Add the European Cookiebot consent stack to documentation - #525
Merged
Conversation
/docs is served same-origin under questdb.com, so the Cookiebot consent cookie and banner are shared with the main site; this adds the same load-bearing script order to every page's head: Consent Mode v2 defaults (all denied), the Cookiebot CMP in manual blocking mode, a bridge event, then PostHog and the Google Ads tag. PostHog previously reached these pages through Netlify's snippet injection, invisible in this repo and ungated — session replay and cookies for every visitor regardless of consent. It now initializes here instead, with cookieless_mode 'on_reject' and an opt-in/opt-out gate driven by the consent state: statistics consent means full capture, anything else means cookieless. The snippet is byte-identical to the one production serves today. The Netlify snippet injection must be removed when this deploys, or PostHog initializes twice. The footer gains a "Cookie settings" link that reopens the banner — the consent withdrawal path, and the opt-out mechanism for visitors whose region never showed a banner. Subscribe and YouTubeEmbed are deleted: neither is imported, registered in MDXComponents, nor referenced by any document, and both carried PostHog calls that predate this gating. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🤖 Component Converter ReminderA component in We are creating markdown correspondents of every path (e.g. questdb.com/docs/quick-start/ → questdb.com/docs/quick-start.md) for LLM consumption. Quick Check
💡 This is a friendly reminder, not a blocker. Ignore if not applicable. |
|
🚀 Build success! Latest successful preview: https://preview-525--questdb-documentation.netlify.app/docs/ Commit SHA: 47675e6
|
- uc.js is now async: it was a render-blocking third-party script second in head on an SEO-critical site. Safe because the PostHog gate falls back to the persisted opt-in state when Cookiebot has not answered yet. - The gate keys on Cookiebot.hasResponse rather than the consent object, which exists (undecided) from the moment uc.js runs. - wait_for_update raised to 2000ms to match the main site. - Footer hides "Cookie settings" until Cookiebot exists. - theme/Input and utils/emailPattern removed: orphaned by the Subscribe deletion, zero remaining references. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same bridge as questdb.io (see its commit for the full reasoning): honors Global Privacy Control over implied consent with denial after Cookiebot's granted update, redaction restore, prefix-enumerated ad-cookie expiry, a watchdog for the iframe-gated granted window, silent-wipe recovery via CookiebotOnDialogDisplay, and an always-fresh broadcast snapshot. Explicit choices are never overridden. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
emrberk
force-pushed
the
docs/cookie-consent
branch
from
August 25, 2026 15:01
8af86e7 to
469e52e
Compare
Termination check runs before the denial so a throwing denyAds cannot keep the interval alive, and the watchdog re-arms on Cookiebot events so a late-arriving uc.js still gets a full watch window. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The .gitleaksignore fingerprint pins a branch commit SHA, which stops matching after the squash merge and would turn main red on the push scan. The inline gitleaks:allow is SHA-independent; the fingerprint entry stays so the PR range scan of the original commit passes too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
emrberk
changed the title
githubwei
enabled auto-merge (squash)
August 31, 2026 16:21
emrberk
disabled auto-merge
August 31, 2026 17:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Applies the same Europe-only consent architecture as questdb/questdb.io#2979 to every documentation page:
There is no US/CCPA implementation in this PR.
The PR also removes unused
SubscribeandYouTubeEmbedcomponents that contained legacy, ungated PostHog calls.Consent behavior
Implementation notes
Required deploy step
Production documentation currently receives PostHog through Netlify snippet injection. After merge, remove that snippet from:
Site configuration → Build & deploy → Post processing → Snippet injection
Leaving both implementations enabled risks duplicate initialization and preserves a path outside the repository consent logic.