What consent gates

An admin sets the signal source in Connect your consent platform. This page covers what your website has to do, and precisely what is gated.

Your job on the page

Write the visitor’s decision to the JavaScript global named in your settings. The default is window.__consent.

// granted
window.__consent = { analytics: true, marketing: true, necessary: true, version: "2.1" };

// denied
window.__consent = { analytics: false, marketing: false, necessary: true, version: "2.1" };

A plain boolean works too: window.__consent = true. The tag reads the value like this:

Value	Read as
`true`	Granted
`false`	Denied
`{ analytics: true, … }`	Granted
`{ analytics: false, … }`	Denied
Anything else, or nothing yet	Not answered. The tag keeps waiting

The full documented shape is { analytics, marketing, necessary, version }. Only analytics is read. The others are accepted and ignored, so writing the whole object now is safe.

The tag walks the signal path property by property from window, so window.__consent, __consent, and window.myCmp.state.consent all work. A path with a function call or an operator in it does not, because the path is never run as code.

Set it as early as you can, ideally before the allGood tag loads. A value already present means no waiting at all.

OneTrust

<script>
  function agSyncConsent() {
    // C0002 is OneTrust's default Performance/Analytics category.
    var groups = window.OnetrustActiveGroups || "";
    window.__consent = {
      analytics: groups.indexOf("C0002") !== -1,
      marketing: groups.indexOf("C0004") !== -1,
      necessary: true,
    };
  }
  window.OptanonWrapper = function () { agSyncConsent(); };
  window.addEventListener("OneTrustGroupsUpdated", agSyncConsent);
</script>

Check your own OneTrust configuration for the right category ids — C0002 and C0004 are the defaults, but they’re editable.

Cookiebot

<script>
  function agSyncConsent() {
    var c = window.Cookiebot && window.Cookiebot.consent;
    if (!c) return;
    window.__consent = {
      analytics: !!c.statistics,
      marketing: !!c.marketing,
      necessary: true,
    };
  }
  window.addEventListener("CookiebotOnAccept", agSyncConsent);
  window.addEventListener("CookiebotOnDecline", agSyncConsent);
  window.addEventListener("CookiebotOnLoad", agSyncConsent);
</script>

Anything else

Set the provider to Custom, keep the signal source as it is, and write the same object from your own banner’s callbacks.

What the tag does, precisely

With No tracking before opt-in on, which is the default:

something happens (page view, identify, track)
   → held in memory rather than sent
   → read the consent signal
        granted   → send everything held, and send normally from now on
        denied    → throw away what was held, and send nothing more this page load
        no answer → keep checking, a couple of times a second
                      answered within half a minute → as above
                      still nothing → drop what was held

Four consequences worth designing around:

A denial sticks for that page load. A later yes doesn’t restart it. A real visitor who changes their mind gets a fresh tag on their next page load, which is why this is acceptable — and it means pre-decision browsing is never delivered late, which is the point.
Nothing is lost on a yes. Everything held is sent, so a page view that happened before the banner was answered still arrives.
What’s held is finite. On a page that fires a great many events before consent is answered, the oldest are dropped.
Silence eventually gives up. If your platform never writes the value — wrong path, banner that never loads — the tag holds, then quietly stops. This is the “nothing is recorded, no errors” case.

With the setting off, none of the above applies: events send immediately.

The gating matrix

Surface	Gated?	Notes
Page views from the tag	Yes	Held until granted
`identify()`	Yes	Same
`track()`	Yes	Same
Events sent to the API directly	Yes	Refused without evidence of consent
Form submission via the tag	No	Always sent
Form submission via the API	No	Never refused for consent
A hosted allGood landing page	Yes	Tracked by the tag on the page, like your own site. Serving the page records nothing and sets no `_ag_id`
Variant cookie on a routed page (`_ag_v_…`)	No	Session-only. Holds the variant label, never an identity
A tracked email click	No	Works without consent; the link has to go somewhere

Why forms aren’t gated

A submission is an explicit action by the visitor. Form processing rests on a different lawful basis from analytics consent, and refusing a lead because someone declined analytics cookies would be the wrong behaviour. What forms do carry is the evidence: the exact consent statement the visitor was shown, stamped onto the record by allGood rather than supplied by the page. See Keep evidence of what visitors agreed to.

A landing page that allGood hosts is tracked only by the tag it loads, so the gate applies there exactly as on your own site. Serving the page records no view and sets no _ag_id. A hosted page that doesn’t load the tag isn’t tracked at all, and publishing it shows a warning.

Property	Value
Name	`_ag_id`
Value	A random identifier containing nothing about the person
Domain	Your allGood subdomain only
Lifetime	One year
Set by	allGood only, never by page script
Readable by your JavaScript	No

It proves a browser reached an allGood surface before. It does not prove anyone consented, which is why the two checks are separate.

Testing the gate

The hosted test page has Grant, Deny and Clear buttons that write the consent global exactly as a real banner would. Use them to watch events hold, then flush.

Marketing Kernel

Platform

Developer

Enterprise

Settings

Your job on the page

OneTrust

Cookiebot

Anything else

What the tag does, precisely

The gating matrix

Why forms aren’t gated

Testing the gate

Your job on the page

OneTrust

Cookiebot

Anything else

What the tag does, precisely

The gating matrix

Why forms aren’t gated

The identity cookie

Testing the gate