# Consent and opt-out

> Respect your visitors' choices with ClickClacks: load the tracker only after consent, opt a visitor out or back in with optOut and optIn, wire it to a consent banner or Google Tag Manager, and honour Do Not Track and Global Privacy Control.

- Canonical URL: https://clickclacks.io/docs/consent
- Section: Tracking
- Last updated: 2026-09-26

ClickClacks gives you the switches; you decide when to flip them. Load the tracker only after consent, or run it and opt individual visitors out. Both are one line.

> **Not legal advice**
>
> Whether you need consent for analytics depends on where your visitors are and how you use the data. This page explains what the tracker does, so you and your counsel can decide.

## What there is to consent to {#what-it-stores}

The tracker sets **no cookies**. It does keep a random anonymous ID and a session ID in the browser’s local and session storage, which many privacy rules (such as the EU’s ePrivacy rules) treat the same way as cookies. It sends pageviews, clicks, scroll depth and your own events to ClickClacks. [What’s collected](https://clickclacks.io/docs/privacy.md) lists every storage key and every field.

## optOut and optIn {#opt-out}

```js
// The visitor declines, or withdraws consent
window.clickclacks('optOut')

// They change their mind (no reload needed)
window.clickclacks('optIn')
```

`optOut`, straight away:

- drops any events not sent yet and stops all tracking on the page: no events, no link tagging, no heatmap captures;
- deletes the tracker’s IDs from local and session storage;
- remembers the choice in local storage (`cco`), so on every later page load the tracker stays off before it reads or writes an ID.

`optIn` forgets that choice and resumes tracking with brand-new IDs, created with the next event. If the opt-out kept the current page from being counted, `optIn` counts it now. Both also exist as `window.clickclacks.optOut()` and `window.clickclacks.optIn()`.

- **Neither can recall events already sent.** Opt out before tracking starts if nothing may be sent: see the next section.
- **The choice is per hostname,** like all browser storage. On `acme.com` and `app.acme.com`, apply it on both.
- **Clearing site data clears the choice.** Re-apply it from your consent tool’s stored record on each load; calling `optOut` again is harmless.

## Load only after consent {#load-after-consent}

The strictest approach: don’t put the tag in your HTML at all, and add it once the visitor agrees. Nothing runs, and nothing is stored, until then.

```html
<script>
  // Call this once the visitor has agreed to analytics.
  function loadClickClacks() {
    if (document.getElementById('clickclacks')) return
    var s = document.createElement('script')
    s.id = 'clickclacks'
    s.async = true
    s.src = 'https://app.clickclacks.io/c.js'
    s.setAttribute('data-key', 'pk_live_3f9a1c7e5b2d4f6a8c0e1b3d')
    s.setAttribute('data-domains', 'acme.com,www.acme.com,app.acme.com')
    document.head.appendChild(s)
  }
</script>
```

The tracker reads its attributes from its own tag, so adding it from script works the same as writing it in the page. Loaded mid-visit, it records the current page as the first pageview.

## Wiring up a consent banner {#banner}

If you load the tag on every page and let visitors opt out, connect your consent tool’s callback to `optIn` and `optOut`. Put the [queue stub](https://clickclacks.io/docs/events.md#before-load) above the tag so a choice made before `c.js` loads is queued: queued calls run before the first pageview, so an early `optOut` means not even that is sent.

```js title="consent.js"
// Adapt to your consent tool's callback. Queue calls with the stub
// (see "Calling before the script loads") if the tag loads after this runs.
onConsentChange((choices) => {
  if (choices.analytics)
    window.clickclacks('optIn')
  else
    window.clickclacks('optOut')
})
```

## Google Tag Manager {#gtm}

If the tag is installed as a [Custom HTML tag](https://clickclacks.io/docs/install.md#gtm), let Tag Manager hold it back: in the tag’s **Consent settings**, require additional consent for `analytics_storage`. With Consent Mode fed by your banner, the tag only fires once that consent is granted.

## Do Not Track and GPC {#dnt-gpc}

ClickClacks doesn’t read Do Not Track or Global Privacy Control by itself: the tracker behaves the same whatever the browser signals. To honour them, check before the tag runs and opt the visitor out, or skip loading the tag:

```html
<script>
  // Before the ClickClacks tag, after the queue stub.
  if (navigator.globalPrivacyControl === true || navigator.doNotTrack === '1') {
    window.clickclacks('optOut')
  }
</script>
```

This needs the [queue stub](https://clickclacks.io/docs/events.md#before-load) above it, so the call waits for the tracker.

## Next steps {#next}

- [What’s collected](https://clickclacks.io/docs/privacy.md): storage keys, fields and what’s scrubbed.
- [Retention and deletion](https://clickclacks.io/docs/data.md): IP addresses, retention and data requests.
- [Tracker API](https://clickclacks.io/docs/tracker-api.md): every command.