> ## Documentation Index
> Fetch the complete documentation index at: https://dev.gojiberry.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Website visitors and cookie consent

> Which cookies the Website visitors script sets, and how to start it only after a visitor accepts your cookie banner.

The Website visitors source identifies the **companies** that visit your site, never the person. It runs on a tracking script you install on your website, which stores cookies in the visitor's browser. Where the law requires consent for cookies (for example under the GDPR in Europe), start the identification only after the visitor accepts your cookie banner. This page shows how.

<Note>
  You are the data controller for your site. Before installing the script, Gojiberry asks you to confirm that you have a privacy notice, a consent mechanism, and the authority to install it.
</Note>

## What the script stores

The script keeps first-party cookies on your domain for up to **1 year**, to recognize returning visitors. With consent mode on, it stores nothing until the visitor accepts.

Example wording for your cookie policy:

> We use Gojiberry to find out which companies visit our website. Gojiberry matches visitors' IP addresses to the company they work for and records the pages they view, at the company level. It keeps first-party cookies for up to one year to recognize returning visitors.

## Start tracking only after consent

Your snippet is in Gojiberry, on the Website visitors source of your agent (**Add leads → Website visitors → View script**), and in the "Install your Goji website visitor tracking snippet" email. It contains a commented-out consent line:

```html theme={null}
<!-- Goji Website visitors -->
<!-- Cookie banner: to track only after consent, uncomment the next line and call window.GojiberryVisitors.init() from your banner's "Accept" handler. -->
<!-- <script>window.GojiberryVisitors=window.GojiberryVisitors||{init:function(){window.GojiberryVisitors.initCalled=true}};</script> -->
<script async src="https://visitor.wv.gojiberry.ai/wv.js?uid=YOUR_USER_ID&aid=YOUR_AGENT_ID"></script>
```

<Steps>
  <Step title="Uncomment the consent line">
    Remove the `<!--` and `-->` around the second `<script>` line, and keep it **before** the `wv.js` script. Leave the rest unchanged:

    ```html theme={null}
    <!-- Goji Website visitors -->
    <script>window.GojiberryVisitors=window.GojiberryVisitors||{init:function(){window.GojiberryVisitors.initCalled=true}};</script>
    <script async src="https://visitor.wv.gojiberry.ai/wv.js?uid=YOUR_USER_ID&aid=YOUR_AGENT_ID"></script>
    ```

    With this line, the script loads but waits: no identification runs and nothing is stored in the browser.
  </Step>

  <Step title="Call init() when the visitor accepts">
    In your cookie banner's "Accept" handler, call:

    ```js theme={null}
    window.GojiberryVisitors.init();
    ```

    The identification then starts. Ready-made examples for common banners are [below](#examples-by-cookie-banner).
  </Step>

  <Step title="Call it again on every page for returning visitors">
    The choice isn't remembered by Gojiberry: call `init()` on **every page load** where the visitor has already accepted. Most banners fire their accept event on page load when consent was given earlier; if yours doesn't, check its stored consent and call `init()` yourself.
  </Step>
</Steps>

You can call `init()` at any time, even before `wv.js` has finished loading: the consent line remembers the call. Calling it twice does nothing more.

<Warning>
  Without the consent line, the identification starts as soon as the page loads and sets its cookies right away. The script doesn't detect your cookie banner on its own: the consent line is the only consent gate.
</Warning>

## Examples by cookie banner

Pick the consent category that your privacy notice lists company identification under, usually **marketing**.

<Tabs>
  <Tab title="Any banner">
    ```js theme={null}
    // Wherever your banner reports that the visitor accepted.
    function onCookieConsentAccepted() {
      window.GojiberryVisitors.init();
    }
    ```

    If your banner stores the choice itself, apply it on page load too:

    ```js theme={null}
    if (localStorage.getItem('cookie_consent') === 'granted') {
      window.GojiberryVisitors.init();
    }
    ```
  </Tab>

  <Tab title="Cookiebot">
    Cookiebot fires `CookiebotOnAccept` when the visitor accepts, and on later page loads when they had already accepted.

    ```html theme={null}
    <script>
      window.addEventListener('CookiebotOnAccept', function () {
        if (Cookiebot.consent.marketing) {
          window.GojiberryVisitors.init();
        }
      });
    </script>
    ```
  </Tab>

  <Tab title="OneTrust">
    OneTrust calls `OptanonWrapper` on load and each time the choice changes. `C0004` is the default id of the Targeting category; use the id of the category you picked.

    ```html theme={null}
    <script>
      function OptanonWrapper() {
        if (window.OnetrustActiveGroups && OnetrustActiveGroups.indexOf('C0004') !== -1) {
          window.GojiberryVisitors.init();
        }
      }
    </script>
    ```

    If your site already defines `OptanonWrapper`, add the `if` block inside it rather than defining it twice.
  </Tab>

  <Tab title="Google Tag Manager">
    Keep the snippet, with its consent line, in your site's `<head>`. Then create a **Custom HTML** tag:

    ```html theme={null}
    <script>
      window.GojiberryVisitors && window.GojiberryVisitors.init();
    </script>
    ```

    Fire it with the trigger your consent setup uses: for example a custom event your banner pushes on accept, or a tag that requires consent for `ad_storage` with Consent Mode.
  </Tab>
</Tabs>

## Alternative: load the whole snippet after consent

Some setups block every third-party script until consent, for example a Google Tag Manager tag that fires only after consent, or a banner that only activates blocked scripts after "Accept". In that case, add the snippet **without** the consent line to that tag or blocked script. It then loads, and starts identifying, only once the visitor accepts.

The difference: with the consent line, your site requests the Gojiberry loader on every page, and only the identification waits for consent. Loading the whole snippet after consent means no request goes to Gojiberry before "Accept".

## Check that it works

1. Open your site in a private window and open the browser's developer tools.
2. Before accepting, the **Network** tab shows `wv.js` but no request to `visitor.app.gojiberry.ai`, and **Application → Cookies** shows no new cookie on your domain.
3. Accept the banner: a script loads from `visitor.app.gojiberry.ai`, and the cookies appear.

The **Verify now** button in Gojiberry works without accepting the banner: it only checks that `wv.js` loads on your saved domains.

## Content Security Policy

If your site sends a Content Security Policy header, allow these hosts:

* `script-src`: `https://visitor.wv.gojiberry.ai` and `https://visitor.app.gojiberry.ai`
* `connect-src`: `https://visitor.api.gojiberry.ai`

## Good to know

* **Withdrawn consent.** Once the identification has started on a page, it keeps running until the visitor leaves or reloads that page (on single-page sites, until a full reload). If your banner no longer calls `init()`, it doesn't start on the next pages. To also delete the cookies at that moment, call `window.Gojiberry && window.Gojiberry.denyCookieConsent && window.Gojiberry.denyCookieConsent();`.
* **Countries.** The identification only runs for visitors from the countries your agent targets. Other visitors receive an empty script, accepted banner or not.
* **Billing.** Consent changes nothing in billing: only a company's first identified visit is billed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.