Meles
Docs menu Consent and cookieless mode

Show the right thing

Consent and cookieless mode

You decide whether your site needs consent for Meles, and your consent platform gives the answer. Meles sets no cookie of its own in any mode; the network that serves its script may set Cloudflare’s bot-management cookie, __cf_bm (see the trust page). Consent decides what it may keep in the browser’s storage; it doesn’t stop Meles working.

If your site asks for consent, start Meles with consent: 'pending', and pass on the answer when it comes:

Your page
Meles.init({ siteKey: 'pk_…', consent: 'pending' });

// Later, from your consent platform's callback:
Meles.setConsent('granted'); // or 'denied'
Consent What Meles keeps in the browser
Not passed to init Your site doesn’t require consent: as the storage mode allows
pending Nothing that outlives the page
granted As the storage mode allows. What the page held so far moves to storage, so the visit stays one visitor
denied Nothing, and what Meles stored for your site is removed
  • The script tag alone doesn’t pass consent. A site that needs it calls Meles.init() itself, with consent, and leaves data-site-key off the tag.
  • Denied still sends. Page views, events and identify calls still reach Meles, under an anonymous ID that lasts only as long as the page. If you want nothing sent, don’t start Meles.
  • Frequency caps need storage, so while consent is pending or denied they last only as long as the page.

Cookieless mode

Meles.init({ siteKey: 'pk_…', cookieless: true }) keeps Meles’s anonymous ID in the tab’s session storage instead of local storage, so a visitor is a new one in every tab, and frequency caps last as long as the tab. It wins over consent: even granted, nothing goes to local storage.

Mode The anonymous ID lasts
Standard, consent not required or granted Until reset(), a denial, the visitor clears their storage, or 180 days pass without Meles starting on your site in that browser
Cookieless The tab
Consent pending or denied The page

Everything Meles stores is under keys starting meles: and your site key, in localStorage or sessionStorage. Where consent allows storage, Meles also notes when it last started, under meles:<site key>:d:seen. If it next starts more than 180 days later, it first removes everything it stored for your site, and the visitor starts again as a new one.

Start Meles with consent: 'pending', then pass on your platform’s answer whenever it changes. Each snippet below is run, word for word, by the SDK’s browser tests. Meles adds nothing to its script for any platform, so these cost your page no weight.

IAB TCF v2.2

The snippet reads Purpose 1, Store and/or access information on a device, the consent Meles’s storage needs. Where your platform says GDPR doesn’t apply, it grants storage; change that line if your site needs consent there too. Meles isn’t on the IAB’s Global Vendor List, so check that your platform asks for Purpose 1.

IAB TCF v2.2
Meles.init({ siteKey: 'pk_…', consent: 'pending' });

if (typeof window.__tcfapi === 'function') {
  window.__tcfapi('addEventListener', 2, function (tcData, success) {
    if (!success) return;
    if (tcData.gdprApplies === false) {
      Meles.setConsent('granted');
    } else if (tcData.eventStatus === 'tcloaded' || tcData.eventStatus === 'useractioncomplete') {
      Meles.setConsent(tcData.purpose.consents[1] ? 'granted' : 'denied');
    }
  });
}

Google’s tag offers no way to hear the visitor’s choice, so pass it on where your page tells Google. Meles follows analytics_storage.

Google Consent Mode
Meles.init({ siteKey: 'pk_…', consent: 'pending' });

// Where your page passes the visitor's choice to Google:
function updateConsent(choices) {
  gtag('consent', 'update', choices);
  if (choices.analytics_storage) {
    Meles.setConsent(choices.analytics_storage === 'granted' ? 'granted' : 'denied');
  }
}

If your platform calls gtag for you, use its own callback instead, as below.

Any other platform

Any other platform
Meles.init({ siteKey: 'pk_…', consent: 'pending' });

// Call this from your platform's callback, with whether the visitor allowed storage:
function onConsentChange(allowed) {
  Meles.setConsent(allowed ? 'granted' : 'denied');
}