Web SDK consent does not switch off third-party cookies after setup

A privacy choice can permit some analytics while withholding permission for cross-domain identity. Those are different decisions. An Adobe Experience League question describes a team that wants to keep collecting data but stop third-party cookie behavior after a visitor's choice. Their implementation uses defaultConsent: "pending" and later calls setConsent; they find that this does not change thirdPartyCookiesEnabled after initialization.

Find the configuration boundary

Adobe documents thirdPartyCookiesEnabled as a configure option. It defaults to true and controls whether the SDK calls Audience Manager for a CORE ID. Adobe documents setConsent as a command governing whether Web SDK sends or discards data under the visitor's consent state. Treat these as separate controls; a later collection decision is not a runtime rewrite of the earlier identity setting.

Test choices, not just page loads

Draw a small consent matrix before coding. For each relevant choice, state whether events may be sent, whether Audience Manager identity is permitted, and whether the page must defer Web SDK configuration until consent is known. In a clean browser, record the calls to Edge Network and Demdex, the consent cookie, and the resulting event delivery. Repeat after changing a choice and after a new visit. Do not infer compliance from a quiet console or one browser's cookie behavior.

Decide what to initialize

If third-party identity must never run for a particular implementation, configure thirdPartyCookiesEnabled: false before sending events and confirm the resulting identity tradeoff. If policy requires a different identity setting after a later choice, design an initialization boundary that can honor it; do not promise that setConsent supplies an option Adobe does not document. Ask privacy and analytics owners to approve the matrix before rollout.

Adovo’s view

Consent is a contract between choices and network effects. One boolean cannot stand in for every purpose a visitor accepts or refuses. Make the request trace the acceptance test, then let the implementation follow the contract.