---
title: "Connect a consent banner"
description: "Start the SDK with consent pending, hold events in memory until the visitor decides, and delete stored ids when they decline."
canonical: "https://www.togohq.ai/docs/guides/consent"
applies_to: "@togohq/sdk-browser 1.x"
updated: "2026-11-03T00:00:00Z"
---

# Connect a consent banner

Start the SDK with consent pending, hold events in memory until the visitor decides, and delete stored ids when they decline.

## Four consent states

| State          | Stores on the device | Sends  | Your events                   |
| -------------- | -------------------- | ------ | ----------------------------- |
| `not_required` | yes                  | yes    | sent — the default            |
| `pending`      | **no**               | **no** | held in memory, then released |
| `granted`      | yes                  | yes    | sent                          |
| `denied`       | **no**               | **no** | dropped                       |

The default is `not_required`: no gate applies, or you ran one before the page loaded. An
integration that never mentions consent works normally.

## Start pending, then pass the decision

```ts
const analytics = init({ writeKey, consent: 'pending' });

// When your banner resolves:
analytics.setConsent('granted'); // or 'denied'
```

**Call `init()` first, before the banner resolves.** Do not wait for the decision. Under
`pending` the SDK stores nothing and sends nothing, but it holds your events in memory — so the
landing page view, with its referrer and campaign, is sent once the visitor accepts. Delaying
`init()` loses it, and it is usually the most valuable event on the page.

The buffer holds `consentBufferMaxEvents` events (100 by default, oldest dropped) and is
discarded if the page closes while the decision is still open.

## Declining deletes

`setConsent('denied')` **removes every key the SDK stored** on the device, not only stops writing
new ones. Granting again later starts fresh identifiers; the two stretches are not joined.

Read the current state with `getConsent()`, for example to show the banner again.

## What Togo records about consent

Nothing. The consent state governs what the SDK does on the device and is never sent: there is no
consent field in your data. Getting consent where the law requires it, before the SDK sends
anything, is yours to do; Togo cannot verify a claim about it, so it collects none. Which states
you need in which country is a question for your counsel.