Consent and opt-out

ClickClacks gives you the switches; you decide when to flip them. Load the tracker only after consent, or run it and opt individual visitors out. Both are one line.

Updated

What there is to consent to

The tracker sets no cookies. It does keep a random anonymous ID and a session ID in the browser’s local and session storage, which many privacy rules (such as the EU’s ePrivacy rules) treat the same way as cookies. It sends pageviews, clicks, scroll depth and your own events to ClickClacks. What’s collected lists every storage key and every field.

optOut and optIn

js
// The visitor declines, or withdraws consent
window.clickclacks('optOut')

// They change their mind (no reload needed)
window.clickclacks('optIn')

optOut, straight away:

  • drops any events not sent yet and stops all tracking on the page: no events, no link tagging, no heatmap captures;
  • deletes the tracker’s IDs from local and session storage;
  • remembers the choice in local storage (cco), so on every later page load the tracker stays off before it reads or writes an ID.

optIn forgets that choice and resumes tracking with brand-new IDs, created with the next event. If the opt-out kept the current page from being counted, optIn counts it now. Both also exist as window.clickclacks.optOut() and window.clickclacks.optIn().

  • Neither can recall events already sent. Opt out before tracking starts if nothing may be sent: see the next section.
  • The choice is per hostname, like all browser storage. On acme.com and app.acme.com, apply it on both.
  • Clearing site data clears the choice. Re-apply it from your consent tool’s stored record on each load; calling optOut again is harmless.

The strictest approach: don’t put the tag in your HTML at all, and add it once the visitor agrees. Nothing runs, and nothing is stored, until then.

html
<script>
  // Call this once the visitor has agreed to analytics.
  function loadClickClacks() {
    if (document.getElementById('clickclacks')) return
    var s = document.createElement('script')
    s.id = 'clickclacks'
    s.async = true
    s.src = 'https://app.clickclacks.io/c.js'
    s.setAttribute('data-key', 'pk_live_3f9a1c7e5b2d4f6a8c0e1b3d')
    s.setAttribute('data-domains', 'acme.com,www.acme.com,app.acme.com')
    document.head.appendChild(s)
  }
</script>

The tracker reads its attributes from its own tag, so adding it from script works the same as writing it in the page. Loaded mid-visit, it records the current page as the first pageview.

If you load the tag on every page and let visitors opt out, connect your consent tool’s callback to optIn and optOut. Put the queue stub above the tag so a choice made before c.js loads is queued: queued calls run before the first pageview, so an early optOut means not even that is sent.

consent.js
// Adapt to your consent tool's callback. Queue calls with the stub
// (see "Calling before the script loads") if the tag loads after this runs.
onConsentChange((choices) => {
  if (choices.analytics)
    window.clickclacks('optIn')
  else
    window.clickclacks('optOut')
})

Google Tag Manager

If the tag is installed as a Custom HTML tag, let Tag Manager hold it back: in the tag’s Consent settings, require additional consent for analytics_storage. With Consent Mode fed by your banner, the tag only fires once that consent is granted.

Do Not Track and GPC

ClickClacks doesn’t read Do Not Track or Global Privacy Control by itself: the tracker behaves the same whatever the browser signals. To honour them, check before the tag runs and opt the visitor out, or skip loading the tag:

html
<script>
  // Before the ClickClacks tag, after the queue stub.
  if (navigator.globalPrivacyControl === true || navigator.doNotTrack === '1') {
    window.clickclacks('optOut')
  }
</script>

This needs the queue stub above it, so the call waits for the tracker.

Next steps