Consent and CMPs

Three modes

Mode	Device storage	Identifiers	What is sent
full	_ah_id, _ah_s cookies	Persistent visitor ID, hashed user ID if provided	Everything
cookieless	Nothing	The collector derives a visitor ID that changes every day	Pages, events, same-day sessions and funnels, agent detection. Reduced device details.
none	Nothing	None	One anonymous ping per page view (URL and referrer only)

Defaults: cookieless before any signal (consent), cookieless after a refusal (deniedMode; set it to none for a stricter setup). Moving down from full deletes every identifier immediately. Events queued under the previous mode are sent with the previous mode's rules before the switch.

Your consent banner (CMP)

With cmp: true (the default), the tag reads your CMP on its own:

CMP	How consent is read
IAB TCF v2.2 (also Sirdata, Didomi, Quantcast and other TCF CMPs)	Analytics = purpose 1 + one of 8, 9 or 10. Ads = 1 + 3 + 4. Personalization = 5 + 6.
Google Consent Mode v2	gtag('consent', 'default' | 'update', …): analytics_storage, ad_storage, ad_user_data, ad_personalization
Didomi	Purposes matched by name
OneTrust	C0002 = analytics, C0004 = ads, C0003 = personalization
Axeptio	Vendor key ah_analytics (change with axeptioVendor)
Cookiebot	statistics, marketing, preferences
Matomo / Piano	Matomo consent calls (setConsentGiven…) and pa.privacy.setMode

Setting consent yourself

eureka('consent', 'granted')                 // analytics granted => full
eureka('consent', 'denied')                  // => deniedMode
eureka('consent', { analytics: true, ads: false, personalization: false })
eureka('consent', 'cookieless')              // force a mode

Browser signals

Global Privacy Control is respected by default (respectGpc: true); Do Not Track is opt-in (respectDnt: true). These signals make the denied mode the default; an explicit grant from your CMP still wins.

Opt-out link

Give visitors a way to object, for example in your privacy policy:

<button onclick="eureka('optout')">Stop audience measurement on this site</button>

eureka('optout') stops collection, deletes Eureka's cookies and sets a strictly necessary _ah_optout cookie for 13 months. eureka('optin') reverses it.

See Privacy and GDPR for the CNIL exemption setup and data subject requests.