DOCSEARCHbyAlgolia
Submit Docs

TrueVault Developer Documentation

website·Indexed 39 days ago

https://developers.truevault.com

Documentation for TrueVault's privacy and consent management tools, including the Polaris CMP, cross-platform consent APIs, and automation integrations for Shopify, Stripe, HubSpot, Zendesk, and Klaviyo. Covers setup for Google Tag Manager, DNS configuration for privacy email, and implementation of the IAB Global Privacy Platform (GPP).

Tokens
31.7K
Snippets
68
Records
208
Agent score
55%

What's inside TrueVault

  1. Overview of TrueVault GPP Implementation

    TrueVault's Consent Management Platform (CMP) implements the IAB Global Privacy Platform (GPP) specification to communicate user privacy signals to downstream vendors and ad-tech partners. The GPP API is available on every page where the TrueVault CMP script is installed, regardless of the banner variant or configuration (including cases where no banner is displayed).

  2. Overview of Polaris Custom API Endpoint Integration

    Polaris allows you to send automation requests to your own downstream systems via custom API endpoints. This enables the automatic processing of privacy requests—specifically Lookup, Access, Opt-Out, and Deletion—within your own custom applications and databases. This functionality is a paid add-on and requires activation via a Customer Success representative.

  3. Overview of Page Session Consent Events

    Page Session Consent Events are one-time-per-page-load browser signals emitted by the CMP in response to specific user consent actions. Unlike the consentChanged event, which fires multiple times and carries the full state, these events are designed as signals that fire at most once per page load. They are primarily used for advanced tag-management setups (like Google Tag Manager) where triggers need to react to a specific event name rather than inspecting a payload.

    Key characteristics:

    • Event Target: window
    • Event Type: CustomEvent
    • Bubbles: true
    • Trigger: Only in response to a user action (not automatic state changes or initial page load defaults).
    • Frequency: Fires at most once per page load per event name.
    • Payload: event.detail contains the current consent settings (same shape as consentChanged), though the event name itself is the primary signal.

  4. Overview of TrueVault Cross-Platform Consent Management

    TrueVault's Consent Management Platform (CMP) allows logged-in consumers to maintain consistent privacy preferences across multiple devices and browsers. The system identifies consumers using platform-specific identifiers (such as Shopify customer IDs or email addresses), generates privacy-preserving JWTs to represent the consumer, and stores preferences in a secure database. When a consumer visits from a new device, the CMP automatically retrieves their stored preferences.

  5. Link the 'Consent Changed' trigger to GTM tags

    To ensure tags load or unload dynamically when a user updates their consent, link them to the 'Consent Changed' trigger:

    1. Go to Tags and click the Shield Icon (Consent Overview).
    2. Select the tags that require the trigger.
    3. Click the three dots (...) in the upper right and select Edit Triggers.
    4. Add the Consent Changed trigger to the 'Firing Triggers' list.
    5. Save and publish the container.

  6. Bulk configure GTM tags using Consent Overview

    Consent Overview allows you to apply consent signals to multiple tags simultaneously.

    Enable Consent Overview:

    1. In GTM, go to Admin → Container Settings.
    2. Select Enable Consent Overview and save.
    3. Return to Workspace → Tags and click the shield icon.

    Apply requirements in bulk:

    1. Select tags with the same purpose and required signal.
    2. Click Edit Consent Settings (shield-and-cog icon).
    3. Under Additional consent settings, add the appropriate signal and save.

  7. Prevent tags from loading for opted-out consumers using GTM

    TrueVault provides a GTM integration that controls a consent signal to block scripts and tracking pixels for opted-out consumers. When a consumer opts out via the opt-out workflow, the consent signal is set to 'Denied', preventing any tags requiring that signal from executing.

  8. Integrate TrueVault consent banner with Google Tag Manager

    TrueVault integrates with Google Tag Manager (GTM) by collecting visitor consent choices and sending corresponding consent signals to GTM. GTM then evaluates these signals against the consent requirements assigned to specific tags before allowing them to fire. For example, analytics tags may require analytics_storage, advertising tags may require ad_storage, and tags involving the sale or sharing of personal information may require the tv_not_opted_out signal.

    Prerequisites:

    • Complete the site-wide steps in the TrueVault Getting Started guide.
    • Ensure polaris.js loads before the GTM container on every page.

  9. Understand TrueVault's Google Consent Mode V2 implementation

    TrueVault's GTM template implements Google Consent Mode V2, allowing the Consent Management Platform (CMP) to communicate user consent choices to Google tags (GA4, Google Ads, Floodlight) using granted or denied signals. This ensures compliance for users in the EEA, UK, and Switzerland. Key signals include ad_user_data and ad_personalization, which are required for Google advertising products in these regions.

  10. Understand TrueVault Shopify Consent Request Flow

    TrueVault uses Shopify's App Proxy to securely communicate consent preferences. The flow is as follows:

    1. The CMP JavaScript loads on the Shopify storefront.
    2. The CMP requests consent data from the store's proxy URL.
    3. Shopify proxies the request to TrueVault's backend, adding authentication and customer information.
    4. TrueVault returns existing preferences or creates a new record.
    GET https://example-store.myshopify.com/apps/truevault/api/v1/cmp/consent?privacy_center_id=YOUR_TV_PRIVACY_CENTER_ID&provider=shopify&client_id=550e8400-e29b-41d4-a716-446655440000

  11. Technical Architecture of the Consent System

    The cross-platform consent system is composed of four primary components:

    1. Consent API: RESTful endpoints used to retrieve and update preferences.
    2. Provider Authentication: Verification of consumer identity (e.g., via Shopify).
    3. JWT Generation: Creation of privacy-preserving tokens representing the consumer.
    4. Storage Layer: Persistence layer with automatic Time-To-Live (TTL) management.

  12. Understand how TrueVault email forwarding works

    Email Forwarding allows customers to email your existing privacy address (e.g., privacy@yourcompany.com) while TrueVault manages the workflow.

    The process flow:

    1. A privacy@yourcompany.com address is established within TrueVault.
    2. TrueVault provides a unique forwarding address in Account Settings > Domain.
    3. Your email admin creates a rule to forward messages from your public privacy address to the TrueVault forwarding address.
    4. TrueVault receives messages via its secure inbound service and displays them in the privacy request workflow.
    5. Your team can reply to requests from the privacy@yourcompany.com address directly within TrueVault.

    This method is recommended over the legacy Nylas real-user inbox approach because it does not require a dedicated user mailbox or ongoing mailbox authorization, reducing the risk of intake failure due to expired credentials.