Consent & privacy

Privacy-first by default: before analytics consent, visitors still get a consistent experience — but nothing is stored and nothing is measured.

The cookieless default

With a consent policy configured, an unconsented visitor is assigned and served a variant using a per-request ephemeral id — consistent rendering, zero measurement. No identity cookie is set, no exposure is emitted, and the browser bridge stays silent. The moment a granting consent value appears, full measurement resumes: durable identity, exposures, conversions.

edge worker

createEdgeApp({
  // …
  consent: { cookieName: "cookie_consent" },  // e.g. your CMP's category cookie
})

Modes

Mode	Pre-consent behaviour
`cookieless`	(default) assign + transform with an ephemeral id; no cookie, no events
`off`	pass the origin through untouched — no experiments at all until consent
`on`	always measure, except when GPC / DNT signals are present

Sec-GPC and DNT are honoured as denial signals. The served response carries x-sz-consent so you can verify the decision per request.

What's stored

Exposures carry a random uid, URL, and coarse dimensions (device class, country). Conversions carry the metric name, optional value, and the same uid. Patch-health diagnostics are fully anonymous — no user identifier at all. Everything lives in your collector on your infrastructure; ShiftZero has no third-party data path.