Set up and test cookie consent
When your setup requires analytics consent, keep Attriboo blocked until the visitor agrees. New code from Setup waits for a consent callback by default. It does not add a cookie banner to your website or connect itself automatically to your consent manager. Ask the person managing your site to configure and test the full flow.
Instructions reviewed
Connect your consent manager
- Review your tracking purpose and visitors' applicable rules.
Decide which notices, choices and consent category your installation needs. These setup steps explain a consent-based installation; they do not establish an exemption.
- Put Attriboo behind the analytics choice.
Use your consent platform's script-blocking or tag-manager controls. Do not leave a second always-on installation in the theme, plugin or site-wide header.
- Load the script once after permission.
Use the code and website ID from Setup. Connect acceptance to window.attriboo.consent(true) and rejection or withdrawal to window.attriboo.consent(false). Apply the saved choice on every page. If you select external consent control in Privacy & data, your loader must block the script until permitted.
- Include identity and checkout code in the same review.
Check identify calls, goals, checkout metadata and server-side integrations too. A browser-script choice does not automatically control payment webhooks or API submissions.
- Make the choice easy to revisit.
Provide a visible way to reject or withdraw analytics and preserve the preference according to your consent platform's instructions.
Connect the real consent callback
Run this function from your consent manager when it has resolved the saved analytics choice and whenever that choice changes. Pass true only for an actual permitted choice. The page-only value handles a consent manager that runs before the deferred Attriboo script. Your consent manager remains responsible for persisting and applying the choice on future pages. The same recipe works with t.js and c.js.
function updateAttribooConsent(analyticsAllowed) {
var allowed = analyticsAllowed === true;
window.attribooConsent = allowed;
if (window.attriboo && window.attriboo.consent) {
window.attriboo.consent(allowed);
}
}
// In your CMP’s real ready/change callbacks:
// updateAttribooConsent(theSavedAnalyticsChoice);Handle withdrawal
Prevent the tracker from loading on future pages. If it is already running, window.attriboo.disable() stops its event sending in the current page. Removing a script element alone does not stop code and listeners that have already run.
The consent(false) and disable() calls stop events, remove the tracker's browser identifier on the current origin and matching cookie domains, undo tracker-added checkout link identifiers, remove the poll, and attempt to clear the active Shopify cart identifier. They do not erase earlier server records or identifiers already sent to a payment provider. Review other origins, checkout metadata, downloads and integrations separately.
When the visitor agrees again, call window.attriboo.consent(true). The tracker resumes with a fresh browser identifier without installing a second copy. Global Privacy Control and Do Not Track keep tracking off. Test this path as well as reloads and navigation.
if (window.attriboo) {
window.attriboo.disable();
}Test every choice on the published website
Test in a fresh browser profile, then repeat with a previously saved choice. If your policy handles browser privacy signals, verify those paths too. Do not bypass a visitor's rejected choice to make a connection test succeed.
| State | Check in the browser's Network and storage tools |
|---|---|
| Before a choice | No Attriboo collection requests or tracker-created identifier storage when consent is required. |
| Reject | No Attriboo events after navigation, reload, form submission or checkout interaction. |
| Accept | The script loads once, the expected visit arrives for the correct website, and only the intended identity features run. |
| Withdraw after accepting | Events stop immediately and after navigation/reload; relevant identifiers are removed. Check all tracked subdomains. |
| Grant permission again | The consent(true) callback resumes tracking once with a fresh identifier. Reloads still follow your saved choice. |
Do not copy Attriboo's own-site consent flag alone
The data-require-consent attribute is used by Attriboo's own consent integration and expects its specific stored choice. Adding that attribute alone does not create a consent interface or connect an unrelated consent manager. Customer websites should use the generic data-consent="required" code from Setup with the consent(true/false) callbacks, or gate loading through a tested external integration.
Attriboo's own-site controls disable optional analytics for Global Privacy Control and Do Not Track. The standard customer tracker also keeps analytics off for these signals. Configure other controls for the obligations and choices that apply.
Understand the effect on reports
Visitors who decline tracking may not have a recorded journey. Payments can still arrive through a connected provider without matching recorded visits. Consent choices, cleared storage and browser restrictions can all reduce attribution completeness; missing journeys do not by themselves mean the payment connection failed.
You are done when
A fresh visit, reject, accept, withdrawal and a later permission change all behave as intended on your published site.
Still need a hand?
Send a question without needing to sign in.