# Consent and Global Privacy Control

> Choose opt-in or opt-out, honour Global Privacy Control, and pick where consent comes from: your CMP, your own banner, or the Kalman banner.

Updated 2026-11-10 · Privacy and consent · https://kalmananalytics.com/support/consent-and-gpc/

Kalman records whether each visitor said yes or no to sharing with ad platforms. Kalman's servers then decide, event by event, whether anything goes to Meta or another ad channel. Your settings are under **Privacy review** → **4. Ad consent**.

## Choose a consent mode

The **Consent mode** list has two options:

- **Opt-out: send unless the visitor said no.** This is the default. Events are sent unless the visitor declined.
- **Opt-in: send only when the visitor said yes.** Events go to ad platforms only after a clear yes.

If your brand treats a single condition, opt-in is the only way to keep the fact that someone bought from you out of ad platforms.

Consent is checked when Kalman builds each batch to send. A "no" given later still stops events that were already waiting.

## Global Privacy Control

Global Privacy Control (GPC) is a browser setting that tells sites not to share or sell data. Kalman always treats it as a no. When the tag sees GPC, it reports a "no" before doing anything else. That applies in both modes and whichever consent source you pick.

## Where consent comes from

Under **Consent manager (CMP) the tag reads**, pick one:

- **None (tag API and GPC only)**: use this with your own banner (see below).
- **OneTrust**, **Cookiebot** or **Osano**: the tag reads the marketing or advertising choice from that tool, and reads it again when the visitor changes it. If the tool loads late, the tag checks again a few seconds later.
- **Kalman banner (shown by the tag)**: Kalman shows its own banner (see below).

To use **your own banner**, have it call the tag with the visitor's answer:

```js
kalman('consent', { ads: true }); // or { ads: false }
```

Webhooks can also send consent in an `ad_consent` field. When signals disagree, the newest one counts.

## Turn on the Kalman banner

1. Open **Privacy review** and go to **4. Ad consent**.
2. Set **Consent manager (CMP) the tag reads** to **Kalman banner (shown by the tag)**.
3. Edit the **Title**, **Text**, **Accept button**, **Decline button**, **Privacy policy URL** (https only) and **Link text**.
4. Choose a **Position** (Bottom bar, Bottom left, Bottom right), a **Theme** and a **Button colour**, and check the **Preview**.
5. Click **Save consent settings**.

You need to be an owner or admin. If you later switch to another consent source, Kalman keeps your banner settings.

**The default wording is a draft.** Have your counsel review the title and text before you rely on it.

How the banner behaves:

- Every visitor sees it until they answer. Accept and Decline look the same. Pressing Esc doesn't close it, because no choice means no answer.
- The answer is saved in a first-party cookie, `_kl_consent`, for 365 days. Returning visitors don't see the banner again.
- **Show a small "Privacy choices" link** lets visitors change their mind later. Your own code can reopen the banner with `kalman('consent:open')`, or listen for the `kalman:consent` browser event to control your other tags.
- When GPC is on, the banner isn't shown and the answer is no.

Below the form you can see how many visitors said yes, said no, or are unknown.

## What Kalman never sends

Consent signals are not events. They aren't sent to any ad platform. The banner reports only a yes or a no: it reads no other cookie, form field or page content. When ads consent is no, intake links carry only Kalman's random visitor id, without ad click ids.

## Health policies still apply

Removing health terms, hashing identifiers and signing a BAA make what Kalman sends safer. They don't make an event eligible under an ad platform's own health-data policies. Meta, Google and the others decide for themselves what a health advertiser may send and optimize on. If your brand treats a single condition, the site itself can say what a visitor is there for, so ask for consent before sending (opt-in) rather than sending unless someone says no.

Still stuck? Log in and open a request: https://app.kalmananalytics.com/support