How consent works.

The rules

What the site needs to work, such as a shopper's cart, sign-in and paid access, is essential and never gated.

Three regimes

• Opt-in. Nothing gated happens until the visitor says yes. No identifying cookie is written before a yes.
• Opt-out. The visitor is told at the moment of collection and can say no. Analytics and personalization start on, and marketing starts off.
• Essential-only. Only what the site needs to work.

The default map

A rule can name a region instead of a whole country, such as California (US-CA), and the more specific rule wins. The map is your site's policy: it is set out on Privacy & Data › Consent, and changed through the copilot behind an approval card.

What each state allows

Do Not Track, sent by the browser, keeps the page's analytics script off until the visitor makes an analytics choice.

Cookies and the record

• The visitor cookie, __em_vid, lasts one year and cannot be read by the page's own scripts. Under opt-in it is created only after the visitor allows analytics or personalization.
• The consent cookie, __em_consent, holds the visitor's choice.
• The record. Each choice is also kept on the server with the regime, the version of the policy in force, and where the choice came from, if the browser has the visitor cookie or the choice creates it.
• Reopening. "Privacy choices" reopens "Choose what you allow on this site." at any time, and the new choice replaces the old.

Your tags

• A head entry on Privacy & Data › Consent › "Head & CSP" can wait for consent of a purpose you name before it loads.
• Tag managers read the visitor's choice from window.praxis.consent, and receive a praxis_consent_change event in the dataLayer whenever it changes.
• The choice arrives as a snapshot: what the visitor chose for each purpose, what is in effect, the regime, whether Global Privacy Control was sent, and the policy version. A subscriber receives the current snapshot at once, then every later change.
• One Content Security Policy for the whole site, in "Report only" or "Enforce".

// What is in effect right now
const now = window.praxis.consent.get();
if (now.effective.analytics) { /* fire the analytics tag */ }

// Every later change, starting with the current state
window.praxis.consent.subscribe((snapshot) => {
  if (snapshot.gpc) { /* the browser sent Global Privacy Control */ }
});

// In a tag manager: the dataLayer event
// { event: "praxis_consent_change", praxisConsent: { explicit, effective, regime, gpc, policyVersion, provenance, sequence } }

Changing the policy

• The policy screen is read-only, so nobody changes it by accident. Ask the copilot, and the change waits behind "Change this site's consent policy?", with an undo.
• A changed choice records the policy version it was made under.
• Praxis is the technical foundation for consent on your site, built to support your compliance. Your advisers confirm your obligations, and the policy you choose is applied on the server to every visitor.

Machines

• A crawler is treated like any other visitor from its location: from an opt-in region it sees the default page, and the page's canonical address is the same for every version of it.