Move linker config into gtag('config') call with accept_incoming and
decorate_forms for reliable cross-domain linking. Capture _gl parameter
in sessionStorage to preserve attribution across navigation. Add
referrer-based attribution replay fallback so GA4 reports source/medium
instead of (not set) when UTMs are absent. Add "Always" script category
that executes without waiting for consent.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Custom scripts are now rendered as inert <script type="text/plain"
data-att-cc-category="..."> tags in the page HTML. On consent,
consent-manager.js scans the DOM and activates matching elements.
This replaces the JSON-in-config approach and allows third-party
plugins (e.g. HFCM) to output consent-gated scripts using the
same data attribute convention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allow visitors to reopen the cookie preferences modal after making
their choice via a configurable floating button (bottom-right or
right-side vertical) or any anchor link with href="#att-cc-preferences".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google Consent Mode v2 cookie consent plugin with session attribution
preservation, custom script management, and gtag.js/GTM support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
