Goals, consent & attribution

Click: a matched button or link click. Pageview: reaching your configured destination pathname. Custom: an application-confirmed event. Custom event names use lowercase letters, digits and underscores, 1–60 characters, and must exactly match the configured goal.

A click is not a completed purchase or enquiry. Fire signup_completed only after successful registration, or choose a genuine confirmation destination. Do not call tracking on every render, optimistic submission or failed request.

Content exposures follow successful target delivery for both arms. Developer exposures must follow actual presentation. Conversion attribution requires a valid previous exposure for the same experiment revision within 30 days. An eligible visitor counts once as exposed and at most once as converted per revision.

The server recomputes assignment, validates events and deduplicates retries. Browser event payloads and Origin headers are not proof that a business action truly happened; your app must fire honest events. Tracking booleans are not delivery confirmations.

Consent is required by default. The core waits before configuration, identification and event delivery until consent allows testing. Consult your applicable privacy requirements before using consentRequired: false. Your website owns the consent decision and privacy notices.

Legacy localStorage keys are expcon_vid, expcon_consent and expcon_exposures on the website origin, not a cookie-based SSR identity. If identity storage cannot persist, the visitor is excluded. Assignment persists while that identity remains; storage clearance or withdrawal changes that.

revokeConsent invalidates pending SDK generations, clears unsent events and identity/exposure storage and restores applied DOM text. Already-sent requests cannot be recalled. React-native fallback needs your own presentation handling; read the adapter limitations. destroy cleans up the running core but is not equivalent to clearing consent.