Understand Pixel consent
What happens before a choice, after consent, and on withdrawal.
CJM uses four signals named after Google Consent Mode v2. Your banner must communicate choices through updateConsent. The Pixel does not automatically detect every banner or update other Google tools' consent.
The four signals
| Signal | Pixel effect |
|---|---|
analyticsStorage | Allows session sid and the cjm_session cookie. |
adStorage | Allows persistent identity cid, the cjm_cid cookie, and access to advertising identifiers. |
adUserData | Together with adStorage, allows sending advertising cookies collected for enabled integrations. |
adPersonalization | Contributes to Meta consent; browser forwarding to Meta/GTM still requires all four signals. |
Read values are granted, denied, and unspecified (no available choice). External callers may set only granted or denied.
What is sent
| Choice | Ordinary CJM events | Identifiers |
|---|---|---|
| Statistics yes, advertising no | Yes | Session without persistent visitor identity. |
| Statistics no, advertising storage yes | Yes | Identity without statistical session; this does not imply inclusion in statistics reports. |
| Both storage signals denied | Anonymous counts instead of ordinary events | No cid or sid in counts. |
| All four granted | Yes, plus configured browser destinations | Identifiers according to configuration. |
Before an answer
When all signals are unspecified, events wait about 3 seconds. A choice permitting sending flushes the queue in order. When the window expires or the visitor leaves, queued events become anonymous counts without full event data or identifiers. They may include path and campaign information.
Later consent applies to subsequent events; it does not restore events already converted to counts. Also restore your banner's saved choice on return visits.
Refusal and withdrawal
Withdrawal deletes identity/session cookies associated with revoked signals. Queued events are not retained for future consent and may become anonymous counts. Requests use consent at sending time.
cjm_consent_cookie stores the choice with a one-year lifetime. It is separate from identity cookies: refusal does not necessarily mean no cookies anywhere on the website.
When the choice changes and an identity already exists, the Pixel may send the dedicated consent_updated event with the previous identifier, captured before cookie deletion. This records withdrawal against the correct profile. It may also send it when advertising storage is granted; an initial refusal without an identity does not generate this event. It is separate from ordinary events and anonymous counts.
Identity and session lifetime
cjm_cid has a configured lifetime of 365 days; cjm_session has 180 days, renewed when the session is updated. Cookie lifetime is different from visit duration: the Pixel creates a new session after more than 30 minutes of detected inactivity, on a new local calendar day, or when the detected campaign changes.
Campaign detection uses URL parameters utm_source, utm_medium, utm_campaign, utm_term, and utm_content when at least one of the first three is present; otherwise it uses an external referring website or direct traffic. Moving from a URL with campaign parameters to one without them may also change the detected campaign. Cookie removal and browser limits may end identity sooner; it is not a guaranteed cross-device identifier.
When server-side Meta collection is enabled, the Pixel can derive _fbc from the URL's fbclid parameter with both adStorage and adUserData granted. This does not install Meta or configure a server rule.
Leads, performance, and errors
trackLead can send explicitly submitted form data even when cookies are refused. Identity and session remain subject to their signals.
Web Vitals and Error tracking, when enabled, use a channel without CJM identifiers independently of these signals. Do not describe the entire website as collecting nothing after refusal. Technical behavior does not replace your website's choices and privacy notice.
Verify
Test full acceptance, statistics only, refusal, withdrawal, and return visits. Check getConsentState and getIdentity against the table. Do not automatically grant consent just to make events appear.