# GDPR consent


The Flare client can run behind a cookie consent or GDPR banner. When consent is off, the client sends
nothing and it doesn't even construct any reports or traces. 

The Flare client never sets cookies, but it does read cookies when attaching context to an error. Asking the user's 
consent is mostly about the data the client sends to Flare.

## Turning the client on and off

By default the consent configuration setting starts at `true`. Enabling/disabling consent is one method:

```javascript
flare.setConsent(true); // allow sending
flare.setConsent(false); // stop sending, and drop anything captured earlier
```

`setConsent(false)` stops all data from leaving the browser. It also drops any buffered logs and spans collected up to that point,
so when later a `setConsent(true)` cannot ship data captured while consent was off.

## Recommended setup

Do not call `flare.light()` until the visitor accepts the consent banner. Without `light()`, the client sends nothing.

```javascript
import { flare } from '@flareapp/js';

// Cookiebot example. OneTrust exposes OptanonWrapper; the idea is the same.
window.addEventListener('CookiebotOnAccept', () => {
    flare.light('YOUR PROJECT KEY'); // first grant: start the client
    flare.setConsent(true); // and allow sending
});

window.addEventListener('CookiebotOnDecline', () => {
    flare.setConsent(false); // withdrawal: stop all sends, drop buffers
});
```

## Starting with consent off

If you already call `flare.light()` at boot, start with consent off instead, then turn it on when the
visitor accepts:

```javascript
import { flare } from '@flareapp/js';

flare.configure({ hasConsent: false }); // start off, before anything can send
flare.light('YOUR PROJECT KEY');

window.addEventListener('CookiebotOnAccept', () => flare.setConsent(true));
window.addEventListener('CookiebotOnDecline', () => flare.setConsent(false));
```

Put `configure({ hasConsent: false })` first, right after the import, so the client is off. While this works, we do advice to use the recommended setup.

See the [configuration reference](/docs/javascript/reference/configuration) for `hasConsent`, and the
[API reference](/docs/javascript/reference/api) for `setConsent()`.