places, so you can show what was collected under what permission:

• a consent context on every event, recording the state in force when the event was collected
• a consent change event each time the decision changes, recording what changed and why

Consent context

Schema: iglu:io.surfside.consent/state/jsonschema/1-0-0

Attached to every event the SDK sends, including page views, ecommerce actions and impressions.

Field	Type	Description
tracking	granted | denied	The tracking decision when the event was collected
identity	granted | denied	The identity decision when the event was collected
signal	tcf | gpp | gpc | api | none	The source responsible for the decision. none means no source expressed a preference and the default applied.
jurisdictions	string[]	The US GPP sections that apply to the shopper, for example ["usca"]. Only present when GPP reported them. At most two.

{
  "schema": "iglu:io.surfside.consent/state/jsonschema/1-0-0",
  "data": {
    "tracking": "granted",
    "identity": "denied",
    "signal": "gpc"
  }
}

Which source gets the credit

When several sources reported, signal names the one that matters most:

1. a source denying identity
2. otherwise, a source denying tracking
3. otherwise, the source that granted

So a shopper with GPC switched on whose CMP granted everything shows identity: "denied", signal: "gpc".

Consent change event

Schema: iglu:io.surfside.consent/signal/jsonschema/1-0-0

Sent to every Surfside tracker on the page when the tracking or identity decision changes.

Field	Type	Description
source	tcf | gpp | gpc | api | none	The source responsible for the new decision
tracking	granted | denied	The new tracking decision
identity	granted | denied	The new identity decision
previousTracking	granted | denied	The tracking decision before the change
previousIdentity	granted | denied	The identity decision before the change
jurisdictions	object[]	Per-section GPP detail (see below). Present only when GPP is the responsible source.
signalString	string	The CMP's encoded TC string (TCF) or GPP string (GPP), when there is one. Up to 4,096 characters.
cmpId	number	The IAB CMP ID, when the CMP supplied one
gdprApplies	boolean	TCF's gdprApplies, when TCF is the responsible source
createdAt	string	ISO 8601 time of the change

Each GPP jurisdiction object contains:

Field	Description
section	The section's API prefix, for example usca
sectionId	The GPP section ID, for example 8
saleOptOut, sharingOptOut, targetedAdvertisingOptOut	opted-out, did-not-opt-out or not-applicable, for the fields the section defines
gpc	The GPC value carried inside the section
mspaServiceProviderMode	yes, no or not-applicable
mspaCoveredTransaction	yes or no

{
  "schema": "iglu:io.surfside.consent/signal/jsonschema/1-0-0",
  "data": {
    "source": "gpp",
    "tracking": "granted",
    "identity": "denied",
    "previousTracking": "granted",
    "previousIdentity": "granted",
    "jurisdictions": [
      { "section": "usca", "sectionId": 8, "saleOptOut": "opted-out", "sharingOptOut": "opted-out" }
    ],
    "signalString": "DBABBg~BUoAAABA.QA",
    "cmpId": 300,
    "createdAt": "2026-10-13T14:03:11.402Z"
  }
}

When it is sent, and when it isn't

Situation	Change event?
A shopper accepts, rejects or changes their choice	Yes
GPC is switched on, or a GPP/TCF CMP publishes a new decision	Yes
setConsent changes a decision	Yes
The CMP re-publishes the same decision	No, nothing changed
A decision is restored from an earlier page view	No. It's still enforced from the first event, but the shopper didn't decide anything on this page.
A stored decision is discarded by maxAgeDays, resetToken or enabled: false	No

Because the event carries the raw signalString alongside the SDK's reading of it, consent decisions can be re-checked later against the original CMP output.

Identity contexts

When identity is denied, these contexts are removed from events. Their absence, together with the consent context, shows that identity was withheld:

Schema	Set by
iglu:io.surfside.identity/user/jsonschema/…	setUser, identifyUser
iglu:io.surfside.identity/uid_context/jsonschema/1-0-0	setSurfId