Server-Side Consent Cookie

Biskoui can expose a visitor's consent choice in a documented first-party cookie. Use it when your backend must make consent-dependent decisions, such as choosing between personalized and anonymous recommendations.

The feature is disabled by default. Enable Server-readable consent cookie in the banner settings.

Cookie contract

Property	Value
Name	biskoui_consent_v1
Encoding	URL-encoded JSON
Path	/
SameSite	Lax
Secure	Enabled on HTTPS
Lifetime	Fixed from the visitor's choice and not renewed by page loads
Domain	Host-only normally; parent domain when cross-subdomain consent sharing is enabled
JavaScript access	Yes, because the Biskoui SDK maintains the cookie

Decoded value:

{
  "version": 1,
  "acceptedServices": ["google_analytics", "google_ads"],
  "configurationHash": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "decidedAt": "2026-08-28T12:00:00.000Z",
  "expiresAt": "2027-02-28T12:00:00.000Z"
}

Field	Meaning
version	Cookie schema version. Currently 1.
acceptedServices	Accepted service stable names. An empty array means that all optional services were rejected.
configurationHash	SHA-256 fingerprint of the service names in the banner configuration.
decidedAt	Time of the explicit accept, reject, or customized choice.
expiresAt	Fixed expiry of the choice.

The configured validity period defaults to six months and can be set from 1 to 24 months. Returning visits do not extend expiresAt. See Consent Validity.

Disabling the feature removes the public cookie the next time the SDK initializes.

Safe interpretation

Grant consent-dependent processing only when all of these conditions are true:

• the cookie is present and valid JSON;
• version is 1;
• expiresAt is in the future;
• acceptedServices contains the required stable service name.

Any missing, expired, malformed, or unsupported value must be treated as denied. An empty acceptedServices array is also denied.

Node.js

This example uses the standard Cookie request header and requires no cookie package:

function readCookie(header, name) {
  for (const part of (header || "").split(";")) {
    const item = part.trim();
    const separator = item.indexOf("=");
    if (separator < 0) continue;
    if (item.slice(0, separator) === name) {
      return item.slice(separator + 1);
    }
  }
  return null;
}

function hasBiskouiConsent(request, service) {
  try {
    const encoded = readCookie(request.headers.cookie, "biskoui_consent_v1");
    if (!encoded || encoded.length > 4096) return false;

    const consent = JSON.parse(decodeURIComponent(encoded));
    const expiresAt = Date.parse(consent.expiresAt);

    return (
      consent.version === 1 &&
      Number.isFinite(expiresAt) &&
      expiresAt > Date.now() &&
      typeof consent.configurationHash === "string" &&
      /^[0-9a-f]{64}$/.test(consent.configurationHash) &&
      Array.isArray(consent.acceptedServices) &&
      consent.acceptedServices.every((name) => typeof name === "string") &&
      consent.acceptedServices.includes(service)
    );
  } catch {
    return false;
  }
}

const analyticsGranted = hasBiskouiConsent(request, "google_analytics");
const adsGranted = hasBiskouiConsent(request, "google_ads");

This works with Node's IncomingMessage, Express's req, and frameworks that expose the original request cookie header.

PHP

function has_biskoui_consent(string $service): bool
{
    $encoded = $_COOKIE['biskoui_consent_v1'] ?? null;
    if (!is_string($encoded) || strlen($encoded) > 4096) {
        return false;
    }

    try {
        $consent = json_decode(
            rawurldecode($encoded),
            true,
            16,
            JSON_THROW_ON_ERROR
        );
    } catch (Throwable $error) {
        return false;
    }

    $expiresAt = strtotime($consent['expiresAt'] ?? '');
    $configurationHash = $consent['configurationHash'] ?? null;

    return ($consent['version'] ?? null) === 1
        && $expiresAt !== false
        && $expiresAt > time()
        && is_string($configurationHash)
        && preg_match('/^[0-9a-f]{64}$/D', $configurationHash) === 1
        && is_array($consent['acceptedServices'] ?? null)
        && in_array($service, $consent['acceptedServices'], true);
}

$analyticsGranted = has_biskoui_consent('google_analytics');
$adsGranted = has_biskoui_consent('google_ads');

Cross-subdomain behavior

Normally the cookie is host-only. A cookie set by www.example.ch is therefore not sent to shop.example.ch.

When cross-subdomain consent sharing is enabled, Biskoui scopes the cookie to the configured parent domain, such as:

Domain=example.ch

Only enable this scope when all affected applications belong to the same consent configuration and trust boundary.