SaaS Privacy: Managing User Consent in Multi-Tenant Apps

Date: May 12, 2026 Author: GetCookies Team Category: Technical Reading Time: 13 min

---

Building a SaaS application? You have a unique privacy challenge: Multi-Tenancy.

You are not just managing consent for your users; you might be managing consent for your users' users. Or, you have a marketing site (.com) and an app (.app), and you need to bridge consent between them.

Scenario 1: The Marketing-to-App Bridge

User lands on www.yoursaas.com. Accepts cookies. Signs up. lands on app.yoursaas.com.

• Bad Experience: Asking for consent again.
• Good Experience: Passing the consent state.

Implementation: Use Cross-Domain Consent. When the user clicks "Sign Up", append ?gc_consent=token to the URL. On the app side, read this token and initialize the CMP in the "Accepted" state silently.

Scenario 2: Product Analytics (Mixpanel/Amplitude)

Inside the app, you use analytics to improve the product.

• GDPR: You usually need consent for this, unless you can argue "Legitimate Interest" (strictly necessary for product improvement, aggregated data only).
• Best Practice: Ask for "Product Improvement" consent during Onboarding, not via a cookie banner. Save this preference to the User Profile in your database (Postgres/SQL), not just a browser cookie.

Scenario 3: B2B vs. Users

In B2B SaaS, your customer is the "Company."

• The Nuance: The Company might sign a DPA (Data Processing Agreement) allowing you to process their employees' data.
• The User: The individual employee still has rights. You generally don't need a "Do Not Sell" link for B2B app usage data (since you aren't selling it), but you do need transparency.

Implementing "Identity-Based" Consent

For SaaS, relying on cookies is fragile (users switch devices). The Architecture:

1. DB Schema: Add consent_preferences (JSONB) to your users table.
2. Login: When user logs in, fetch these preferences.
3. Init: Initialize GetCookies with these saved preferences.
4. Update: If user changes settings in the banner, sync it back to the API/Database.

// On Login
const userPrefs = await api.getConsent();
GetCookies.init({
  savedPreferences: userPrefs
});

// On Change
window.addEventListener('getcookies:consent_updated', (e) => {
  api.updateConsent(e.detail);
});

Conclusion

For SaaS, consent should travel with the User ID, not the Browser ID. Treat privacy preferences as a first-class profile setting, just like "Dark Mode" or "Notification Settings."