Consent Settings
Set your organization's consent posture, connect a consent source, and decide what happens to events from visitors who decline.
Consent Management covers how a consent signal reaches Logspot from your code or your CMP. This page covers the settings that decide what Logspot does with that signal.
Everything here lives under Settings → Privacy, which has four tabs: User Consent, Consent Sources, Server Events, and Data Requests.
Consent Behavior
Settings → Privacy → User Consent sets the Default Behavior for your organization. This is the state Logspot assumes before any consent source has said otherwise.
| Option | What it means |
|---|---|
| Not Required | Standalone analytics. Analytics, Functional, and Marketing (Advertising) are all allowed unless a consent source restricts them. |
| Implied | All categories are granted until a visitor or your CMP denies them. |
| Express | Strict. Every category is denied until explicitly granted. |
| Custom Per Category | Set each category individually. |
Under Custom Per Category, each of the three categories takes either Implied (Allowed by Default) or Express (Denied Until Granted).
A project can depart from the organization default. Open Project Settings → Consent and use Override for This Project.
Analytics-Denied Events
When a visitor declines analytics, you choose what happens to their events:
Discard the Event drops them. Nothing is stored.
Store Anonymized keeps the event for aggregate counts but strips every identifier, including user, anonymous, identity, company, and session. Metadata is dropped and location is truncated to country. Choose this when you still need traffic totals from visitors you cannot identify.
Server-Side Events
Settings → Privacy → Server Events decides how events sent with your secret key interact with the analytics-denied rule. Client-side events from the browser SDK are always gated, whatever you pick here.
Exempt Revenue is the recommended setting. A payment sent from your secret key is recorded under a transactional basis and bypasses the analytics-denied rule, while other server-side events stay gated. The denied stamp still blocks marketing and sale or share destinations downstream.
Exempt All Server-Side lets every secret-key event bypass the rule. Use it when all your server-side data is first-party and trusted.
Gate Everything puts server-side events through the same gate as client-side events. This is the strictest option.
Consent Sources and Priority
Settings → Privacy → Consent Sources is where you connect the systems that can tell Logspot about a visitor's choices. More than one can be active, so Logspot ranks them.
The ladder, highest authority first:
- The Logspot Consent API, meaning an explicit
setConsent()call or a request to the consent endpoint - Concord
- Third-party CMPs: OneTrust, Usercentrics, and Cookiebot
- Google Consent Mode
- The organization default
A source can overwrite a record written by anything below it, never by anything above it. The three third-party CMPs share one rank, so among those the most recent write wins.
Google Consent Mode sits deliberately low. Logspot reads it but never writes to it, and a Consent Mode state can be a site-configured default rather than a choice a person made. The reader cannot tell those apart, so anything above it takes precedence.
Browser Privacy Signals
Global Privacy Control and similar browser signals are always recorded. Whether they override a category outcome depends on where that outcome came from.
If a real consent management platform produced the record, meaning the Consent API, Concord, OneTrust, Usercentrics, or Cookiebot, its outcome stands and the signal is recorded alongside it. The reasoning is that a person answered a question, and that answer is better evidence than a browser-level default.
If the record came from Google Consent Mode or from your organization default, a Global Privacy Control signal does override it. Neither of those represents a human answering a question about your site, so a visitor's explicit signal wins.
Per-Person Consent History
Open Settings → Identities and select a person to see their current state for Analytics, Functional, and Marketing (Advertising), along with the history of changes. Each event carries the source that produced its consent state, so you can trace why a given event was treated the way it was.