Site-wide GDPR cookie consent banner with shared consent cookie - #1340
Merged
Conversation
Replace the binary event-page consent banner with a site-wide banner offering Essential / Analytics / Advertising choices, enabled via VITE_COOKIE_CONSENT_ENABLED. Consent is stored in a hi_cookie_consent cookie shared with the marketing site on .hi.events (VITE_COOKIE_CONSENT_DOMAIN), and Google Consent Mode v2 defaults are emitted server-side from that cookie before any gtag snippet loads. - Organizer tracking pixels are filtered by consent category; they load ungated when the banner is disabled (self-hosted default) - Revoking a granted category reloads the page; a Cookie settings link on public pages reopens the banner - Banner and link are suppressed inside embedded widgets and on /widget routes - Google Ads conversion tracking via VITE_GOOGLE_ADS_CONVERSION_ID/_LABELS - Remove the GA4 plugin's delete of the non-configurable global gtag - Document new env vars, pass them through the all-in-one image, add E2E spec
|
🚅 Deployed to the Hi.Events-pr-1340 environment in Hi.Events
3 services not affected by this PR
|
railway-app
Bot
temporarily deployed
to
Hi.Events / Hi.Events-pr-1340
September 6, 2026 16:46
Destroyed
Contributor
✅ E2E · smoke
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the binary Accept/Decline banner (shown only on event pages) with a site-wide cookie consent banner offering Essential / Analytics / Advertising choices via a "More choices" panel. Enabled with
VITE_COOKIE_CONSENT_ENABLED=true; self-hosted installs see no change unless they opt in.Consent is stored in a
hi_cookie_consentcookie (analytics=1&advertising=0) that the marketing site writes with the same contract on.hi.events, so a choice made on hi.events carries into app.hi.events (VITE_COOKIE_CONSENT_DOMAIN).Changes
utilites/cookieConsent.ts+useCookieConsenthook replacetrackingPixels/consent.ts; the oldhi_tracking_consentcookie is not migrated (visitors are asked once more)server.jsemits the Google Consent Mode v2defaultfrom the stored cookie before any gtag snippet (default-denied +wait_for_updatewhen absent)/widgetroutesVITE_GOOGLE_ADS_CONVERSION_ID/_LABELS) fired fromtrackEventdeletes the non-configurable globalgtag(threw on effect teardown once the head declares it)EventHomepage/Footercomponentfrontend/.env.example, passed through the all-in-one image; 11 new strings translated in all localesDeploy notes (cloud)
The domain var is required on cloud, otherwise the site's
.hi.eventscookie and a host-only app cookie coexist.Test plan
tsc --noEmitclean on touched files;messages:extract --cleanreports 0 missingcookie-consent.spec.ts+free-checkoutsmoke pass against the dev stack (consent cookie seeded in default storage state so existing specs never see the overlay)analytics=0&advertising=1and pushes a matchingconsent update; GA4 pixel withheld while Facebook loads; Cookie settings reopens pre-filled; revoking Advertising reloads with nofbevents.js; banner-off path loads pixels immediatelycurlwith/without the cookie shows the server-emitted consent default in the expected order🤖 Generated with Claude Code