Vendor consent

How vendor consent works

A visitor allows marketing, then switches off X Pixel. Other marketing scripts load; X Pixel does not. c15t loads a script, network request or iframe that names a vendor only when both are true:

• Its category is allowed.
• The visitor has not switched its vendor off.

A vendor switch never grants a category. With marketing denied, X Pixel stays blocked whatever its own switch says. You do not need IAB TCF for this. Under an iab policy, c15t ignores vendor slugs and takes vendor consent from the TC string instead; see IAB TCF.

Declare the vendors

Built-in @c15t/integrations helpers already list their vendor by name, so you only declare a vendor for a script of your own, or to replace a helper's name and privacy policy.

Add vendors to the c15t() integration in astro.config.mjs. Each entry uses the vendor slug its script already carries:

vendors: [
	{
		category: 'measurement',
		description: 'Product analytics and session insights.',
		id: 'posthog',
		name: 'PostHog',
		privacyPolicyUrl: 'https://posthog.com/privacy',
	},
	{
		category: 'measurement',
		description: 'Embedded videos.',
		id: 'youtube',
		name: 'YouTube',
		privacyPolicyUrl: 'https://policies.google.com/privacy',
	},
	{
		category: 'marketing',
		description: 'Ad conversion tracking.',
		id: 'x-pixel',
		name: 'X Pixel',
		privacyPolicyUrl: 'https://x.com/en/privacy',
	},
],

Vendor entries are plain data, so they survive the JSON serialization the integration options go through and can sit in astro.config.mjs next to mode. The server also asks about the categories these vendors sit in, so a vendor in marketing puts marketing in the banner decision and the preference dialog.

Vendor fields

The id must match the vendor slug on the script. Every @c15t/integrations helper sets vendor to its script ID, so xPixel() is x-pixel, gtag() is gtag and cloudflareZaraz() is cloudflare-zaraz. Each vendor guide names its slug.

You don't need to declare a helper's vendor. Each helper also sets vendorDetails on its script: the vendor's name, privacy policy, homepage and legal entity. The dialog lists the vendor with its own switch from those. Declare the vendor in vendors to replace them, for example to link your own data processing notice, or when you self-host a tool such as Matomo, Umami, Plausible or PostHog and the vendor's privacy policy doesn't cover your install. A declaration replaces vendorDetails as a whole and doesn't merge with it.

Your own scripts can set vendorDetails too. A script with a vendor slug and no name and privacyPolicyUrl from any source still loads with its category, but the dialog has no switch for it. In development, c15t logs a console warning that names the slug. Production builds skip the warning.

A self-hosted backend can declare vendors too. /init returns them and c15t merges them with the vendors in code. When both declare the same id, the code declaration wins.

Gate scripts, requests and iframes by vendor

Put the vendor slug on each target:

An iframe with data-vendor and no data-category is gated on the vendor alone. A script with alwaysLoad still loads when its vendor is off. Its callbacks receive info.vendor.granted, so the SDK can stop itself. The Google Consent Mode, RudderStack and Cloudflare Zaraz helpers do this for you. While their vendor is off, they send every optional category as denied.

On an Astro site, two more targets take a vendor slug:

An inert tag with data-c15t-vendor runs once its category is allowed and the visitor has not switched the vendor off:

<script
  is:inline
  type="text/plain"
  data-c15t-category="marketing"
  data-c15t-vendor="x-pixel"
>
  // X Pixel's base code
</script>

data-c15t-vendor does nothing without data-c15t-category. Under a nonce-based Content Security Policy, the tag still needs the page's nonce. See gate an inline script. Embeds covers the iframe blocker's data-vendor attribute and the custom element pattern.

What the preference dialog shows

The preference dialog lists each declared vendor under its category, with its own switch, whichever ui framework renders the dialog island: React, Vue or Svelte.

The dialog lists only vendors that have a name and a privacyPolicyUrl. A vendor's switch is disabled while its category is off. Save records the vendors the visitor changed. Accept All and Reject All clear every vendor denial, so each vendor follows its category again. The labels come from consentManagerDialog.vendors in the translations: title, privacyPolicy, disabledByCategory and switchLabel.

Read and record vendor choices in your own script

The page client from getConsentClient() in c15t/astro/client reads and records vendor consent:

A vendor reads as allowed only when it is declared, its category is allowed and the visitor has not switched it off. An id that nothing declares, in vendors, on a script or iframe, or from the backend, reads as not allowed. A typo such as x-pixle or a vendor you forgot to declare never looks like consent. In development, c15t logs a console warning that names the id.

The video component reads client.isVendorAllowed('youtube'), so it needs youtube in vendors.

Call save() only from a visitor's action, such as a switch in your own form. This records marketing as allowed and X Pixel as off:

import { getConsentClient } from 'c15t/astro/client';

await getConsentClient()?.save({
	marketing: true,
	vendors: { 'x-pixel': false },
});

Client API covers the rest of the page client.

What c15t stores

c15t stores only the vendors a visitor switched off, and sends the full vendor map to the backend with the consent record. Under an opt-out policy, every vendor starts on. Turning a vendor off that was on reloads the page, the same as withdrawing a category, so code the vendor already ran stops.

What switching a vendor off does not do

• It does not delete cookies the vendor already set. Clear on revocation does not run, because the category stays allowed. Delete the vendor's cookies from the script's onConsentChange when info.vendor.granted is false.
• It does not expire. The switch stays off until the visitor changes it or uses Accept All or Reject All, even across a policy change.
• Adding a vendor does not ask returning visitors again. A new vendor starts on inside an allowed category. Change the policy's copyRevision if a new vendor should prompt again.

Verify vendor consent

Test the production build in a private window with DevTools Network open and filtered to ads-twitter.com:

1. Register xPixel(). Open Privacy settings. The marketing row lists X Pixel with a switch.
2. Allow marketing and save. uwt.js loads.
3. Open Privacy settings, switch X Pixel off and save. c15t reloads the page. After the reload there is no uwt.js request, and other marketing scripts still load.
4. Reload again. The X Pixel switch is still off.
5. Turn marketing off. The X Pixel switch is disabled.
6. Open Privacy settings and click Accept All. uwt.js loads again.