@cookiechimp/core consent engine
as the CookieChimp web SDK.
This package is in development and is not yet published to npm. See
release status.
What it does
- Shows the banner and preferences you design in the CookieChimp dashboard as native screens, with your copy, translations, colors and button settings.
- Picks the right banner for the user’s country or US state and applies GDPR (opt-in) or CCPA (opt-out) rules from the banner’s consent mode.
- Stores the decision on the device and asks again when it expires or when you require re-consent in the dashboard.
- Sends consent records to CookieChimp, queued and retried while offline.
- Starts and stops your analytics and advertising SDKs as consent changes.
- Needs no custom native code beyond AsyncStorage, so it works in Expo Go, development builds and bare React Native apps.
Install
npx expo install @cookiechimp/react-native @react-native-async-storage/async-storage.
In a bare app, run npx pod-install afterwards. React Native 0.80 or newer
(Expo SDK 54 or newer) and React 18 or newer are supported. Older React Native
versions ship an incomplete URL implementation: install
react-native-url-polyfill and import react-native-url-polyfill/auto first.
Quick start
Wrap your app withCookieChimpProvider and your account ID from the dashboard.
Connected and offline modes
Connected mode (accountId) downloads the dashboard config, caches it on the
device and renders from the cache on later launches. It revalidates with an ETag
in the background and again when the app returns to the foreground after five
minutes, so dashboard changes reach users without an app release.
Offline mode (config) uses a config file you download from the dashboard
(Setup, Download Config) and ship inside the app. No config requests are made.
Consent records are still delivered when the device is online.
Region and language
The region selects which dashboard banner applies and whether its opt-out (CCPA) rules can be used. By default the SDK never looks up the user’s location.country="DE"orcountry="US-CA"always wins. Pass it when your app already knows the user’s country, for example from your own backend.- Otherwise, with
geolocationand anaccountId, the SDK asks CookieChimp’s own first-party endpoint for the connection’s country (one small IP-based request on launch). No third-party location service is contacted and device location permissions are never used. This is off unless you opt in. - Without a region, the dashboard’s default banner is shown with the safe GDPR fallback: optional categories stay off until the user chooses, even when the default banner is an opt-out banner.
en-US) is a language setting, not a location, and
is never used to choose the region.
The language defaults to the device language and falls back to the first
language the banner has. Override it with language="fr".
Provider props
Reading and changing consent
Use hooks inside the provider:
Or use the
CookieChimp object anywhere, including outside React:
CookieChimp.run(options) starts the SDK without the provider, for example in
index.js before React mounts. Render <CookieChimpProvider> without
accountId or config to show the built-in UI for an SDK started this way.
Controlling vendor SDKs
Register each analytics or advertising SDK with the category it belongs to. The SDK callsonStart when consent allows it and onStop when consent is
withdrawn. Nothing starts before consent where consent is required.
onStart. getVendors(), isVendorRunning(name), startVendor(name),
stopVendor(name) and unregisterVendor(name) are also available.
Design settings
The built-in screens follow the banner design you set in the dashboard:
Categories and vendors expand with an animation to show their purpose, the
company and the privacy policy. Banners and preferences animate in and out, and
animations are skipped when the device asks for reduced motion.
Vendor data labels
Mobile SDKs do not set cookies, so each vendor shows its data labels from the dashboard instead, in the same shape as Apple’s App Privacy details and Google Play’s Data safety section:
SDKs added from the dashboard’s library come with these filled in, and you can
edit them per SDK. For a custom UI,
appData(service.app_data) validates a
vendor’s labels, and DATA_TYPES and PURPOSES hold their English names.
Custom UI
Setui={false} and build your own screens with the hooks, or render
<ConsentBanner /> and <ConsentPreferences /> yourself where you want them.
Consent records
Each decision is stored on the device first and then sent to CookieChimp (POST /api/v1/mobile-sdk/sync/{accountId}) with the platform (ios or
android), banner, language, accepted and rejected categories and services,
and the decision time. Device identifiers, user IDs and advertising IDs are
never sent. Records wait in a queue of up to 50 while the device is offline,
retry with backoff and are sent again when the app returns to the foreground.
Delivery is idempotent, so a retry never creates a duplicate.
Storage
The decision, the cached config and queued records are stored in AsyncStorage under keys starting with@cookiechimp:. Pass storage to use another store
with the same getItem, setItem, removeItem and getAllKeys methods.
Debugging
debug logs the selected banner, region, language, regulation and every
decision. CookieChimp.reset() clears the stored decision so you can test the
first-launch flow again.
MIT licensed.