SDK: no consent / DNT / opt-out gate — writes localStorage + tracks unconditionally (EU blocker)

[jean9ross]

The SDK writes localStorage and tracks unconditionally, with no consent / Do-Not-Track / opt-out gate. This legally blocks onboarding any EU customer.

Need a consent gate (respect DNT, an explicit opt-out API, and a no-storage mode) before any visitor data is written or sent.

Source: 2026-07 platform audit (ember/docs/PLATFORM_AUDIT_2026-07.md), "SDK (flame) gaps that break the primary install path" + Phase 2.

[jean9ross]

Design locked (2026-07-12) — mechanism is ours to build; two defaults are counsel-gated

Ready-to-build design, confirmed with Jeannine. The mechanism has no legal dependency; the two legal defaults below are built as flippable flags so counsel can set them without a rebuild.

Locked design:

• API: flame.consent(true) grants (persist deviceId + flush buffered events + track); flame.consent(false) opts out (stop + clear stored data). Boolean — "pending" = no consent() call yet (internal state, not an API value).
• Posture: a single requireConsent flag; when on (data-consent="required"), gating applies. Default is opt-in (off) for now — see counsel Q1.
• Pre-consent: assignment runs on an in-memory session deviceId + variants apply; no localStorage, no /events until consent → then persist + flush.
• DNT/GPC: navigator.doNotTrack==='1' or navigator.globalPrivacyControl → default to not-track/persist.
• Architecture: a central consent.ts gate (canPersist() / canTrack() / setConsent()), threaded through identity (deviceId persist), assignment (cache persist), tracking (buffer /events).

⚖️ Two counsel-gated decisions (built as flippable flags — need a legal call before final)

1. Posture default — opt-in vs. default-gated. Ship default-off (backward-compatible; sites opt in via data-consent="required"), or default-on (privacy-forward, EU-safe, but every site must call consent() or lose tracking)? Pre-launch, breaking cost is ~nil, so default-gated is cheaper to adopt now than later. Flag flippable.
2. GPC-vs-explicit-consent precedence — the sharp one. GPC is a legally binding opt-out in some US states. Does a site's consent(true) override a browser GPC signal, or does GPC win (consent can't re-enable tracking against a browser-level legal opt-out)? Building "GPC wins" as the safer default — letting a site override a legally-recognized signal is a liability. Flag flippable; needs counsel.

Both relate to cuped-io/spark#4 (legal copy, pending counsel) — the consent mechanism here and the legal copy there should agree.

Next: red-first build (unit tests: no storage/no /events pending → flush on grant; + a consent-gated e2e page). Design is fully specified; no rework needed.