Skip to content

User Consent

Part of the Human Scoring use case.

The SDK records how the user interacts with your page. Depending on where your users are and on your own privacy policy, you may need their permission before recording starts. The web SDK has a consent gate for this; it is off by default, so capture starts at init unless you turn it on.

The SDK does not draw a consent dialog. Your page asks the question, in its own words, and passes the answer to the SDK.

When to use it

  • Your users are in a jurisdiction that requires consent for behavioural data
  • Your consent management platform (CMP) already asks about analytics or fraud prevention

Prerequisites

Usage

import { init } from '@dea/sdk';

const dea = init({
  appId: 'YOUR_APP_ID',
  appKey: 'YOUR_APP_KEY',
  requireConsent: true,
});

With requireConsent: true, until the user agrees:

  • nothing is recorded or scored, and getClassification() answers 'insufficient';
  • resume() does not start recording: the gate is separate from pause();
  • the SDK downloads no scoring model, and ready() does not resolve. Do not wait for ready() before you ask.

Record the answer

dea.setConsent(true);  // the user agreed: recording starts
dea.setConsent(false); // the user declined, or withdrew: recording stops

setConsent(false) stops recording at once. The session and what was already scored in it are kept, so a later setConsent(true) continues it; call reset() as well to discard them.

The answer is kept in the browser's localStorage, under the key deapnetwork.consent, and restored at the next init. To keep the answer for the current page only — a shared or kiosk device — pass { remember: false }; what is already stored is left as it was:

dea.setConsent(true, { remember: false });

Ask only when nobody has answered

if (!dea.consent.isAnswered) {
  showConsentDialog(); // your own dialog, which calls dea.setConsent(…)
}

dea.consent.decision is 'unknown', 'granted' or 'denied'. dea.consent.isGranted is true only for 'granted'.

Keep the answer in your own store

To file the answer beside your consent platform's record instead of in localStorage, pass a consentStore:

import { init, type ConsentDecision } from '@dea/sdk';

init({
  appId: 'YOUR_APP_ID',
  appKey: 'YOUR_APP_KEY',
  requireConsent: true,
  consentStore: {
    read: (): ConsentDecision => myConsentRecord.dea ?? 'unknown',
    write: (decision) => { myConsentRecord.dea = decision; },
  },
});

Note: The gate holds back recording, scoring and the model download. It does not hold back calls your page makes: do not call attest(), which registers the browser's key with DEA, before the user agrees.

Note: On iPhone and iPad, the mobile profile asks the browser for motion-sensor permission at the user's first tap, and the browser shows its own prompt. The SDK asks even while the gate is closed. To avoid that prompt before consent, pass motionRate: 0, or call init only after the user agrees, as below.

If your page already waits for consent before loading tools like this one, call init only after the user agrees, and dispose() when they withdraw:

import { init, DeaSdk } from '@dea/sdk';

function onConsentGiven() {
  init({ appId: 'YOUR_APP_ID', appKey: 'YOUR_APP_KEY' });
}

function onConsentWithdrawn() {
  DeaSdk.current?.dispose(); // stops capture and drops anything not yet processed
}

Examples

import { init } from '@dea/sdk';

const dea = init({ appId: 'YOUR_APP_ID', appKey: 'YOUR_APP_KEY', requireConsent: true });

// Replace with your CMP's API.
cmp.onChange((consent) => {
  dea.setConsent(consent.fraudPrevention);
});

showConsentDialog, myConsentRecord and cmp stand for your own code.

API

Member Returns Description
init({ requireConsent: true }) DeaSdk Starts the SDK with the gate closed
setConsent(granted, options?) void Records the answer; { remember: false } keeps it to this page
consent.decision 'unknown' \| 'granted' \| 'denied' The current answer
consent.isAnswered boolean false until the user has answered
consent.isGranted boolean true when the answer is 'granted'
dispose() void Stops capture and releases the SDK