Consent & cookies
Optimeleon is suppress-only: until a visitor grants analytics consent, nothing is written to their device and no analytics leaves the page. Wire your consent banner to it in one call.
Optimeleon is suppress-only. Until a visitor grants analytics consent, it sends zero events to its collector, builds no visitor id, and writes nothing identifying to the device. This is the default on every page and it does not branch on the visitor's country.
Variants still serve before consent, so the visitor sees the optimized page. Only the measurement waits.
The consent API
window.optimeleon('consent', { analytics: true, marketing: true }); // grant
window.optimeleon('consent', { analytics: false, marketing: false }); // withdrawwindow.optimeleon(…) is available immediately. The inline bootstrap installs a queue, so calls made before the bundle finishes loading are replayed in order. Call it as early as your CMP fires. Calling it again later, when the visitor changes their mind, is honoured at any point in the page's life.
| Category | Effect |
|---|---|
analytics | The one that matters. true starts capture, enables first-party cookie persistence, and links the session to a lasting profile keyed to a random id. false suppresses capture again and forgets the identity. |
marketing | Recorded only. Stamped onto events as granted/denied for your own segmentation. It drives no cookie or storage behavior today. |
- Pass a boolean per category. Unknown categories and non-boolean values are ignored, so forwarding extra categories from your CMP is safe.
- Omitting a category leaves it unchanged.
- Repeating an identical signal is a no-op, with no double counting and no churn.
What a grant and a withdrawal do
| analytics: true | analytics: false | |
|---|---|---|
| Capture | Begins | Suppressed |
| Persistence | First-party cookies + localStorage | Nothing written to the device |
| Visitor identity | Linked to a lasting random id | Reset and forgotten |
| Cookies | Written, apex-scoped | Cleared |
| Variant assignment | Seed and assignment persisted | Persisted copies cleared |
| Variant on screen | Unchanged | Unchanged |
Mapping your CMP's categories
Optimeleon's storage falls under analytics / statistics in standard taxonomies.
| CMP | Map to analytics |
|---|---|
| OneTrust | Performance / Analytics Cookies (commonly C0002) |
| Cookiebot | Statistics |
| Sourcepoint / TCF | Measurement (for example Purposes 7 to 10, per your configuration) |
| Google Consent Mode | analytics_storage |
Example: Cookiebot
window.addEventListener('CookiebotOnConsentReady', function () {
window.optimeleon('consent', {
analytics: Cookiebot.consent.statistics,
marketing: Cookiebot.consent.marketing,
});
});Example: Google Consent Mode
// Wherever you already react to a consent update:
window.optimeleon('consent', { analytics: analyticsStorageGranted === 'granted' });optimeleon('config', { consent: 'analytics' }) / 'anonymous' form. Both are supported and they mean the same thing. Use whichever reads better inside your CMP callback.Cookie and storage reference
Register these in your CMP. Match by exact name, except __opti_cap_assign, whose runtime key carries your project's edge token as a suffix. Register that one by prefix.
Before consent: strictly necessary
Two entries run before consent. Neither identifies anyone.
| Key | Purpose | Lifetime |
|---|---|---|
__opti_probe, __opti_dprobe | Checks whether the browser allows storage. Written and removed in the same moment. | Removed immediately |
__opti_cap_assign* | Remembers which version was served so the page does not flip between versions within a tab. Holds a version label, not an identity. | Until the tab closes |
After analytics consent: statistics
| Key | Purpose | Lifetime |
|---|---|---|
__opti_vid | Recognises one visitor across your subdomains. A random id, not a profile. | 365 days |
__opti_arm | Lets a conversion completed on another of your subdomains still count for the variant the visitor was shown. | 30 minutes |
__opti_visitor | Remembers which version a returning visitor should see. | Until consent is withdrawn or browser data is cleared |
__opti_assignment | Records which variant and campaign the visitor belongs to. | Until consent is withdrawn or browser data is cleared |
__opti_cap_vid | The visitor's analytics id, a random code grouping their activity. | Until consent is withdrawn or browser data is cleared |
__opti_cap_sid | Identifies a single browsing session. | Until the tab closes |
Shopify checkout adds one
| Key | Purpose | Lifetime |
|---|---|---|
__opti_px_sid | Groups checkout activity for a shopper who lands directly on checkout, for example from an email link. Set only after consent. | Until the tab closes |
Cross-subdomain identity
The __opti_vid cookie is written at your apex domain, so a visitor recognised on www.example.com is the same visitor on shop.example.com. __opti_arm carries the served variant across that boundary for a short window, which is what lets a purchase completed on another subdomain be credited to the variant that earned it.
Every subdomain involved still has to be on your tracking allowlist.
What Optimeleon never does
- No IP storage. A visitor's IP is used momentarily to estimate a rough city, then dropped.
- No personal profiles. Everything ties to a random id, never a name or an email.
- No third-party ad tracking. No advertising cookies, no outside ad-network trackers. Data goes only to Optimeleon's own collector at
edge.optimeleon.com, and is never sold or shared with ad networks or data brokers. - On Shopify, a purchase is recorded with its amount, currency and products, never the order number, the checkout token, or any customer detail from your admin.
Retention and visitor rights
Analytics is deleted 12 months after it is recorded, plus up to one further month to complete a late deletion request, and never beyond 13 months. The recognition cookie lasts up to 365 days, and a visitor can clear it or withdraw consent at any time to remove it immediately.
If a visitor asks to see or delete their data, send us their visitor id and we will export or erase their records. Deleting a project removes all of its data.