Handle consent, CSP, and flicker for the website connector

Updated Nov 8, 2026 · Based on the Salesforce Developer docs for Personalization, retrieved 2026-11-08

Before you go live on the web, handle three concerns: capture events only with consent (tracking agreement, often managed by a Consent Management Platform, or CMP), allow the Interactions SDK in your Content Security Policy (CSP, the browser rule blocking untrusted scripts), and stop personalized regions from flickering — briefly showing default content before personalized content loads.

Gate event capture behind consent

1. Call the SDK’s consent API to tell it which consent purposes (for example, tracking or personalization) a visitor has granted or denied, using updateConsents().
2. Read the visitor’s current consent state with getConsents() before deciding whether to initialize tracking.
3. Leave consent unset, or set to denied, and the SDK withholds events until consent status changes — you don’t need to block the script tag yourself.
4. If your CMP supports revoking consent, clear any cookies the SDK has already set for that visitor so tracking fully stops.

Allow the SDK in your Content Security Policy

1. The SDK’s beacon script relies on unsafe-eval (it permits dynamic code evaluation functions like eval()).
2. If your CSP blocks that and a security scanner flags it, add unsafe-inline as a documented workaround.
3. Also add unsafe-inline if you use web templates with the Handlebars Gear feature enabled.
4. Already allowing unsafe-inline without unsafe-eval? No change is needed.

Prevent personalization flicker

1. Hide the page region a campaign will personalize until the SDK confirms its decision (a “hide-then-reveal” pattern), so visitors never see default content flash before personalized content loads.
2. Set a short maximum wait (for example, a few hundred milliseconds) before revealing the default content anyway, so a slow network never leaves the region blank.
3. Test on a throttled connection with consent granted and with consent denied, confirming no visible flash in either case.