Policies & campaigns

Keep consent valid over time, adjust the banner per country, and re-ask a whole audience when the rules change.

Recording consent once isn’t enough. It goes stale, the law differs by country, and sometimes you need everyone to answer again. This screen has three tools for that — each independent, use only what you need.

1. Expiry policies — consent that ages out

Why: regulators expect you to refresh consent periodically rather than treat a one-time “yes” as forever. A common bar is 24 months for marketing.

How: add an Expiry policy — “marketing consent is valid for 730 days”. Each night, any matching grant older than that flips to EXPIRED. The subject’s state now reads as not-consented, a consent.expired event fires, and (if you listen for it) reconsent.required too — so your app knows to ask again next visit.

Example: you set 730 days scoped to marketing_email and marketing_sms. Someone who opted in 25 months ago opens your site tonight; tomorrow their marketing state is EXPIRED, your banner shows the ask again, analytics consent is untouched.

2. Regional rules — one banner, right behaviour per country

Why: the same banner should not behave the same everywhere. In the EU, non-essential purposes must default to off and rejecting must be as easy as accepting. In some other regions you may pre-tick, or only need an opt-out. Hard-coding that per market is how banners drift out of compliance.

How: describe each region once as a rule. Your banner calls GET /v1/policy?country=FR on load and gets back: which purposes are mandatory, what each purpose should default to, and whether a one-click “reject all” is required. It renders itself from that answer — no per-country code.

// "EU baseline" — applies to these countries, everything off by default,
// reject-all must be one click
{
  "name": "EU baseline",
  "appliesToCountries": ["ES", "PT", "FR", "DE", "IT", "IE", "NL"],
  "requiredPurposes": ["necessary"],
  "defaults": { "marketing_email": "denied", "analytics": "denied" },
  "rejectAllInOneClick": true
}

Rules have a priority, so a specific one (say Germany) can override a broad one (the EU baseline). GET /v1/policy?country=DE returns the merged result.

3. Re-consent campaigns — re-ask an audience, track progress

Why: you published a statement change that requires re-consent, or an expiry policy just invalidated a batch. You need to know: how many people still owe you an answer, and when everyone’s caught up.

How: start a campaign on that purpose. It counts every subject whose recorded consent is behind the current version as pending, and updates as people re-answer through your banner. When the pending count hits zero the campaign marks itself complete. It doesn’t email anyone — your app does the asking; the campaign is the scoreboard.