FS.consent - Capture elements with consent

FS.consent gives you the ability to selectively capture parts of your website or mobile application based on explicit user consent.

You can use FS.consent whenever a user grants or revokes consent to capture data. Depending on a user’s preference, FullStory will either capture or block specially designated elements (known as “consent-required elements”) within that user’s sessions.

Note: Only Admins or Umbrella Managers (available on select FullStory Enterprise plans) can modify privacy settings.

To make use of consent functionality, you'll need to:

• Add consent-required elements to the Excluded Elements section of your Privacy settings, and

• Call the FS.consent function from the FullStory JavaScript API when a user gives (or revokes) consent.

FS.consent(userConsents)    // userConsents is an optional boolean parameter indicating whether the user is giving consent (true, default) or revoking consent (false)

Consent-required elements are blocked by default. Calling FS.consent() or FS.consent(true) will enable capturing of all consent-required elements for the current user from that point forward. Calling FS.consent(false) will block all consent-required elements for the current user once again (useful when the user has revoked their consent).

Additional details can be found in our developer documentation.

Special Considerations

• Since FS.consent is a new function in FullStory’s JavaScript API, you’ll need to re-install your FullStory snippet in order to use it.

• As with any other excluded element, data entered into consent-required elements before FS.consent(true) is called will not be sent to FullStory. In other words, FS.consent is not retroactive.

• Consent-required elements operate in an “all or nothing” manner. This means that FS.consent(true) and FS.consent(false) will apply to all consent-required elements for the current user. It is not currently possible for users to consent to certain elements but not others.

• FS.consent only affects whether or not certain elements on a page will be captured by FullStory. Consent settings do not affect or block any other information you may be passing to FullStory about your users, e.g. with FS.identify or FS.setUserVars. If you wish to avoid passing this information in certain situations, then you should simply not make these API calls in those cases

Example

Consider the example Element data capture rules below:

Elements can be excluded without consent, masked without consent or unmasked without consent. You’ll notice that we’ve added #email and #full-name as exclude without consent and mask without consent elements. Now consider the example account creation form below:

Let’s assume that the IDs of the “Full name,” “Email,” and “Password” fields are #full-name, #email, and #password respectively. Given our Excluded Elements settings above, here’s how these fields would appear in FullStory before a user gives their consent (i.e. before you call FS.consent(true)):

All three fields are excluded from FullStory. “Full name” and “Email” are excluded because we explicitly added them; “Password” is excluded automatically because it matches input[type=password].

In order to capture the “Full name” and “Email” fields to FullStory based on the user’s consent preference, let’s call FS.consent upon submission of the form. Assuming the form has an ID of #create-account and the consent checkbox has an ID of #consent-check, then the JavaScript code to call FS.consent may look something like this:

Vanilla JavaScript

document.getElementById('create-account').onsubmit = function() {
    var consentValue = document.getElementById('consent-check').checked;
    FS.consent(consentValue);
  };

JQuery

$('#create-account').submit(function(event) {
    var consentValue = $('#consent-check').is(':checked');
    FS.consent(consentValue);
  });

Now, provided that the user gave their consent, here’s how the form would appear in FullStory after the FS.consent call:

Note that the consent-required elements are captured, but the “Password” field remains excluded regardless of consent because it matches input[type=password].