The Consent Manager
The consent manager decides whether a visitor is asked about cookies, what they are asked, and what loads as a result.
Where to find it
Architect Panel → Security:
- Cookie Consent — categories, services, cookies, scans and records
Three modes
- Opt-in everywhere — every visitor is asked, and nothing non-essential loads until they agree. The strictest and the simplest to defend.
- By region — the treatment depends on where the visitor appears to be.
- Notice only — visitors are informed rather than asked.
How region is worked out
From a country header supplied by your infrastructure — the setting defaults to the one a common content delivery network provides. From that country the platform resolves a jurisdiction and a mode:
- United Kingdom — opt-in.
- European Economic Area — opt-in.
- Brazil — opt-in under its own regime.
- United States — opt-out.
- Elsewhere — notice.
When the region is unknown
There is a separate setting for that case, and it defaults to the strictest treatment. That default is correct and should generally be left alone.
The country header is not always present — a direct request, a different network path, a visitor behind something unusual. Falling back to opt-in means an unknown visitor is treated properly rather than tracked by default.
Opt-in everywhere is often the right choice
Region-based treatment is legitimate and it is more to maintain, more to explain and more to get wrong. If most of your visitors are in an opt-in jurisdiction anyway, treating everybody the same is simpler and defensible.
Consent must come before loading
The rule the whole system exists to implement. A tag that loads and then asks has already set its cookies and sent its request, and the banner is decoration.
Which is why third-party tags belong in the consent manager as services rather than being placed in a page template.
Withdrawal must be as easy as giving
A visible route to change a decision — conventionally a footer link. The platform can also sweep cookies when consent is withdrawn, which is what makes withdrawal mean something rather than being a recorded preference nothing acts on.
Test as a visitor
In a private window, with developer tools open, and look at what is set before you agree. That is the only test that matters and it takes two minutes.
Worked example
An organisation chose opt-in everywhere for simplicity, left the unknown-region fallback at its strictest, and enabled the cookie sweep on withdrawal. A private-window check before launch found an analytics cookie being set before any choice, because the tag was in a template rather than registered as a service.
Recommendations
- Opt-in everywhere unless you have a reason otherwise.
- Leave the unknown-region fallback strict.
- Register tags as services, never in a template.
- Check in a private window what loads before agreement.