# Consent

> Understand when the Cevoid Analytics SDK creates a session, when it does not, and how consent affects session IDs.

Breadcrumb: Analytics SDK › Consent · Updated: 2026-10-17
Docs index: https://docs.cevoid.com/developers/llms.txt

Use this page when you need the exact rules for Cevoid session creation and the `ca_session` cookie. If you only want the operational setup steps, use [Session tracking](https://docs.cevoid.com/developers/analytics-sdk/setup-session-tracking.md) instead.

## Short answer

Every tracked event carries a `session_id` for the current page runtime. The SDK only writes that session to the `ca_session` cookie, so it lasts across page loads, when both of these are true:

1. `enableSessionTracking` is enabled
2. The consent checks resolve to granted

If consent is denied, events can still be sent, but `ca_session` is not written, so the `session_id` lasts only for the current page runtime. Cevoid only uses sessions stored in `ca_session` to connect widget activity with completed orders.

On a non-Shopify site with no GTM consent entry and no `window.cevoidTrackingConsent` value, the consent checks default to granted.

## Session cookie name

The current Cevoid session cookie name is `ca_session`.

`cevoid_sid` is the legacy cookie name. The SDK will migrate an existing legacy cookie into `ca_session` and clean up the old cookie when possible.

If your storefront requires cookie disclosures before analytics storage is enabled, document `ca_session` in your cookie policy before you turn on session tracking in production.

## Consent sources

When session tracking is enabled, the SDK checks up to three sources, described below. Consent resolves to granted only when every check resolves to granted. If none of these sources are present on a non-Shopify site, the overall consent result defaults to granted.

### Shopify Customer Privacy API

If Shopify is not present, this check defaults to granted.

If Shopify is present, the SDK tries to load the `consent-tracking-api` feature and waits up to 5 seconds:

- if the feature loads, it uses `window.Shopify.customerPrivacy.userCanBeTracked()`
- if feature loading fails or times out, the Shopify check resolves to denied

### GTM `dataLayer`

If `window.dataLayer` is missing, is not an array, or holds no consent command, this check defaults to granted.

If consent commands are present, the SDK reads `analytics_storage` from the latest `['consent', 'default' | 'update', {...}]` style entry that sets it:

- `analytics_storage === 'granted'` means granted
- any other value means denied

If consent commands are present but none of them sets `analytics_storage`, this check resolves to denied.

### `window.cevoidTrackingConsent`

If this global is missing, this check defaults to granted.

If it is present:

- `'granted'` means granted
- any other value means denied

## What happens when consent is granted

If consent resolves to granted, the SDK:

- creates or refreshes `ca_session`
- uses a 30-minute rolling expiry
- keeps the same `session_id` on tracked events across page loads

Cookie attributes:

- Name: `ca_session`
- Path: `/`
- SameSite: `Lax`
- Domain: only set when you pass `cookieDomain`

## What happens when consent is denied

If consent resolves to denied:

- the SDK removes `ca_session` and the legacy `cevoid_sid` cookie
- the SDK does not create `ca_session`
- tracked events can still be sent
- those events carry a `session_id` for the current page runtime only

## What happens when cookies cannot be written

If consent is granted but the browser blocks cookie writes, the SDK falls back to an in-memory session for the current page runtime.

That fallback:

- does not persist across full page reloads
- still allows a session value to be attached during the current runtime

## What happens while consent is resolving

When `enableSessionTracking` is enabled, tracked events are deferred until consent resolution finishes.

After consent resolves:

- if granted, the SDK creates or refreshes the session and then sends the deferred events
- if denied, the SDK sends the deferred events without writing `ca_session`

## Practical examples

### Gallery on a non-Shopify site with no custom consent signals

Result:

- consent defaults to granted
- `ca_session` is created if session tracking is enabled

### Shopify storefront where tracking is denied

Result:

- no `ca_session` is created
- events can still be sent, with a `session_id` for the current page runtime only

### Site where cookies are blocked

Result:

- no persistent `ca_session`
- in-memory session fallback for the current runtime only

## Related articles

- [Session tracking](https://docs.cevoid.com/developers/analytics-sdk/setup-session-tracking.md)
- [Installation](https://docs.cevoid.com/developers/analytics-sdk/installation.md)

---

Canonical: https://docs.cevoid.com/developers/analytics-sdk/consent