Skip to content

🎉 feat(consent): Add cross-SDK consent and profile-continuity controls#304

Merged
Charles Hudson (phobetron) merged 1 commit into
mainfrom
NT-3282_consent-concept-doc
Jun 4, 2026
Merged

🎉 feat(consent): Add cross-SDK consent and profile-continuity controls#304
Charles Hudson (phobetron) merged 1 commit into
mainfrom
NT-3282_consent-concept-doc

Conversation

@phobetron
Copy link
Copy Markdown
Collaborator

@phobetron Charles Hudson (phobetron) commented Jun 4, 2026

Summary

Adds consent-management support across the Optimization SDK Suite and documents how applications should map privacy policy decisions into SDK behavior. Also streamlines AGENTS.md files to reduce context overhead.

  • Adds split consent handling for event emission vs durable profile continuity with consent({ events, persistence }), while preserving boolean consent(true | false) as a shorthand for both.
  • Exposes states.persistenceConsent, adds PERSISTENCE_CONSENT_KEY, and gates profile, anonymous ID, selected optimization, and changes persistence behind persistence consent.
  • Refactors stateless Core/Node event calls behind forRequest(...), so each request binds consent, profile, shared event context, and Experience options before calling page, identify, trackView, etc.
  • Updates Web, React Web, React Native, iOS, Android, and the native JS bridge to restore profile continuity only when permitted, clear durable continuity when denied, and support split consent APIs.
  • Updates hybrid Node/Web and Next.js reference implementations to use application-owned consent cookies, render baselines before consent, and persist shared anonymous IDs only when continuity consent allows it.
  • Adds a cross-SDK consent concept guide and refreshes package READMEs/guides with default-on, strict opt-in, split-consent, revocation, and server/browser alignment guidance.
  • Expands test coverage for consent gating, storage restore/clear behavior, request-bound stateless calls, native storage, and baseline-before-consent flows.

Notable API/behavior changes

  • New/updated exports include ConsentInput, CoreStatelessRequest, request-scoped stateless types, EventType, PERSISTENCE_CONSENT_KEY, and states.persistenceConsent.
  • Node/stateless direct event methods now use forRequest(...).page()/identify()/....
  • Core now fails closed by default; platform SDKs provide their runtime-specific pre-consent allowlists.

[NT-3282]

@wiz-inc-38d59fb8d7
Copy link
Copy Markdown

wiz-inc-38d59fb8d7 Bot commented Jun 4, 2026

Wiz Scan Summary

Scanner Findings
Vulnerability Finding Vulnerabilities -
Data Finding Sensitive Data -
Secret Finding Secrets -
IaC Misconfiguration IaC Misconfigurations -
SAST Finding SAST Findings 5 Low
Software Management Finding Software Management Findings -
Total 5 Low

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

@phobetron Charles Hudson (phobetron) force-pushed the NT-3282_consent-concept-doc branch 3 times, most recently from 2188be9 to 58ced15 Compare June 4, 2026 17:33
**Summary**

Adds consent-management support across the Optimization SDK Suite and documents how applications should map privacy policy decisions into SDK behavior.

- Adds split consent handling for event emission vs durable profile continuity with `consent({ events, persistence })`, while preserving boolean `consent(true | false)` as a shorthand for both.
- Exposes `states.persistenceConsent`, adds `PERSISTENCE_CONSENT_KEY`, and gates profile, anonymous ID, selected optimization, and changes persistence behind persistence consent.
- Refactors stateless Core/Node event calls behind `forRequest(...)`, so each request binds consent, profile, shared event context, and Experience options before calling `page`, `identify`, `trackView`, etc.
- Updates Web, React Web, React Native, iOS, Android, and the native JS bridge to restore profile continuity only when permitted, clear durable continuity when denied, and support split consent APIs.
- Updates hybrid Node/Web and Next.js reference implementations to use application-owned consent cookies, render baselines before consent, and persist shared anonymous IDs only when continuity consent allows it.
- Adds a cross-SDK consent concept guide and refreshes package READMEs/guides with default-on, strict opt-in, split-consent, revocation, and server/browser alignment guidance.
- Expands test coverage for consent gating, storage restore/clear behavior, request-bound stateless calls, native storage, and baseline-before-consent flows.

**Notable API/behavior changes**

- New/updated exports include `ConsentInput`, `CoreStatelessRequest`, request-scoped stateless types, `EventType`, `PERSISTENCE_CONSENT_KEY`, and `states.persistenceConsent`.
- Node/stateless direct event methods now use `forRequest(...).page()/identify()/...`.
- Core now fails closed by default; platform SDKs provide their runtime-specific pre-consent allowlists.

[[NT-3282](https://contentful.atlassian.net/browse/NT-3282)]
@phobetron Charles Hudson (phobetron) merged commit bb2b6ab into main Jun 4, 2026
70 of 71 checks passed
@phobetron Charles Hudson (phobetron) deleted the NT-3282_consent-concept-doc branch June 4, 2026 18:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant