Cookie consent bannerCompliance scannerPrivacy policy generator
GuidesIndustriesAgenciesPricing
Log inStart for free

Developers

Documentation

Everything to install Consorm, manage consent and integrate your tools, from the first script to exporting the records.

Banner

The JavaScript API

Control the banner from your code: reopen the preferences, read the consent state, condition your own scripts and react to decisions through the dataLayer.

Once loaded, the banner exposes a global window.__cmp object on every page. It lets you open the banner or the preference center from your own interface elements and read the current consent state: useful, for example, for a "Manage my cookies" link in your footer.

Methods

MethodEffect
__cmp.showPreferences()Opens the preference center, where the visitor changes or withdraws their consent, and hides the notice.
__cmp.showBanner()Shows the initial consent notice again and closes the preference center.
__cmp.hideBanner()Hides the notice and the preference center.
A "Manage my cookies" link in your footer
<a href="#" onclick="window.__cmp && __cmp.showPreferences && __cmp.showPreferences(); return false;">
  Manage my cookies
</a>

The banner may not be loaded yet

window.__cmp exists from the bootstrap script onwards, but the three methods are only attached once the banner is displayed, and never under the "No banner" regime. Test for the presence of the method itself before calling it, as in the example above.

Reading the consent state

The __cmp object also carries the current state, read-only:

PropertyContent
__cmp.consentThe state of the non-necessary categories, for example { functional: false, analytics: true, advertisement: false }. Necessary categories are not listed: they are always active.
__cmp.catsThe keys of the non-necessary categories configured for the site.
__cmp.readytrue when the banner is initialized.
__cmp.regimeThe regime applied to the visitor according to their location: an object with mode (opt-in, opt-out, notice-only or none), ui, honorGpc, gpcApplied.
__cmp.gpcAppliedtrue if a Global Privacy Control signal was honored.
__cmp.debugSet it to true to show the banner's [cmp] logs in the console.
Example: show a module only if analytics is consented
if (window.__cmp && __cmp.ready && __cmp.consent.analytics) {
  // the visitor accepted the Analytics category
  loadMyModule();
}

Conditioning your own scripts and content

Without writing JavaScript, you can attach a script or a page element to a category directly in your HTML:

  • A <script type="text/plain" data-consent="analytics"> is only executed once the analytics category is accepted (replace with the key of the category you want).
  • Any element carrying data-consent="advertisement" stays hidden as long as the category is not consented, thanks to the cmp-no-<key> class set on <html>.
  • Iframes blocked by the URL patterns are replaced by a .cmp-placeholder block, which you can style; blocked scripts, iframes and images are reinjected on acceptance.

For tags managed in Google Tag Manager with the template, see Your tags with the GTM template instead.

The csm_consent cookie

The visitor's decision is kept in a single first-party cookie, csm_consent, valid for 365 days, set with SameSite=Lax (and Secure over HTTPS) on your site's registered domain: it therefore also applies to your subdomains. Its value is an encoded JSON object:

FieldMeaning
idThe visitor's consent identifier (csm_ prefix), the one that appears in the record.
vThe fingerprint of the configuration published at the time of the choice (the record's policy version).
cThe detail per non-necessary category (true / false).
aThe action: accept_all, reject_all or save_preferences.
tThe decision's timestamp (milliseconds since the epoch).

Reacting to decisions (dataLayer)

There is no callback subscription API: the integration goes through Google Tag Manager. On every decision, the banner pushes the Consent Mode update into the dataLayer. It also pushes the csm_consent_update event there when a category has just been granted, and on each page load for a visitor whose choice is already recorded. A custom event trigger on that name fires a tag as soon as a visitor consents: it is how the tags of the automatic installation fire without a reload.

What the banner pushes after an acceptance (simplified)
// 1) the Consent Mode update, through gtag()
gtag("consent", "update", {
  analytics_storage: "granted",
  ad_storage: "denied",
  ad_user_data: "denied",
  ad_personalization: "denied",
  /* … every Consent Mode v2 signal */
});
// 2) then, if a category has just been granted
window.dataLayer.push({ event: "csm_consent_update" });