From b2e86d1052f8743818472e2343ce8f33ad2833c9 Mon Sep 17 00:00:00 2001
From: Nurul Sundarani <sundarani@prisma.io>
Date: Thu, 18 Jun 2026 21:57:52 +0530
Subject: [PATCH 1/3] fix(analytics): use Google Consent Mode v2 with a
 CookieYes consent bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CookieYes's auto-blocker does not re-activate type="text/plain" gated scripts in
this account (confirmed: Tolt was dead too; consent recorded analytics:yes but
scripts stayed inert), so the gated GTM never executed and GA4 got no data.

Switch to Consent Mode v2, which does not depend on script re-activation:
- load GTM normally (no type="text/plain" gate);
- default all consent types to "denied" inline before GTM, so no cookies/device
  storage pre-consent (only anonymous cookieless pings) — ePrivacy-compliant;
- bridge CookieYes -> Google consent in code via CookieYes's JS API
  (cookieyes_consent_update event + getCkyConsent()), firing
  gtag('consent','update',...) on accept. No CookieYes dashboard access needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../ui/src/components/google-tag-manager.tsx  | 93 +++++++++++--------
 1 file changed, 56 insertions(+), 37 deletions(-)

diff --git a/packages/ui/src/components/google-tag-manager.tsx b/packages/ui/src/components/google-tag-manager.tsx
index b98bad5ce8..362f7d9ada 100644
--- a/packages/ui/src/components/google-tag-manager.tsx
+++ b/packages/ui/src/components/google-tag-manager.tsx
@@ -1,26 +1,22 @@
 /**
- * Consent-gated Google Tag Manager loader.
+ * Google Tag Manager loader with Google Consent Mode v2.
  *
- * Split into two parts on purpose:
+ * GTM loads normally — it is NOT gated as a `type="text/plain"` script (CookieYes
+ * does not re-activate blocked scripts in this account, so gating left GTM inert
+ * and GA4 got no data). Compliance is handled by Consent Mode instead:
  *
- *  1. An inline bootstrap that always runs. It only initialises `dataLayer`
- *     (a plain in-memory array) and pushes the page section + GTM start event.
- *     This sets no cookies and makes no network requests, so it is safe to run
- *     before consent.
- *  2. The GTM library itself, loaded as an EXTERNAL `src` script tagged for
- *     CookieYes' analytics category. CookieYes only reliably re-activates
- *     external `src` scripts after consent — an inline `type="text/plain"` GTM
- *     bootstrap is left inert and never executes, so it must NOT be used here.
- *     This mirrors the working external-`src` pattern used for Tolt/PromptWatch.
- *     See https://www.cookieyes.com/documentation/implement-prior-consent-using-cookieyes/
+ *  - All consent types default to "denied", inline and synchronously, BEFORE GTM
+ *    runs. GA4 sets no cookies and only sends anonymous cookieless pings until the
+ *    visitor consents — no device storage pre-consent (ePrivacy satisfied).
+ *  - A small bridge maps CookieYes consent to Google's consent signal via
+ *    CookieYes's JS API (`cookieyes_consent_update` event + `getCkyConsent()`),
+ *    firing `gtag('consent','update',...)` on accept. This needs NO CookieYes
+ *    dashboard configuration — it works purely from the consent events CookieYes
+ *    already emits. See
+ *    https://www.cookieyes.com/documentation/implementing-google-consent-mode-using-cookieyes/
  *
- * Nothing contacts Google until CookieYes activates the external script once the
- * visitor grants analytics consent (GDPR/ePrivacy compliant). No `<noscript>`
- * iframe fallback is rendered, as it would load GTM regardless of consent.
- *
- * One container serves the whole prisma.io domain; each zone passes its
- * `section` so every hit carries a `site_section` dimension and can be segmented
- * (website vs blog vs docs) in GA4.
+ * One container serves the whole prisma.io domain; each zone passes its `section`
+ * so every hit carries a `site_section` dimension (website/blog/docs).
  */
 
 import type { SiteSection } from "../lib/analytics";
@@ -34,25 +30,48 @@ type GoogleTagManagerProps = {
 };
 
 export function GoogleTagManager({ section }: GoogleTagManagerProps) {
-  const bootstrap = `
+  const html = `
 window.dataLayer = window.dataLayer || [];
+function gtag(){dataLayer.push(arguments);}
+gtag('consent', 'default', {
+  ad_storage: 'denied',
+  ad_user_data: 'denied',
+  ad_personalization: 'denied',
+  analytics_storage: 'denied',
+  wait_for_update: 500
+});
 window.dataLayer.push({ site_section: ${JSON.stringify(section)} });
-window.dataLayer.push({ 'gtm.start': new Date().getTime(), event: 'gtm.js' });`.trim();
 
-  return (
-    <>
-      {/* Always runs: dataLayer setup only — no cookies, no network requests. */}
-      <script id="gtm-datalayer" dangerouslySetInnerHTML={{ __html: bootstrap }} />
-      {/* Consent-gated: CookieYes activates this external script after analytics
-          consent, which then loads the container and starts firing tags. */}
-      <script
-        id="gtm-loader"
-        type="text/plain"
-        data-cookieyes="cookieyes-analytics"
-        data-cookieyes-category="analytics"
-        async
-        src={`https://www.googletagmanager.com/gtm.js?id=${GTM_CONTAINER_ID}`}
-      />
-    </>
-  );
+// Bridge CookieYes consent -> Google Consent Mode (no dashboard config required).
+(function(){
+  function update(accepted){
+    accepted = accepted || [];
+    var ads = accepted.indexOf('advertisement') !== -1 ? 'granted' : 'denied';
+    gtag('consent', 'update', {
+      analytics_storage: accepted.indexOf('analytics') !== -1 ? 'granted' : 'denied',
+      ad_storage: ads,
+      ad_user_data: ads,
+      ad_personalization: ads
+    });
+  }
+  // Fires when the visitor changes consent.
+  document.addEventListener('cookieyes_consent_update', function(e){
+    update(e && e.detail && e.detail.accepted);
+  });
+  // Applies stored consent for returning visitors once CookieYes is ready.
+  document.addEventListener('cookieyes_banner_load', function(){
+    if (typeof getCkyConsent === 'function') {
+      var cats = (getCkyConsent() || {}).categories || {};
+      update(Object.keys(cats).filter(function(k){ return cats[k]; }));
+    }
+  });
+})();
+
+(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+})(window,document,'script','dataLayer','${GTM_CONTAINER_ID}');`.trim();
+
+  return <script id="gtm-loader" dangerouslySetInnerHTML={{ __html: html }} />;
 }

From a0adc2e7d892da5a10f25a944e08a6bd09ad234b Mon Sep 17 00:00:00 2001
From: Nurul Sundarani <sundarani@prisma.io>
Date: Thu, 18 Jun 2026 22:14:15 +0530
Subject: [PATCH 2/3] Fix Analytics Script

---
 .../ui/src/components/google-tag-manager.tsx  | 26 ++-----------------
 1 file changed, 2 insertions(+), 24 deletions(-)

diff --git a/packages/ui/src/components/google-tag-manager.tsx b/packages/ui/src/components/google-tag-manager.tsx
index 362f7d9ada..8072b2b075 100644
--- a/packages/ui/src/components/google-tag-manager.tsx
+++ b/packages/ui/src/components/google-tag-manager.tsx
@@ -1,28 +1,6 @@
-/**
- * Google Tag Manager loader with Google Consent Mode v2.
- *
- * GTM loads normally — it is NOT gated as a `type="text/plain"` script (CookieYes
- * does not re-activate blocked scripts in this account, so gating left GTM inert
- * and GA4 got no data). Compliance is handled by Consent Mode instead:
- *
- *  - All consent types default to "denied", inline and synchronously, BEFORE GTM
- *    runs. GA4 sets no cookies and only sends anonymous cookieless pings until the
- *    visitor consents — no device storage pre-consent (ePrivacy satisfied).
- *  - A small bridge maps CookieYes consent to Google's consent signal via
- *    CookieYes's JS API (`cookieyes_consent_update` event + `getCkyConsent()`),
- *    firing `gtag('consent','update',...)` on accept. This needs NO CookieYes
- *    dashboard configuration — it works purely from the consent events CookieYes
- *    already emits. See
- *    https://www.cookieyes.com/documentation/implementing-google-consent-mode-using-cookieyes/
- *
- * One container serves the whole prisma.io domain; each zone passes its `section`
- * so every hit carries a `site_section` dimension (website/blog/docs).
- */
-
 import type { SiteSection } from "../lib/analytics";
 
-// Public, client-side container ID (Prisma Main › prisma.io). Ships in the HTML
-// to every visitor by design, so it is intentionally hardcoded, not an env var.
+// Public, client-side container ID (Prisma Main › prisma.io).
 const GTM_CONTAINER_ID = "GTM-KRTRXXQ6";
 
 type GoogleTagManagerProps = {
@@ -42,7 +20,7 @@ gtag('consent', 'default', {
 });
 window.dataLayer.push({ site_section: ${JSON.stringify(section)} });
 
-// Bridge CookieYes consent -> Google Consent Mode (no dashboard config required).
+// Bridge CookieYes consent
 (function(){
   function update(accepted){
     accepted = accepted || [];

From 3cc25cc9bc40a8c373fedbbd9839d827a7da4c60 Mon Sep 17 00:00:00 2001
From: Nurul Sundarani <sundarani@prisma.io>
Date: Thu, 18 Jun 2026 22:41:00 +0530
Subject: [PATCH 3/3] fix(analytics): align consent default with CookieYes GCM
 v2 spec

Match CookieYes's documented Consent Mode v2 default snippet:
- add functionality_storage/personalization_storage = denied,
  security_storage = granted;
- raise wait_for_update 500 -> 2000 (CookieYes loads late; 500ms could drop a
  returning consenter's hit before the update arrives);
- add ads_data_redaction + url_passthrough.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packages/ui/src/components/google-tag-manager.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/ui/src/components/google-tag-manager.tsx b/packages/ui/src/components/google-tag-manager.tsx
index 8072b2b075..244f93af11 100644
--- a/packages/ui/src/components/google-tag-manager.tsx
+++ b/packages/ui/src/components/google-tag-manager.tsx
@@ -16,8 +16,13 @@ gtag('consent', 'default', {
   ad_user_data: 'denied',
   ad_personalization: 'denied',
   analytics_storage: 'denied',
-  wait_for_update: 500
+  functionality_storage: 'denied',
+  personalization_storage: 'denied',
+  security_storage: 'granted',
+  wait_for_update: 2000
 });
+gtag('set', 'ads_data_redaction', true);
+gtag('set', 'url_passthrough', true);
 window.dataLayer.push({ site_section: ${JSON.stringify(section)} });
 
 // Bridge CookieYes consent