Consent and CMP
How the widget reads consent from your consent management platform, the supported CMPs and category mappings, and manual mode.
The chat itself is a service the shopper asks for, so it works without consent (strictly necessary). Optional features need consent:
| Category | Used for |
|---|---|
| Preferences | Continuing a conversation in a new tab, remembering proactive message cooldowns |
| Analytics | A device-level visitor id for returning-visitor analytics and assisted-session attribution |
| Marketing | Nothing in the widget itself; newsletter sign-ups have their own explicit consent in the form |
Nothing is written to the shopper's device before they open the chat (storage disclosure).
Supported CMPs
With Privacy → Consent tool set to Automatic, the widget detects the first of these on the page:
| CMP | Detected by | Mapping |
|---|---|---|
| Shopify Customer Privacy | Shopify storefronts | Fixed |
| IAB TCF v2.2 (any TCF CMP) | __tcfapi | Preferences = purpose 1; analytics = 1 and 8; marketing = 1, 3 and 4 (overridable) |
| Cookiebot | Cookiebot | Fixed (statistics → analytics) |
| OneTrust | OnetrustActiveGroups | C0003, C0002, C0004 (overridable) |
| CookieYes | getCkyConsent | functional, analytics, advertisement (overridable) |
| Usercentrics | __ucCmp / UC_UI | Requires a category map |
| WP Consent API | wp_has_consent | Fixed |
| Magento cookie restriction | data-cookie-restriction="1" | Accepted → all; otherwise none |
Consent changes apply immediately: keys of withdrawn categories are deleted.
Category map
For CMPs with custom categories, map them in Privacy → Consent tool → Category map, for example {"analytics": ["C0002"], "preferences": ["C0003"]}. A purpose is granted only when all listed categories are granted. Usercentrics needs a map (cmp_category_map_required otherwise).
Without a CMP
Without a CMP decision, the default is "no optional consent" for visitors in the EEA, UK, Switzerland or an unknown region. Outside those regions you can choose to allow preferences and analytics by default. Global Privacy Control (Sec-GPC) turns analytics and marketing off when no CMP has decided.
Manual mode
Set data-consent="managed" (or Consent tool → Manual) and call setConsent from your own consent code:
ShopAssist.setConsent({ preferences: true, analytics: false, marketing: false })Last updated on