Self-hostWhat gets stored, and why
What gets stored, and why for JavaScript
Every field of a stored consent record, what it proves, and what is deliberately left out. A page to send to your legal team.
Each consent decision becomes one row: who decided (by a random id), when, what they saw, what they chose, and where. Nothing about what the visitor was browsing is stored. This page lists every field so you can check it against your own privacy notice.
One row per decision
| Column | What it shows |
|---|---|
| Visitor | consent_id, a random id kept in the visitor's consent cookie. It is not derived from anything about the visitor. |
| When | decided_at, by the visitor's clock, and received_at, by your server's. Keeping both shows a record that was delayed, retried or replayed. |
| What they saw | taxonomy_hash, a fingerprint of the categories shown, plus regulation, sdk_version and domain. |
| What they chose | granted and denied, the category ids, and action: accept all, reject all, accept selected, or save. |
| Where | source: the banner, the preferences dialog, the opt-out dialog, or your own code. |
| Signals | gpc: whether the browser sent Global Privacy Control. region: the region the SDK detected, when region detection is on. |
A visitor who changes their mind adds a row; earlier rows are kept, so the history is complete. The visitor's current choice is their latest row.
Every stored column
| Field | Type | Personal data | Meaning |
|---|---|---|---|
recordId | string | no | Id of the decision. |
consentId | string | pseudonymous | Random id of the visitor. Use it to find or delete their records. |
decidedAt | string | no | When the visitor decided, by their device's clock. |
receivedAt | string | no | When the server received the record, by the server's clock. |
granted | string[] | no | Categories the visitor granted. |
denied | string[] | no | Categories the visitor denied. |
regulation | "GDPR" | "CCPA" | "DEFAULT" | no | The regulation the banner applied. |
region | string | null | coarse location | Region the SDK detected, when region detection is on. |
domain | string | no | The site's hostname. |
taxonomyHash | string | no | Fingerprint of the category list the visitor was shown. |
action | "accept_all" | "reject_all" | "accept_selected" | "save" | no | What the visitor did. |
source | "banner" | "preferences" | "optout" | "api" | no | Where they decided. |
sdkVersion | string | null | no | Version of the SDK that sent the record. |
gpc | boolean | null | no | Whether the browser sent Global Privacy Control. |
ip | string | null | yes | Empty unless you turn on ipAddress; then truncated or hashed, never raw. |
Deliberately not stored
- The IP address, unless you turn on
ipAddress. Then it is truncated to its network (the last part of an IPv4 address, or all but the first three groups of IPv6, removed) or replaced by a keyed hash. A raw address is never an option. - Page URLs, referrers, user agents and cookies. The record is about the consent, not the browsing.
- Fields the backend does not know. A newer SDK may send more; they are dropped, never stored.
Server logs say what happened ("deleted 2 records"), never who it happened to: no consent id, no payload, no address.
What the SDK sends
| Field | Type | Personal data | Meaning |
|---|---|---|---|
recordId | string | no | Id of this decision. The same decision always has the same id, so a retry is stored once. |
consentId | string | pseudonymous | Random id of the visitor, kept in their consent cookie. |
categories | Record<string, boolean> | no | Each category id, and whether the visitor granted it. |
regulation | "GDPR" | "CCPA" | "DEFAULT" | no | The regulation the banner applied. |
domain | string | no | Hostname of the site where the visitor decided. |
decidedAt | string | no | When the visitor decided, in UTC. Not when the record was sent. |
taxonomyHash | string | no | Fingerprint of the category list the visitor was shown. |
action | "accept_all" | "reject_all" | "accept_selected" | "save" | no | What the visitor did. |
source | "banner" | "preferences" | "optout" | "api" | no | Where the visitor decided. api is a call from the site's own code. |
region | string | coarse location | Region the SDK detected, like US-CA. Sent only with region detection on. |
sdkVersion | string | no | Version of @cookieyes/core that sent the record. |
gpc | boolean | no | Whether the browser sent the Global Privacy Control signal. |
Good to know
decided_atcomes from the visitor's device and can be wrong if its clock is.received_atis your server's and is what retention counts from.- The same decision sent twice is stored once: its
record_idis the key. A different decision under a knownrecord_idis refused and the first one kept. - Whether a record is enough for your obligations is a question for your own legal advice.