Consent Docs
Open console

Build a privacy page

Give signed-in users a page that lists what they agreed to and lets them withdraw, with two calls from your server.

Tutorial2 min readFor everyone new to the product

Build an account page where a signed-in user sees every choice you hold for them and withdraws with one button. It takes about 20 minutes and continues from the sign-up tutorial.

Before you start#

  • The secret key, consent.mjs and the record from Record sign-up consent.
  • Express. Run npm install express in the same project.

Give the key two scopes#

A scope is a permission on a secret key. Each call that acts on a person as a whole needs its own scope.

  1. In the console, open Install and choose Scopes on your key.
  2. Tick Find a person’s records by your identifier.
  3. Tick Withdraw everything a person agreed to.
  4. Choose Save scopes.

The console confirms with Scopes saved, and the key shows the Find and Withdraw all badges.

Write the page#

The page uses two calls. findSubject lists every record held for the person, on every form. withdrawSubject withdraws every consent they gave.

privacy.mjsJavaScript
import express from 'express';
import { client } from './consent.mjs';

const app = express();
const user = { id: 'usr_8f2K1xQz' };

const esc = (text) =>
  String(text).replace(/[&<>"]/g, (c) => `&#${c.charCodeAt(0)};`);

function choice(decision) {
  const answer = decision.granted ? 'Allowed' : 'Not allowed';
  return `<li>${esc(decision.purposeName)}: ${answer}</li>`;
}

function card(record) {
  const choices = record.decisions.map(choice).join('');
  return `<h2>${record.status}</h2><ul>${choices}</ul>`;
}

const withdrawForm = `
  <form method="post" action="/account/privacy/withdraw">
    <button>Withdraw all</button>
  </form>`;

app.get('/account/privacy', async (req, res) => {
  const found = await client.findSubject(user.id, 'USER_ID');
  const cards = found.records
    .filter((record) => !record.erasedOn)
    .map(card);
  res.send(`<h1>Your choices</h1>${cards.join('')}${withdrawForm}`);
});

app.post('/account/privacy/withdraw', async (req, res) => {
  await client.withdrawSubject(user.id, 'USER_ID', {
    reason: 'Withdrawn on the account privacy page',
  });
  res.redirect('/account/privacy');
});

app.listen(4816);

user stands for the signed-in user from your own session. Send the same identifier and type you recorded the consent under.

See the choices#

  1. Run node privacy.mjs, with PIEDAP_SECRET_KEY set as before.
  2. Open http://localhost:4816/account/privacy.

The page shows the record from the sign-up tutorial:

PARTIAL
Course updates by email: Allowed
Class reminders by SMS: Not allowed

A record matches when your identifier is the one it was recorded under, or one that was linked to it. A test key sees test records, and a live key sees live records.

Withdraw#

  1. On the page, choose Withdraw all.
  2. In the console, open Records, type usr_8f2K1xQz in the search box and choose Find.
  3. Select the record.

The page now shows WITHDRAWN, with every purpose that can be declined set to Not allowed. The console shows the same status, and the withdrawal is sealed in the record's history with your reason. A consent.withdrawn webhook goes out for each record withdrawn.

Withdrawing keeps the person's identifiers. Choosing the button again changes nothing.

Your deployment serves a privacy notice and a rights request form for you. Add both links to the page, with your publishable key in the address. To get the key, choose Copy on your key in Install.

HTML
<a href="https://console.dpconsent.com/consent/sdk/v1/pages/pk_…/privacy">
  Privacy notice
</a>
<a href="https://console.dpconsent.com/consent/sdk/v1/pages/pk_…/request">
  Make a rights request
</a>

Open the first link. You see a privacy notice built from the purposes your team set up in the console. The key in the address is public, so the links are safe to publish.

Next steps#

↑↓ to move, Enter to open