> ## Documentation Index > Fetch the complete documentation index at: https://help.maestra.io/llms.txt > Use this file to discover all available pages before exploring further. # Tracking Consent in Maestra Platform > How a visitor's cookie-banner choice is stored on the customer profile, where to see it, and how to find customers by it. When a visitor answers your cookie banner, Maestra Platform can keep that choice on the customer profile as evidence: what the visitor chose, on which browser and site, when, and through which consent tool. You can then see the choice on the customer card and find customers by it with filters. This article covers what is stored and where to find it. To set up the banner integration itself, see [Consent and Tracking](https://help.maestra.io/api-integrations/consent-and-tracking.md). > [!NOTE] > > **Available on request.**\\ > > Storing consent on the profile is turned on per account by the Maestra Platform team. It isn't a self-service setting. To turn it on, contact support or your Maestra Platform Forward Deployed Marketer. ## Before you start Maestra Platform records a choice only when the tracker knows about consent: * **Maestra Shopify app.** The app embed passes choices automatically. See [Shopify notes](#shopify-notes). * **Your own site or a tag manager.** The `create` call must have a `consent` block, and your consent tool must call `consent.set` when the visitor answers. See [Set up consent with JavaScript](https://help.maestra.io/api-integrations/consent-and-tracking.md#set-up-consent-with-javascript). Without a `consent` block in `create`, the tracker tracks every visitor as before and records no consent. ## What gets recorded The tracker reports **explicit choices** only: | Event | When it's sent | | - | - | | The visitor grants consent | Right after the tracker registers the visit, so the record carries the browser's device ID. | | The visitor withdraws consent | Just before the tracker deletes its identifiers from the browser. This is the only request sent after a withdrawal. | | Global Privacy Control is on | A separate sale-of-data opt-out. See [Global Privacy Control](#global-privacy-control). | | A saved choice was never sent | If the page closed before a choice reached Maestra Platform, the tracker sends it once on the next page. It shows as **Stored choice**. | These aren't recorded: * **Regional defaults.** A state that comes from the `default` in `create` (for example, a region where your store shows no banner) is not the visitor's choice and is never sent. * **Repeats.** A choice identical to the one already stored changes nothing on the profile. You can call `consent.set` on every page. * **A decline on the first visit.** A visitor who declines before ever accepting has no device ID, and none is created. There is nothing to attach the choice to. > [!NOTE] > > Recording consent never creates a customer, never changes email or SMS subscriptions, and isn't triggered by a form submission. ## What is stored on the profile ### Consent purposes Each choice can carry four purposes, each **granted** or **denied**: | Purpose | What it covers | | - | - | | **Analytics** | Measuring visits and site usage. | | **Marketing** | Personalization and marketing based on the visitor's interests on your site. | | **Preferences** | Remembering the visitor's settings. | | **Advertising** | Passing the visitor's data to advertising platforms. | **Tracking consent** is analytics and marketing together: it's granted only when both are granted. Advertising is stored separately and never affects tracking consent. **Sale of data** is a separate value: **opted out** when the visitor (or their browser, through [Global Privacy Control](#global-privacy-control)) refuses the sale or sharing of their data. ### Consent state per browser and site Maestra Platform keeps the current consent for every combination of customer, browser, and site. A customer who uses two browsers, or visits two of your sites, has a separate state for each. The state changes only when the choice changes. ### System actions Every change adds one of three system actions to the customer's activity feed: | Action | When | | - | - | | **Tracking consent granted** | The visitor grants tracking consent, or changes purposes while tracking stays granted. | | **Tracking consent withdrawn** | The visitor withdraws tracking consent, or changes purposes while tracking stays denied. | | **Sale of data opt-out (GPC)** | The visitor's browser sends Global Privacy Control, and the sale of their data becomes opted out. | The actions are in the **Personal** category. They carry these custom fields: | Field | Values | | - | - | | **Tracking consent: source** | `platform` — a consent banner or consent tool; `api` — a direct `consent.set` call; `gpc` — Global Privacy Control; `stored` — a saved choice sent on a later page. | | **Tracking consent: consent platform** | The consent tool that reported the choice, such as `shopify` or `pieeye`. Empty when the tool didn't say. | | **Tracking consent: device** | The browser's device ID. | | **Tracking consent: sale of data** | `granted` or `denied`. | | **Tracking consent: analytics**, **marketing**, **preferences**, **advertising** | `granted` or `denied` for each purpose. A purpose the consent tool didn't send is left empty. | The action date is the moment the visitor made the choice, not the moment Maestra Platform received it. ### Change history Each change also adds a **Consent changed** entry to the customer's change history, with the browser, the site, the source, and the old and new values. ## Where to see it in the customer card **1. Open the customer** Go to **Customer Data Platform** → **Customers** and open the customer's profile. **2. Open the browsers list** Go to **Devices** → **Browsers**. The **Tracking consent** column shows **Granted**, **Withdrawn**, or **No data** for each browser. **3. Expand a browser** The **Tracking consent** group shows: * **Changed** — when the visitor made the choice. * **Source** — where the choice came from, for example **Platform banner · Shopify**, **consent.set API**, **Stored choice**, or **GPC**. * **Sale of data** — **Opted out (GPC)** or empty. * **Purposes** — the analytics, marketing, preferences, and advertising values. The consent actions are also in the customer's activity feed, and each change is in the change history. ## Find customers by consent Two filter conditions are available for customers. | Condition | Value | Matches customers who… | | - | - | - | | **Tracking consent** | **Granted** | granted tracking consent on at least one browser and site. | | | **Withdrawn** | made a choice, and no browser or site has tracking consent granted. | | | **No data** | never made a tracking choice. | | **Sale of data** | **Opted out** | opted out of the sale of data on at least one browser and site, by choice or through Global Privacy Control. | | | **No data** | never opted out. | To build a filter: **1. Open the filter** Go to **Customer Data Platform** → **Customers** and add a condition. **2. Pick the condition** Search for **Tracking consent** or **Sale of data**. **3. Pick the value** For example, choose **Granted** to build a segment of customers you may track on your site. > [!TIP] > > To find customers who granted tracking but refused the sale of their data, combine **Tracking consent** is **Granted** AND **Sale of data** is **Opted out**. For filter basics, see [How to Create Filters](https://help.maestra.io/filters/how-to-create-filters.md). ## Global Privacy Control Global Privacy Control (GPC) is a browser setting that tells websites not to sell or share the visitor's data. The tracker reads it from `navigator.globalPrivacyControl`. When GPC is on and tracking is granted, the tracker sends a separate opt-out with source `gpc`. The profile gets the **Sale of data opt-out (GPC)** action, and the browser's **Sale of data** shows **Opted out (GPC)**. GPC changes only the sale of data. It doesn't change tracking consent or the purposes. GPC is sent even when tracking is granted only by the regional default. It isn't sent again once the sale of data is already known for that browser, and it can't be recorded for a visitor who hasn't granted tracking. ## Anonymous visitors A visitor who grants consent before you know who they are (before they sign in, subscribe, or place an order) has no customer profile yet. Maestra Platform keeps their choices for **30 days** without creating a profile. When the browser is identified within those 30 days, the choices are attached to the customer's profile in the order the visitor made them, with their original dates. A later choice wins over an earlier one. Choices older than 30 days are dropped. ## Shopify notes The Maestra app embed reads the visitor's answer from Shopify's Customer Privacy API and passes it to the tracker with provider `shopify`: | Shopify purpose | Maestra Platform purpose | | - | - | | Analytics | Analytics | | Marketing | Marketing | | Preferences | Preferences | | Sale of data | Sale of data | | — | Advertising: granted when marketing is granted and the sale of data isn't denied | Shopify has no separate advertising purpose. Its marketing purpose covers the merchant's own ads, and its sale-of-data purpose covers sharing with third parties for advertising. That's why advertising needs both. For PieEye, the embed reads PieEye's categories with provider `pieeye`: | PieEye category | Maestra Platform purpose | | - | - | | Performance | Analytics | | Targeting/Advertising | Marketing, advertising, and sale of data | | Preferences or Functionality | Preferences | On Shopify, an answer counts as a choice when the visitor refused analytics or marketing, or accepted both. Anything else is the regional default: it goes to the tracker only as the `create` default and is never recorded. A choice the visitor made on an earlier page (or at checkout) is recorded too, unless the tracker already remembers a choice in its cookie. ## Limits * **Available on request.** The feature is turned on per account by the Maestra Platform team. * **30 days for anonymous visitors.** Choices of a visitor who isn't identified within 30 days aren't kept. * **Browser cookie lifetime.** The tracker remembers the choice in the `maestraConsent` cookie for up to a year, but Safari and other browsers with tracking prevention delete cookies set by scripts after about 7 days. A returning visitor may then see the banner again. Answering it again doesn't create duplicate actions, because a choice identical to the stored one is ignored. See [Cookies and Browser Storage](https://help.maestra.io/api-integrations/cookies-and-browser-storage.md#consent-cookie). * **Sent, not confirmed.** The tracker sends a choice and doesn't wait for an answer. A request lost by the network leaves the choice off the profile. * **Deleted customers.** Deleting a customer deletes their consent records too. ## Related * [Consent and Tracking](https://help.maestra.io/api-integrations/consent-and-tracking.md) — consent modes and how to pass the visitor's choice to the tracker. * [Cookies and Browser Storage](https://help.maestra.io/api-integrations/cookies-and-browser-storage.md) — what the tracker keeps in the browser. * [What is a DeviceUUID?](https://help.maestra.io/api-integrations/what-is-a-deviceuuid.md) — the device ID used for each browser. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.