feat: iubenda CMP with TCF consent for ads tracking - #6382
Open
pnvasanth wants to merge 2 commits into
Open
Conversation
Load the iubenda Cookie Solution (TCF mode) for GDPR-covered webapp users behind the iubenda_cmp flag, mirror its consent into the existing ilikecookies* cookies, populate the ad tracker consent macros from __tcfapi, send gdpr/gdpr_consent/addtl_consent on ad requests, attach the iubenda consent id to analytics events, and forward the stored TC string to boot via the x-gdpr-consent header.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
pnvasanth
requested review from
capJavert and
idoshamun
and removed request for
capJavert
July 28, 2026 10:44
capJavert
reviewed
Jul 28, 2026
|
|
||
| win._iub = win._iub || {}; | ||
| win._iub.csConfiguration = { | ||
| siteId: Number(process.env.NEXT_PUBLIC_IUBENDA_SITE_ID), |
Contributor
There was a problem hiding this comment.
we already have NEXT_PUBLIC_IUBENDA_POLICY_ID which should be NEXT_PUBLIC_IUBENDA_SITE_ID
Comment on lines
+88
to
+104
| lang: 'en', | ||
| enableTcf: true, | ||
| googleAdditionalConsentMode: true, | ||
| perPurposeConsent: true, | ||
| askConsentAtCookiePolicyUpdate: true, | ||
| invalidateConsentWithoutLog: true, | ||
| // consent cookie shared across *.daily.dev, matching the existing | ||
| // `_iub_cs-*` bridge from the marketing homepage | ||
| localConsentDomain: process.env.NEXT_PUBLIC_DOMAIN, | ||
| floatingPreferencesButtonDisplay: false, | ||
| banner: { | ||
| position: 'float-bottom-center', | ||
| acceptButtonDisplay: true, | ||
| rejectButtonDisplay: true, | ||
| customizeButtonDisplay: true, | ||
| closeButtonDisplay: false, | ||
| listPurposes: true, |
Contributor
There was a problem hiding this comment.
we need to make sure it matches with our homepage and marketing site configuration as well, since there we use iubenda already
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Adds the iubenda Cookie Solution (IAB TCF v2.2) as CMP for GDPR-covered users, behind the new
iubenda_cmpGrowthBook flag (default off). Companion PRs: dailydotdev/skadi#352 (deploy first), dailydotdev/daily-api#4027.Iubenda.tsx(webapp only — extension CSP blocks CMP scripts): loads stub → safe-tcf → core in order for GDPR-covered users, mirrors iubenda purposes into the existingilikecookies*cookies (incl. a new withdrawal path inuseCookieConsentthat updates the react-query cache), suppresses the homegrown banner for those users.lib/tcf.ts: store over__tcfapiexposing{gdprApplies, tcString, addtlConsent}; mirrors the TC string to localStorage so the next boot sends it as anx-gdpr-consentheader (lib/boot.ts).resolveAdConsentpreviously abusedgdpr=1to mean "not consented" — nowgdprAppliesstates scope and the TC string carries consent;useAdMacroContextrecomputes on consent change. The existing${GDPR_CONSENT_755}/${ADDTL_CONSENT}macros now populate (pixels, measurement tags, click URLs, incl. the extension measurement frame contract).gdpr/gdpr_consent/addtl_consent; consent is part of the ad queryKey so ads refetch after the banner is answered.Behavior changes to be aware of: EU users consented via the old banner now emit
gdpr=1+ TC string (previously miscodedgdpr=0) and will see the iubenda banner once; EU extension users truthfully sendgdpr=1with no string (contextual ads).Rollout checklist
Values pulled from the live daily.dev homepage's iubenda embed (same site/policy so consent is shared across
*.daily.dev):NEXT_PUBLIC_IUBENDA_SITE_ID=1334205NEXT_PUBLIC_IUBENDA_POLICY_ID=14695236(referenced by existing code — verify rather than assume it's set)packages/webapp/.env(edit-protected, not included in this PR)enableTcf— without it__tcfapinever loads and no TC string is generated)NEXT_PUBLIC_*is inlined at build time)iubenda_cmpflag (GrowthBook) 0% → EU-targetedEvents
New shared property on all log events:
consent_id— the iubenda consent-record correlator (cons.randfrom the_iub_cs-*cookie), unset when no iubenda consent exists. Needs coordination with the analytics pipeline.Preview domain
https://feat-iubenda-cmp-tcf-consent.preview.app.daily.dev