Consent integration guide

1. Add the banner

Paste this once, before </body>. The banner renders, captures consent, and records it automatically.

<script src="https://api.scrutora.com/api/consent/embed/cs_your_site_key.js" async></script>

2. Gate your own scripts on the consent state

The banner records consent — you decide what to run. Read the stored decision before loading anything non-essential (analytics, marketing pixels, and so on):

// Returns the visitor's stored decision (or null if undecided)
const consent = window.ScrutoraConsent?.getConsent();

if (consent?.states?.analytics) {
  loadAnalytics();        // only runs if they granted "analytics"
}
if (consent?.states?.marketing) {
  loadMarketingPixels();
}

3. Block third-party tags with no JavaScript

For tags you can edit in the page, mark the script type="text/plain" and give it a category. The banner unblocks it only after consent for that category — and re-emits Google Consent Mode v2 signals so gtag-based tags gate themselves too.

<!-- Blocked until the visitor grants "marketing". -->
<script
  type="text/plain"
  data-sc-category="marketing"
  data-src="https://cdn.example.com/pixel.js"
></script>

<!-- Inline tags gate the same way — the body runs only after consent. -->
<script type="text/plain" data-sc-category="analytics">
  initAnalytics();
</script>

Run the tag monitor from your dashboard to confirm nothing fires before consent — it loads your page pre-consent, after Reject All, and after Accept All, and flags any tracker that ignores the choice.

4. Let visitors change their mind

Wire a “Manage cookies” link in your footer to re-open the preferences panel:

<button onclick="window.ScrutoraConsent.openPreferences()">
  Manage cookies
</button>

5. Accept data-subject requests (DSR)

Point your privacy or “your rights” form at the DSR intake endpoint. Scrutora records the request, starts the statutory SLA clock, emails the requester a verification link, and fires a dsr.created webhook — the queue then appears under Records & requests in your dashboard.

await fetch("https://api.scrutora.com/api/consent/dsr/cs_your_site_key", {
  method: "POST",
  // text/plain keeps this a simple request (no CORS preflight)
  headers: { "Content-Type": "text/plain" },
  body: JSON.stringify({
    // one of: access | correction | erasure | withdraw | grievance | nominate
    request_type: "access",
    email: userEmail,
    details: "Optional free text from the requester",
  }),
});
// -> 201 { ok: true, request_id, sla_due_at }

The six request types map to DPDP data-principal rights (§§11–14) and the equivalent GDPR/CCPA rights. The requester must confirm ownership via the emailed link before the request is actioned.

6. React server-side (optional)

Register a webhook to act when consent changes or a request arrives — for example, stop processing on withdrawal. Each delivery is signed; verify the HMAC with your endpoint's signing secret.

POST  https://your-app.com/webhooks/consent
X-Scrutora-Event: consent.withdrawn
X-Scrutora-Signature-256: sha256=<hmac of the body>

{ "event": "consent.withdrawn", "data": { "purposes": { ... } } }

7. Make the banner yours (Design tab)

No code needed. Open the site's Design tab in your dashboard and pick a preset (Light, Dark, or Match my brand), then adjust the layout (bar, card, or modal), colours, button style and order, typography, logo, the “Manage cookies” button, and every line of copy. A live preview shows the banner, the preferences panel, and the notice on desktop and mobile as you edit.

The theme is validated server-side when you save (bad colours or unknown keys are rejected) and re-checked before it is served, so nothing invalid ever reaches your page. Saved changes apply on the visitor's next page load; there is nothing to redeploy.

8. Check consent before you process (server-side)

Webhooks tell you when consent changes; this endpoint tells you what it is right now. Call it from your backend before an email send, a record export, or an AI pipeline touches a person's data. It is authenticated with an API key from your account settings, never the public site key.

curl -G "https://api.scrutora.com/api/consent/sites/{site_id}/state" \
  -H "Authorization: Bearer sk_live_..." \
  --data-urlencode "identifier=person@example.com" \
  --data-urlencode "identifier_type=email"

{
  "found": true,
  "purposes": { "necessary": true, "analytics": true, "marketing": false },
  "status": "granted",
  "notice_version": 3,
  "collected_at": "2026-09-19T08:41:12+00:00"
}

found: false with empty purposes means no consent is on record for that person, so treat it as not granted. identifier_type is email or phone; pass anonymous_id instead for visitors who never identified themselves. The key must belong to the account that owns the site.