Skip to content

Latest commit

 

History

History
135 lines (100 loc) · 10.7 KB

consent-management.md

File metadata and controls

135 lines (100 loc) · 10.7 KB
title hidden related
Consent Management Overview
true
/privacy/account-deletion/
/privacy/complying-with-the-gdpr/

info "Consent Management is in private beta" This means that Consent Management features are in active development, and some functionality may change before it becomes generally available. Contact Segment{:target="_blank"} with any feedback or questions.

When an end user visits your site, they set consent preferences, or make decisions about the types of data they want you to collect, use, and share. These consent preferences are typically presented as a set list of categories that describe how your company intends to use that data. Common categories include personalization, advertising, and site performance.

Segment works with your third-party consent management platform (CMP) or bespoke consent solution to capture an end user's consent preferences and enforce those preferences by only routing events to the categories consented to by an end user.

Diagram outlining information flowing from an end user to Segment destinations

After a user sets their consent preferences, Segment captures them with the Analytics.js Consent Tools wrapper and updates the consent object. The events are then sent downstream to any streaming destinations in categories that a user consented to share data with.

info "" Segment collects consent for both registered users and anonymous users.

Enforce consent

Segment routes events with a consent object to the destinations in categories consented to by a user and to destinations that do not have a consent category.

If an end user changes the categories they consent to (or if they consent using a different device or identifier,) any events they generate after updating their consent preferences will contain the updated consent information. Segment only sends events to the destinations in the categories that are currently consented to.

warning "Segment recommends mapping all destinations to a category" Segment assumes any destinations without a mapping do not require user consent and will receive all events containing a consent object.

To learn more about configuring consent categories in your workspace, see the Configure Consent Management documentation.

Consent object

Segment requires every event from all of your sources to include the end-user consent preferences, captured by your consent management tools or your application logic, in the form of the consent object. The consent object is a JSON object with the following format:

{
"context": {
  "consent": {
    "consentPreferences": {
        "Advertising": true,
        "Analytics": false,
        "Functional": true,
        "DataSharing": false
      }
   }
  }
}

Reconcile consent conflicts

Segment resolves conflicts between your consent object and your integration object and between your CMP and the consent categories you configured in the Segment app.

Reconcile consent object and integrations object conflicts

You can add both the integrations object and the consent object to your Segment payloads for greater control over how Segment routes data to your downstream destinations.

success " " For more information about the Integrations object, please see Filtering your Segment Data.

If an event includes both an integrations and consent object, Segment will look at the consent object first, and then take into account the integrations object according to the following table:

Consent Object Integration Object Result
Not provided

"context": {
}
Not provided or empty object Data flows to all destinations
Empty consent object

"context": {
"consent": {
}
}
OR
"context": {
"consent": {
"categoryPreference": {
}
}
}
Not provided or empty object Data does NOT flow to any mapped destinations - consent is considered to be false for all categories.

Data flows to all destinations NOT mapped to a consent category.
Not provided

"context": {
}
{facebook: true,
amplitude: false}
Data flows to the destinations that are true in the integrations object (Facebook). Any metadata provided in the integrations object also flows to your downstream destinations.
Empty consent object

"context": {
"consent": {
}
}
OR
"context": {
"consent": {
"categoryPreference": {
}
}
}
{facebook: true,
amplitude: false}
Data does NOT flow to any mapped destinations - consent is considered to be false for all categories.

Data flows to all destinations NOT mapped to a consent category, destinations set to true in the integrations object, and destinations not included in the integrations object.
{ad: true,
analytics: false}

Segment has no category-to-destination mapping for ad and analytics
Provided, not provided, or empty object Data flows to all destinations, as all destinations are unmapped. If the integrations object is present, data flow may be impacted.
{ad: true,
analytics: false}

ad = facebook, google-ads
Not provided or empty object Data flows to destinations that map to a consented purpose. In this case, data flows to all ad destinations (Facebook and Google Ads).

No data flows to analytics destinations.
{ad: true,
analytics: false}

ad = facebook, google-ads
analytics = amplitude
{facebook: true,
amplitude: false}
Data flows to all ad destinations, even though Google Ads is not present in the integrations object.

Data does NOT flow to analytics destinations.
{ad: true,
analytics: false}

ad = facebook, google-ads
analytics = amplitude
{facebook: false,
amplitude: false}
Data only flows to Google Ads and not to Facebook, which is false in the integrations object.

Data does NOT flow to analytics destinations.
{ad: true,
analytics: false}

ad = facebook, google-ads
analytics = facebook, amplitude
{facebook: true,
amplitude: false}
When destinations are mapped to multiple categories, data only flows if consent is true for all categories. In this case, data only flows to Google Ads and not to Facebook.

Data does NOT flow to analytics destinations.
{ad: true,
analytics: true}

ad = facebook, google-ads
analytics = facebook, amplitude
{facebook: true,
amplitude: false}
When destinations are mapped to multiple categories, data only flows if consent is true for all categories. In this case, data flows to Google Ads and Facebook. No data flows to Amplitude because it is false in the integrations object.
{ad: false,
analytics: true}

ad = facebook, google-ads
analytics = facebook, amplitude
{facebook: true,
amplitude: false}
When destinations are mapped to multiple categories, data only flows if consent is true for all categories.

In this example, data does NOT flow to any destination because of the interaction between the integrations and consent objects.

Reconcile CMP and Segment consent category conflicts

If you have a category configured in your consent management tool (for example, advertising) and there is no category with the same ID in Segment, the data will flow to unmapped destinations. If destinations are mapped to a different category in the Segment app, data flow will honor end user consent for that category.

If there is a category configured in Segment (functional) that is not mapped in your CMP, data will not flow to destinations mapped to the functional category.

Consent observability

Events discarded due to consent preferences appear in Delivery Overview at the "Filtered at destination" step with the discard reason Filtered by end user consent.