> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://contentful.com/developers/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://contentful.com/_mcp/server.

# Privacy plugin

> Make sure that data transfer is only sent and received based on your visitor's consent.

The Privacy Plugin allows you to granularly control what Contentful Personalization SDK events can trigger and what properties those events can contain with and without your visitors' consent.

The values you pass as configuration when instantiating the plugin determine what events and properties can be sent *before or without* your user's consent. The plugin provides a `consent` method  when called allows all Contentful Personalization SDK events to be triggered with any properties.

## Installation

Add `@ninetailed/experience.js-plugin-preview` as a dependency:

#### npm

```bash
npm install @ninetailed/experience.js-plugin-privacy
```

#### yarn

```bash
yarn add @ninetailed/experience.js-plugin-privacy
```

Then, add the plugin to the instance. If you do not supply any configuration options to the plugin, it will use the defaults described in the [Properties](#properties) section.

#### React, Next.js

```jsx
import { NinetailedPrivacyPlugin } from '@ninetailed/experience.js-plugin-privacy'
```

```jsx
<NinetailedProvider
  // ...
  plugins={[
    new NinetailedPrivacyPlugin()
  ]}
>
  <Component {...pageProps} />
</NinetailedProvider>;
```

#### Gatsby

In Gatsby, add the plugin to the plugins array:

```javascript
plugins: [
    // ...
    {
        resolve: `@ninetailed/experience.js-gatsby`,
        options: {
            clientId: PUBLIC_NINETAILED_CLIENT_ID,
            environment: PUBLIC_NINETAILED_ENVIRONMENT,
            ninetailedPlugins: [
                {
                    resolve: `@ninetailed/experience.js-plugin-privacy`,
                    options: {}
                }    
            ]
        }
    }
]
```

#### JavaScript

```javascript
import { Ninetailed } from '@ninetailed/experience.js';
import { NinetailedPrivacyPlugin } from '@ninetailed/experience.js-plugin-privacy'

export const ninetailed = new Ninetailed(
    { 
        clientId: // Your client ID 
        environment: // Your Ninetailed environment
    }, 
    { 
        plugins: [
            new NinetailedPrivacyPlugin();
        ]
    }
);
```

## Properties

Use these properties in the configuration objects passed when instantiating the plugin. Passing blank configuration objects will use the default values.

| Property Name                 | Description                                                                               | Default             | Available                                                                                                                                                                                                                                                                                                  |
| ----------------------------- | ----------------------------------------------------------------------------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `allowedEvents`               | Which events you want to allow?                                                           | `['page', 'track']` | An array containing any of `page`, `track`, `identify`, and/or `component`. The former three correspond to Experience SDK events. `component` corresponds to impression events sent from Contentful Personalization plugins, including the Insights Plugin, Google Tag Manager Plugin, and Segment Plugin. |
| `allowedPageEventProperties`  | Which page event properties will be allowed?                                              | `[*]`               | An array of your page event properties as strings or use `[*]`                                                                                                                                                                                                                                             |
| `allowedTrackEvents`          | What `.track` event names will be allowed?                                                | `[]`                | An array of your `track` event names as strings or use or use `[*]`                                                                                                                                                                                                                                        |
| `allowedTrackEventProperties` | What `.track` event properties (additional data on a track event) will be allowed?        | `[]`                | An array of your `track` event properties as strings or use or use `[*]`                                                                                                                                                                                                                                   |
| `allowedTraits`               | What user traits will be allowed?                                                         | `[]`                | An array of your `.identify` event traits or use or use `[*]`                                                                                                                                                                                                                                              |
| `blockProfileMerging`         | Shall the merging of profiles (attaching an ID to a profile via `identify`) be prevented? | `true`              | `true` or `false`                                                                                                                                                                                                                                                                                          |
| `enabledFeatures`             | What additional features should be enabled?                                               | `[]`                | `location`. Enables resolution of location data (continent, country, region, city, and zip code) of the user, `ip-enrichment` Enables the Albacross integration (if an Albacross API key has been provided) to attach firmographic data as traits                                                          |

## Configuration

The first configuration object uses the [properties](#properties) above to indicate what events and behaviours are allowed prior to end-user consent.

SDK versions 7.7 and above add a second configuration parameter to specify what tracking events and behaviours are allowed even after a user has consented. This configuration parameter uses the same properties.

### Example custom use

This example configuration demonstrates overriding the default to allow only `page` and `identify` events to be sent and for those `identify` event calls to only capture the `firstName` trait prior to user consent.

Additionally, a second configuration object is passed to indicate that all of `page`, `track`, `identify` and `component` events are allowed, in addition to the `lastName` trait and track events of type `myCoolEvent` and `anotherCoolEvent` are allowed.

All unspecified config object options use their default values.

#### React, Next.js

```jsx
<NinetailedProvider
   // ...
    plugins={[
      new NinetailedPrivacyPlugin({
        allowedEvents: ['page', 'identify'],
        allowedTraits: ['firstName'],
      // SDK versions >= 7.7 Allow a second config object
      }, {
        allowedEvents: ['page', 'track', 'identify', 'component'],
        allowedTraits: ['firstName', 'lastName'],
        allowedTrackEvents: ['myCoolEvent', 'anotherCoolEvent']
      }),
     ]}
  >
   // ...
 </NinetailedProvider>
```

#### Gatsby

```javascript
plugins: [
    // ...
    {
        resolve: `@ninetailed/experience.js-gatsby`,
        options: {
            clientId: PUBLIC_NINETAILED_CLIENT_ID,
            environment: PUBLIC_NINETAILED_ENVIRONMENT,
            ninetailedPlugins: [
                {
                    resolve: `@ninetailed/experience.js-plugin-privacy`,
                    // Gatsby implementations only support the first at this time
                    options: {
                        allowedEvents: ['page', 'track', 'identify'],
                        allowedTraits: ['firstName'],
                    }
                }    
            ]
        }
    }
]
```

#### JavaScript

```javascript
import { Ninetailed } from '@ninetailed/experience.js';
import { NinetailedPrivacyPlugin } from '@ninetailed/experience.js-plugin-privacy'

export const ninetailed = new Ninetailed(
    { 
        clientId: // Your client ID 
        environment: // Your Ninetailed environment
    }, 
    { 
        plugins: [
            new NinetailedPrivacyPlugin({
                allowedEvents: ['page', 'identify'],
                allowedTraits: ['firstName'],
              // SDK versions >= 7.7 Allow a second config object
              }, {
                allowedEvents: ['page', 'track', 'identify', 'component'],
                allowedTraits: ['firstName', 'lastName'],
                allowedTrackEvents: ['myCoolEvent', 'anotherCoolEvent']
            }),
        ]
    }
);
```

## Confirm user consent

The plugin attaches a `consent` method to the `window.ninetailed` object. The consent method takes a single boolean argument. When the argument is `true`, this sets a localStorage entry of `__nt-consent__: "accepted"`. When not called or the argument is set to `false`, the `__nt-consent__` local storage entry is cleared. Call this method in your client-side application when a user has taken an action that indicates their explicit consent.

```javascript
window.ninetailed.consent(true) // sets `__nt-consent__: "accepted" in local storage
window.ninetailed.consent(false) // clears `__nt-consent__` from local storage
```

> Make sure that data transfer is only sent and received based on your visitor's consent.