How Consent Works in Surfside

The Surfside Digital SDK has a consent framework built in. It reads consent from your Consent Management Platform (CMP) and from the shopper's browser, turns what it finds into one clear decision, and applies that decision to every event before it leaves the page. You don't have to install anything extra.

This page explains the model. The rest of this section covers each part in detail:

Page	Read it if you want to…
CMP & Browser Signals	Know how the SDK reads IAB TCF, IAB GPP and Global Privacy Control
Setting Consent from Your Site	Connect a custom banner or a non-IAB CMP with setConsent
What Happens When Consent Is Denied	Understand exactly what changes on the wire
Configuration & Storage	Turn readers on or off, set expiry, or reset stored decisions
Consent Data in Your Events	Use the consent context and consent change events in reporting
Testing & Troubleshooting	Check your implementation, and see which behaviours are deliberate
Privacy Regulations & Signals	See how the main regulations relate to the signals the SDK reads

Two purposes

Every consent decision comes down to two purposes. Each one is either granted or denied.

Purpose	What it controls	When it is denied
tracking	Whether events can be tied to a browser	Events are still sent, but anonymised: no Surfside cookie IDs, no session ID, and the collector anonymises the IP address.
identity	Whether Surfside may work out who the shopper is	Identity calls (setUser, identifyUser, setSurfId, setUserId and its variants) are held instead of sent. Identity already attached to the tracker is removed, and the stored UID2 token is deleted.

A denied identity does not stop collection

When only identity is denied, page views and ecommerce events keep flowing with the anonymous browser ID attached. US opt-out laws restrict the sale of personal data and targeted advertising, not first-party measurement, so the SDK keeps measurement running and removes what identifies the person.

Where consent comes from

The SDK reads four sources:

Source	What it reads	Purposes it can deny
tcf	IAB TCF v2 CMP (window.__tcfapi)	tracking and identity
gpp	IAB GPP CMP, US sections (window.__gpp)	identity
gpc	Global Privacy Control (navigator.globalPrivacyControl)	identity
api	Your own calls to surf('setConsent', …)	tracking and identity

The TCF, GPP and GPC readers are on by default. If your site already runs an IAB-compliant CMP, the SDK picks its decisions up with no extra code.

How sources combine

Sources can disagree. The SDK resolves them with a small set of rules:

1. The most restrictive answer wins. If any source denies a purpose, that purpose is denied, even if another source grants it.
2. A source with nothing to say does not count. A CMP that hasn't loaded, or a browser that doesn't send GPC, has no effect on the result.
3. With no signal anywhere, both purposes are granted. A site with no CMP and no GPC behaves exactly as it did before the consent framework existed.

The resolved state also records which source decided it. In the signal field, none means nothing has expressed a preference and the SDK is using its default.

setConsent cannot override a CMP or browser denial

Because the most restrictive answer wins, setConsent({ identity: true }) does not lift a denial that came from GPC, GPP or TCF. That's deliberate: a shopper who opts out through their browser or your CMP stays opted out. See Testing & Troubleshooting.

When it takes effect

• From the first event. A decision made on an earlier page view is stored on the device and restored when the tracker is created, before the first page view is sent.
• Before the tracker exists. You can call setConsent, getConsent and getConsentSignal as soon as window.surf exists, before the tracker is created. Calls made before the SDK finishes loading are queued and applied in order.
• As soon as a CMP answers. The readers wait for a CMP to appear and react as soon as it publishes a decision. They also keep listening, so a shopper who changes their mind mid-visit is handled straight away.

Events sent before a late signal can't be recalled

With the default granted posture, an event sent before a slow CMP publishes its decision is not recalled once that decision arrives. If your legal basis requires a decision before any collection (for example, an EU opt-in regime), set an explicit default with setConsent before the tag loads. See Setting Consent from Your Site.

What gets recorded

Every event carries the consent state in force when it was collected, and every change in consent is recorded as its own event. Together they give you an audit trail of what was collected under what permission. See Consent Data in Your Events.