Consent mode & categories
Understand explicit vs implicit consent and how categories map to Spectry features.
Consent mode
- Explicit (default) — nothing is tracked until the visitor actively accepts. This is the GDPR-recommended setting.
- Implicit — tracking starts unless the visitor opts out. Only appropriate where local law allows and typically used with the "none" provider.
Categories and what they control
| Category | Enables |
|---|---|
essential | Core functionality and Core Web Vitals. Always on. |
analytics | Page views, navigation, scroll depth, custom events, user identification, rage and dead clicks. |
heatmaps | Click, move and scroll interaction tracking for heatmaps. |
feedback | Feedback widgets, surveys and optin forms. |
replay | Session recording. |
Heatmaps and replay are separate categories. Granting one does not grant the other, so a visitor can contribute to a heatmap without being recorded.
How enforcement works
- Each tracking request carries the visitor's current consent state.
- The server validates that the relevant category is granted before storing anything. A request that declares the category as denied is rejected with a 403 and nothing is stored, so the browser's word is not simply trusted.
- On the default explicit consent mode, a request that carries no consent state at all is still accepted — the server has nothing to reject on, and the SDK is what withholds it. That is why the two layers exist together rather than one replacing the other. Sites switched to implicit mode skip the server-side gate entirely.
- If a visitor revokes consent mid-session, session replay stops recording immediately. Analytics, heatmaps and friction capture already running in that page keep sending until the next page load, and the server-side gate is what drops the data in the meantime.
If a feature shows no data, check consent before checking the feature. A heatmap with no interactions, a replay list that stays empty, or a survey with impressions but no responses is very often a consent category that was never granted — not a broken integration.
Setting consent from code
Spectry.acceptAll();
Spectry.setConsent({ analytics: true, heatmaps: false });
Spectry.revokeConsent();