Using , you can configure geolocation rules that determine the consent model, behaviors, and content that will be shown to site visitors from certain locations. This is done by leveraging Cloudflare to perform a reverse IP lookup that will return the general location of the user (approximately at the city level). The location is not stored and is only used to determine the applicable rule.
From Cloudflare's IP geolocation documentation:
Cloudflare can include the country code of the visitor's IP address (in ISO 3166-1 Alpha 2 format) with each request between Cloudflare and the upstream origin web server. This allows site administrators to capture their visitor's IP location in server logging and/or application logic. Besides ISO country codes, Cloudflare uses the following special country codes:
To set up geolocation rules, you first have to set up a geolocation rule group. This will allow you to group geolocation rules in a way that complies with applicable privacy laws. You must have a default geolocation rule group and a default geolocation rule within each geolocation rule group to define the behaviors to use when no other rules apply.
When a script is published, the template and geolocation rule will change to Active. If any changes are made to the geolocation or template, they will revert to Draft. Scripts will either be Draft if unpublished or Published after publishing.
Tip
If you have configured your Company Profile in Athena, the geolocation rule groups will be populated with recommended settings. For more information, see Athena Company Profile.
To add a geolocation rule group
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click the Create New button. The Create New Rule Group modal appears.
-
Complete the Rule Group Name, Organization, and optional Description field.
-
Click the Create button.
To add a geolocation rule
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click on the name of the Geolocation Rule Group. The Geolocation Rule Group Details screen appears.
-
Click the Add Rule button. A new rule is added.
-
Complete the fields. For more information, see Geolocation Rule Configuration Screen Reference.
-
Click the Save button.
Geolocation Rule Configuration Screen Reference
To assign a geolocation rule group to a domain
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click on the name of the rule group you want to assign. The Geolocation Rule Group Details screen appears.
-
Go to the Assigned Domains tab.
-
Click the Assign to Domains button. The Assign to Domains modal appears.
-
Select the check boxes for the domains you want to assign.
-
Click the Assign button. The next time you publish the script for your domain, it will adhere to the rules configured in the policy. For more information on publish the script see Publishing and Implementing Cookie Consent Scripts
To view geolocation rule versions
New versions of geolocation rules are created when an existing geolocation rule is edited and saved.
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click on the name of the Geolocation Rule Group. The Geolocation Rule Group Details screen appears.
-
Select a geolocation rule from the list. The geolocation rule configuration appears in the editor.
-
Click the Show Version History button in the header. The Geolocation Versions pane appears.
-
View the version history for the geolocation rule.
To delete a geolocation rule group
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click the Context Menu icon 
on the row for the group you want to delete. The menu appears.
-
Select . A confirmation modal appears.
-
Click the Submit button.
To delete a geolocation rule
Note
You cannot delete the default Geolocation Rule.
-
On the menu, select . The Geolocation Rule Groups screen appears.
-
Click on the name of the rule group you want to delete. The Geolocation Rule Group Details screen appears.
-
Click the Edit icon for the rule. All editable fields display.
-
Click the Context menu icon. The menu appears.
-
Select . A confirmation modal appears.
-
Click the Remove button.
Notice Only. If you select Notice Only as the default consent model, all cookie categories will set and cannot be disabled by website visitors. A banner informing the visitor that the website uses cookies will be displayed on the landing page of the website.
Opt-out. If you select Opt-out, all cookie categories (besides Strictly Necessary) will be set to require opt-out. These cookies will be automatically enabled when the visitor lands on the website. The website visitor can disable the non-Strictly Necessary cookies in the preference center.
Opt-in. If you select Opt-in, all cookie categories (besides Strictly Necessary) will be set to opt-in. These cookies will not be set on the visitor's device unless they are enabled in the preference center.
Implied Consent. If you select Implied Consent, all cookie categories (besides Strictly Necessary) will be set to implied consent. These cookies are not set until the website visitor clicks the Accept button or engages in another implied consent behavior. The website visitor can disable cookie categories in the Preference Center.
Always Inactive. If you select Always Inactive, all cookie categories (besides Strictly Necessary) will set to inactive and cannot be enabled by website visitors. A banner informing the visitor that the website uses cookies will be displayed on the landing page of the website.
Custom. If you select this option, you can set a different default status for each category of cookie on your site. You can customize the consent model to suit your organization's needs and can set the Do Not Track status for each category of cookie.
For rules that use the Custom consent model, you can select the default status for each category of cookies or vendors. The status indicates the behavior of category and the conditions under which the cookies will be set. The statuses align with the consent models with which they share their names.
Notice Only. Cookies in a Notice Only category are automatically set and will be shown in the preference center, but cannot be disabled by the site visitors. Cookies in a Notice Only category cannot rely on Consent as the legal basis for processing data.
Opt-out. Cookies in an Opt-out category are automatically set and can be disabled by the site visitor in the preference center.
Opt-in. Cookies in an Opt-in category are not set by default and must be proactively selected by the site visitor in the preference center. Opt-in allows for the explicit consent of the site visitor.
Implied Consent. Cookies in an Implied Consent category are set when a site visitor engages in designated implied consent behaviors such acknowledging the banner, scrolling, clicking, or navigating to a new page.
Always Inactive. Cookies in an Always Inactive category are automatically set and cannot be enabled by website visitors. A banner informing the visitor that the website uses cookies will be displayed on the landing page of the website.
