On this page
Where: Configuration › Privacy center. Owners and admins can edit it, and the next request after saving follows the new rules.
How the region is decided
From the country of the visitor's network address, in six regions: the European Economic Area, the UK, California, the rest of the US, China, and everywhere else.
Each region can override these, falling back to the project default when left empty:
- Collection level (1, 2 or 3 — see How visitors are counted without cookies)
- Whether consent is required
- IP shortening (IPv4 and IPv6 set separately)
- Location precision: city, country, or none
Defaults
The EEA and the UK default to level 2 with consent required. Every other region defaults to level 2 without a consent requirement.
Consent required, but not given
This is often misunderstood. When consent is required and the request doesn't carry consent for analytics:
- That visit drops to level 1 (anonymous aggregate).
- Pageviews and custom events are still stored, using an anonymous identifier that changes daily.
- Autocapture, identity linking and device identifiers don't run.
So switching on "require consent" doesn't empty your real-time report. What goes missing is autocapture and user-level data.
Consent has three purposes: analytics, functional and marketing. Events before a choice is made are queued by default and handled once the visitor decides; you can drop them instead.
Passing the choice to us
If your site already has a consent banner (a CMP), pass the visitor's choice to the analytics script once they've made it. The wiring differs between consent tools, so ask us in the chat when you set it up and we'll give you the code for the one you use. If you have no banner and operate where consent is needed, consider keeping identity features off and relying on the default cookieless analytics.
China mode
For apps and mini programs in mainland China, app stores and platforms usually require that nothing is collected before the user accepts the privacy policy. With China mode on:
- The SDK doesn't initialise until consent is granted and sends nothing before that.
- After a refusal, the cooling-off period is 7 days by default.
- China-specific export counting and data-request deadlines are enabled.
China mode adds to the regional rules; it doesn't turn off the EEA consent requirement.
Children
Products for children can switch on children's mode: level 1 enforced, no identifiers at all, and shorter retention for detail.
One-click presets
The privacy center has two presets that set the related options together:
- Anonymous analytics without consent — for sites that want basic analytics and no consent handling.
- Identified with full consent — for products with sign-in, cross-device analysis and an existing consent flow.
After applying a preset, locked options must be unlocked before you can edit them by hand.
A reminder
Laws differ on what needs consent. This article describes what the product can do; it isn't legal advice. Check with your legal team before going live.