Skip to main content

Where are the consumer's Cookie Consent settings stored?

Article Overview​

The cookie consent settings for consumers are stored in the visitor's browser in a first-party cookie called polaris_consent_settings. Polaris sets the cookie on your site's root domain (so it is shared across subdomains) with path=/ and an expiration of 180 days. The value is a URL-encoded JSON object.

The article provides a comprehensive table of all cookie consent fields:

Field NameData TypeDefault Values (EU / US)GTM MappingsDescription
clientIdStringUUID / UUIDN/AAnonymously generated UUID for recording consent choice
implicitBooleantrue / trueN/ATracks user interaction with cookie banner
analyticsPermittedBooleanfalse / trueanalytics_storageConsent for analytics cookies
personalizationPermittedBooleanfalse / truepersonalization_storageConsent for Personalization Cookies
adsPermittedBooleanfalse / truead_storage, ad_user_data, ad_personalization fallbackConsent for advertising cookies
essentialPermittedBooleantrue / truefunctionality_storage, security_storageConsent for essential cookies
notOptedOutBooleanDepends on banner variant and opt-out signalstv_not_opted_out, ad_personalization when Targeted Advertising appliesTrueVault GTM tag to track opt-out status

The notOptedOut default is true in implicit-consent flows where the visitor has not opted out, and false in default-no-consent flows or when a browser/privacy signal has already opted the visitor out.

The ad_personalization mapping depends on whether Targeted Advertising applies. When it does, ad_personalization is granted only when Advertising is enabled and the consumer has not opted out of Targeted Advertising. When Targeted Advertising is not applicable, ad_personalization falls back to adsPermitted.

Code Examples​

It can sometimes be useful to read this cookie directly if you are developing custom code around a consumer's consent state.

Another reliable way to detect consent activity is to listen for the consentChanged event.

function getCookie(name) {
  const cookie = document.cookie
    .split("; ")
    .find((row) => row.startsWith(`${name}=`));

  return cookie ? cookie.substring(name.length + 1) : null;
}

function readConsentSettings() {
  const rawValue = getCookie("polaris_consent_settings");
  if (!rawValue) return null;

  try {
    // Cookie values are URL-encoded in most browser implementations.
    const decoded = decodeURIComponent(rawValue);
    return JSON.parse(decoded);
  } catch (error) {
    console.warn("Unable to parse polaris_consent_settings cookie", error);
    return null;
  }
}

const consentSettings = readConsentSettings();
console.log("Consent settings:", consentSettings);
console.log("Analytics permitted:", consentSettings?.analyticsPermitted ?? null);

US Configuration Example​

{
  "clientId": "77ee15e6-c9ff-47d4-9e63-5ae85f1ffec9",
  "implicit": true,
  "analyticsPermitted": true,
  "personalizationPermitted": true,
  "adsPermitted": true,
  "essentialPermitted": true,
  "notOptedOut": true
}

EU Configuration Example​

{
  "clientId": "b74292b7-1623-4f00-ea03-3bd036025f99",
  "implicit": true,
  "analyticsPermitted": false,
  "personalizationPermitted": false,
  "adsPermitted": false,
  "essentialPermitted": true,
  "notOptedOut": true
}

Because polaris_consent_settings is a first-party cookie set on your root domain with path=/, the browser includes it in requests to your servers. Server-rendered code — including server-side analytics or tag servers that your pages call — can read the visitor's current consent state from the incoming request's Cookie header at first render, before any client-side JavaScript runs.

When reading the cookie server-side:

  • URL-decode the cookie value, then parse it as JSON. The fields are the same as in the reference table above.
  • If the cookie is absent, the visitor has no stored choice (first visit, cleared cookies, or an expired cookie). Apply the default behavior for the visitor's region — do not assume consent was granted or denied.
  • For opt-out enforcement, check notOptedOut: false means the visitor is opted out of targeted advertising / data sale, and server-side events for selling or sharing vendors should be suppressed.
  • The client-side CMP remains the source of truth. If the visitor changes their choice after the page is rendered, the consentChanged event fires in the browser and the cookie is updated; the new state reaches your server on the next request. Forward consentChanged payloads to your server if you need mid-page updates.

Key Information Summary​

  • Storage Location: A first-party cookie named polaris_consent_settings, set on the site's root domain with a 180-day expiration; sent to your servers on page requests
  • Regional Differences: Default values differ between EU and US regions, with EU having stricter defaults (most permissions set to false)
  • GTM Integration: The consent settings map to specific Google Tag Manager variables for tracking purposes
  • UUID Generation: Each user gets an anonymous UUID for consent tracking
  • Essential Cookies: Always permitted by default in both regions
Last updated on