Consent

Sourcream supports three consent modes, set per site under Sites, your site, Settings, Consent mode. The setting is built into the script, so you do not need to change the script tag.

This page explains the technical behaviour. It is not legal advice; check your obligations under the Australian Privacy Principles, the GDPR or other law that applies to you.

What happens before consent

Until consent is granted (Required mode), or while analytics_storage is denied (Google Consent Mode), the script runs in memory only mode:

• no cookies are read or written and nothing is sent to Sourcream;
• forms still get this visit's values (first touch equals last touch equals this visit), so a lead submitted without consent still carries its source in the hidden fields to your form tool;
• the browser does not report the submission to Sourcream, so it only reaches Sourcream if your form also posts to the webhook intake (Zapier, Monday.com and webhooks).

When consent is granted, the script starts normally on the same page: it writes its cookies, contacts our servers and refills the forms. Withdrawing consent deletes the _sc_* cookies the script can access and stops all further calls. The server set _sc_id cookie (first-party proxy only) is HttpOnly, so scripts cannot remove it; it expires on its own and is not read while consent is withdrawn.

Required mode

Grant or withdraw consent from your banner's callbacks:

// Visitor accepted analytics or marketing cookies
window.Sourcream && Sourcream.consent(true);

// Visitor declined or withdrew
window.Sourcream && Sourcream.consent(false);

If your banner knows the answer before the Sourcream script loads (a returning visitor who already accepted), set this before the script tag:

<script>window.SourcreamConsent = true;</script>
<script src="https://cdn.sourcream.ai/t/YOUR_SITE_KEY.js" async></script>

Because the script loads async, the callback may run before window.Sourcream exists. A safe pattern is to set the flag and call the API when it is there:

function sourcreamConsent(granted) {
  window.SourcreamConsent = granted;
  if (window.Sourcream) Sourcream.consent(granted);
}

Most consent platforms (Cookiebot, OneTrust, CookieYes, Complianz and others) can run a snippet like this on accept and on decline. Classify Sourcream as analytics or marketing, whichever category your policy uses for attribution.

Google Consent Mode

With this mode the script reads the analytics_storage value of the Consent Mode commands in window.dataLayer, and follows later commands as your banner pushes them. 'granted' runs normally; 'denied' keeps the script in memory only mode.

• An update always beats a default, whatever order they arrive in. The latest update decides.
• Without an update, the latest default that has no region decides, unless a region specific default denies (below).
• With no analytics_storage command at all, the script waits in memory only mode.

// Typical setup, set by your banner or GTM before tags run
gtag('consent', 'default', { analytics_storage: 'denied', ad_storage: 'denied' });

// After the visitor accepts
gtag('consent', 'update', { analytics_storage: 'granted' });

Make sure your banner sets the default state before the Sourcream script runs (the normal Consent Mode setup), so the script never stores anything before a choice is known.

Region specific defaults

Consent Mode lets a default apply to some regions only, for example denied in the EEA and the UK and granted everywhere else:

gtag('consent', 'default', { analytics_storage: 'denied', region: ['AT', 'BE', 'DE', 'FR', 'GB'] });
gtag('consent', 'default', { analytics_storage: 'granted' });

Google applies the most specific default that matches the visitor's location. The Sourcream script cannot tell which region a visitor is in, so it never guesses:

• A region specific default that denies analytics_storage keeps every visitor in memory only mode until your banner pushes an update, in whichever order the defaults arrive. Visitors in the listed regions are never tracked before they choose.
• A region specific default that grants never grants on its own. Only a default without region, or an update, can.

So with region specific defaults, have your banner push gtag('consent', 'update', { analytics_storage: ... }) for every visitor once it knows the answer, including the visitors outside the listed regions who never see a banner. Most consent platforms do this on every page load. If yours does not, visitors outside those regions stay in memory only mode: forms still get this visit's values, but nothing is stored and the browser does not report submissions. In that case use Required mode and call Sourcream.consent(true) from the banner's callbacks instead.

Letting the consent tool block the script

Instead of a consent mode, you can let your consent tool block the script tag until consent (for example type="text/plain" with the tool's category attribute, or the tool's automatic blocking). That also works, with one difference: before consent there is no script at all, so forms get no hidden values. Consent modes keep the hidden values and only hold back storage and network calls.

What Sourcream stores

• In the browser: the first-party cookies listed in Custom HTML sites. No third-party cookies.
• On our servers: a visitor record (visitor ID, first and last touch, up to 50 touches) for 180 days after the last visit, and each lead. Contact details on leads (email, name, phone, company and other captured fields) are redacted after the account's retention period (Settings, PII retention days; 30 days by default) once delivery to your CRMs has finished.
• With Capture mode set to None, no form contents are sent to Sourcream at all. Match CRM records by visitor ID instead.

Questions: [email protected]