Compliance Groups
A Compliance Groupis how Consenti groups jurisdictions that share the same consent compliance rules — how consent must be collected, what "opt-out" needs to look like, whether GPC must be auto-honored, and so on. Right now that's 8 built-in Compliance Groups, covering every jurisdiction in the Jurisdiction Coverage Map— but it's not fixed to 8: extend it with your own via a custom Compliance Group (see complianceGroupsOverride below).
ComplianceGroupId in @consenti/types). In code and everywhere else in these docs, you may find them referred to as Consent Model — same 8 things, two names.The 8 built-in Compliance Groups
Standard Opt-in (GDPR) opt-in
GDPR / ePrivacy style: prior consent required before non-essential cookies. Granular consent, easy reject, easy withdrawal.
- GPC signal is ignored by default (can be changed per profile).
- Legitimate interest is a valid legal basis alongside consent.
- Compatible with IAB TCF v2.3 vendor consent.
Opt-out (US State Laws) opt-out
US state privacy laws. Collect first, allow opt-out of sale/share. Covers CCPA and all state-level equivalents.
- GPC signal is auto-honored — a GPC-specific banner variant is shown once.
- Consent is the only valid legal basis — no legitimate-interest fallback.
Colorado is a per-region exception within this group: cookies tagged cpraCategory:'sensitive' default to denied there (requiresSensitiveOptIn), same as the sale/share carve-out below, while the rest of the group's cookies still default to granted. Only takes effect with a geoip/maxmind geoDataProvider — see the CCPA/CPRA guide.
Opt-out Strict (CPRA / California) opt-out-strict
California CPRA: opt-out with sale/sharing/sensitive categories required. GPC must be honored. Stricter than general US state laws.
- GPC signal is auto-honored — a GPC-specific banner variant is shown once.
- Consent is the only valid legal basis — no legitimate-interest fallback.
- Requires CPRA sale/share/sensitive-data categories.
Opt-in (India DPDPA) opt-in-dpdpa
India's Digital Personal Data Protection Act. Opt-in consent with data fiduciary disclosure. No legitimate interest basis.
- GPC signal is ignored by default (can be changed per profile).
- Consent is the only valid legal basis — no legitimate-interest fallback.
- Requires DPDPA data-fiduciary disclosure.
Opt-in (China PIPL / DSL) opt-in-china
China PIPL + DSL + CSL: strict opt-in with purpose specification, data minimisation, and cross-border transfer controls.
- GPC signal is ignored by default (can be changed per profile).
- Consent is the only valid legal basis — no legitimate-interest fallback.
Opt-in (Brazil LGPD) opt-in-brazil
Brazil LGPD: opt-in consent required. Legitimate interest is a valid basis. Analytics and advertising may differ in treatment.
- GPC signal is ignored by default (can be changed per profile).
- Legitimate interest is a valid legal basis alongside consent.
General Privacy Consent general-privacy-consent
Privacy notice or consent rules exist but the jurisdiction does not have a GDPR/PECR-style strict cookie banner law. Documenting legal basis is best practice.
- GPC signal is ignored by default (can be changed per profile).
- Legitimate interest is a valid legal basis alongside consent.
PIPEDA, POPIA, and APPI resolve here by default automatically, but each has its own docs page recommending a stricter opt-in override — check the linked page for the specific recommendation.
Notice Only notice-only
A privacy notice is generally sufficient. No dedicated cookie banner law is encoded for this jurisdiction.
- GPC signal is ignored by default (can be changed per profile).
- Legitimate interest is a valid legal basis alongside consent.
Extending beyond the 8
Not every jurisdiction fits one of the 8 built-in groups exactly — and you might want different banner text, buttons, or cookies per country even within a group. Two options, both first-class (neither is a workaround):
- A custom Compliance Group — author a profile with a free-form
customComplianceGroupid instead of one of the 8 built-in ones, then target it withcompliance: { type: 'your-group-id' }or register it locally withregisterProfile(). Route visitors to it automatically by having yourgeoDataProviderresolve to that group id for the countries you want. complianceGroupsOverride— keep the 8 built-in groups (or your custom ones), but override text/buttons/cookies per group from a single config object instead of authoring a separate profile for each. See the full guide in complianceGroupsOverride — per-group content, one config object.
For the full country → group mapping (which is what actually decides which Compliance Group a given visitor gets), see the Jurisdiction Coverage Map.