consent-management

Consent Management

Integrate or modify consent handling for GA4 Consent Mode v2. Use when launching in a consent-required market (EU/EEA, UK, Brazil LGPD, etc.), integrating a Consent Management Platform (CMP), or modifying the default consent posture.

Current state

Consent defaults to granted in src/lib/analytics.ts. No CMP is integrated. This is appropriate when the target market has no legal requirement for prior user consent before analytics tracking.

When to change

You must switch to a consent-denied default when any of these apply:

• Launching in the EU/EEA or UK (GDPR / ePrivacy Directive)
• Launching in Brazil (LGPD)
• Launching in a jurisdiction with similar consent-before-tracking laws
• Your organisation's privacy policy requires opt-in consent regardless of market

Migration guide — adding consent management

Step 1: Change the default consent posture

In src/lib/analytics.ts, inside init(), replace the granted defaults:

// Before (current — consent granted by default)
gtag('consent', 'default', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
})

// After (consent denied until user grants)
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500, // ms to wait for CMP to load
})

Step 2: Integrate a CMP

Choose one of the following approaches:

Option A: Third-party CMP (recommended for production)

Popular CMPs with Google Consent Mode v2 support:

• Cookiebot — automatic geo-detection, plug-and-play script tag
• OneTrust — enterprise-grade, geo-specific banner rules
• Usercentrics — strong EU compliance, Google CMP partner
• Cookie Information — simple setup, Google-certified

These CMPs automatically call gtag('consent', 'update', {...}) when the user interacts with the banner. No custom code needed beyond loading their script.