@c15t/react 3.2.0-canary.0 → 3.2.1

package/docs/integrations/liveintent.md

@@ -0,0 +1,327 @@
+---
+title: LiveIntent
+description: Load LiveIntent with c15t after marketing consent and verify its
+  loader, storage and revocation behavior.
+seoTitle: LiveIntent consent with c15t
+seoDescription: Load LiveIntent's LiveConnect tag only after marketing consent.
+  Learn what liveIntentTag queues, which storage it sets and how to verify it.
+icon: radar
+group: integrations
+---
+
+LiveIntent's LiveConnect tag identifies visitors for people-based ad targeting
+and measurement. The c15t `liveIntentTag` helper waits until the `marketing`
+category is allowed before it creates the `liQ` queue and adds your account's
+tag.
+
+LiveConnect has no API to stop it. When the visitor withdraws, the helper
+leaves the tag on the page, and c15t's default page reload removes it.
+
+## Configure LiveIntent
+
+Copy the tag ID from your account's LiveConnect base tag. Use the filename
+without `.min.js`. Don't test with the public `a-00xx` tag from LiveIntent's
+examples. It's live production code, not a sandbox or a default for your
+account. Then delete the direct base tag and any tag manager copy, so they
+can't load LiveConnect without consent.
+
+| Package manager | Command                          |
+| :-------------- | :------------------------------- |
+| npm             | `npm install @c15t/integrations` |
+| pnpm            | `pnpm add @c15t/integrations`    |
+| yarn            | `yarn add @c15t/integrations`    |
+| bun             | `bun add @c15t/integrations`     |
+
+```ts title="src/consent-scripts.ts"
+import { liveIntentTag } from '@c15t/integrations/liveintent';
+
+export const scripts = [liveIntentTag({ tagId: 'YOUR_TAG_ID' })];
+```
+
+## Register the scripts
+
+Complete your [framework quickstart](https://c15t.com/docs/frameworks) first. Keep its Inth
+endpoint, policy, styles and consent UI. Remove the vendor's original script,
+SDK initializer or tag-manager entry, so the vendor loads only through c15t.
+
+The vendor pages put the helper in `src/consent-scripts.ts`. If your framework
+quickstart already has a `scripts` array, such as the one in `c15t.config.ts`
+in the Next.js guide, add the helper to that array instead of creating a
+second file.
+The `scripts` export is a configuration, not an initializer. Add it to the c15t provider you already have, at the registration
+point for your framework below. These are edits to that provider, not a second
+provider.
+
+**Next.js**
+
+Add the configuration to `scripts` in `c15t.config.ts`, next to
+`next.config.ts`:
+
+```ts title="c15t.config.ts"
+import { defineConsentConfig } from 'c15t/next';
+import { scripts } from './src/consent-scripts';
+
+export default defineConsentConfig({ scripts });
+```
+
+Keep the rest of your config, such as `mode` and `routePrefix`, in the
+same call. `ConsentRoot` reads the config in the browser, so the layout
+keeps passing only `state`. App Router, Pages Router and static export all
+read the same file. See
+[Next.js scripts and embeds](https://c15t.com/docs/frameworks/next/scripts).
+
+**TanStack Start**
+
+Import the configuration into your root route and pass it to the existing
+`ConsentRoot` as a top-level prop. Keep the loader from the
+[TanStack Start quickstart](https://c15t.com/docs/frameworks/tanstack-start/quickstart):
+
+```tsx title="src/routes/__root.tsx"
+import { scripts } from '../consent-scripts';
+
+<ConsentRoot state={consent} scripts={scripts}>
+```
+
+Import vendor helpers in the root route module, not in a server function.
+A server function's return value must be serializable, and script
+configurations carry callbacks. See
+[TanStack Start scripts](https://c15t.com/docs/frameworks/tanstack-start/scripts).
+
+**React**
+
+Add the configuration to the existing `ConsentProvider` options, next to
+`mode`:
+
+```tsx title="src/consent.tsx"
+import { scripts } from './consent-scripts';
+
+<ConsentProvider options={{ mode, scripts }}>
+```
+
+`mode` is the `manifest()` value from the
+[React quickstart](../frameworks/react/quickstart.md). Keep the banner,
+dialog and preferences link inside the provider. See
+[React scripts and embeds](../frameworks/react/scripts.md).
+
+**Nuxt**
+
+Register the scripts under the `c15t` key in `app/app.config.ts`. Adjust the
+relative import to where you created `consent-scripts.ts`:
+
+```ts title="app/app.config.ts"
+import { scripts } from '../src/consent-scripts';
+
+export default defineAppConfig({
+  c15t: { scripts },
+});
+```
+
+The Nuxt module merges this over its options in `nuxt.config.ts` and starts
+one script loader in the browser after hydration, once it has applied the
+visitor's stored choice and privacy signals. Keep `scripts` out of
+`nuxt.config.ts`, which reaches the browser as JSON and drops the vendor
+callbacks. Write the vendor IDs into `consent-scripts.ts`. See
+[Nuxt scripts and embeds](https://c15t.com/docs/frameworks/nuxt/scripts).
+
+**Vue**
+
+Pass the scripts to the existing `c15tVue` plugin call in `src/main.ts`:
+
+```ts title="src/main.ts"
+import { c15tVue, manifest } from 'c15t/vue/vue-plugin';
+import { scripts } from './consent-scripts';
+
+app.use(c15tVue, {
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep your existing `mode` and other options. The plugin starts one
+script loader when the app mounts, after it has applied the visitor's stored
+choice. Do not also call `createScriptLoader` from a component. See
+[Vue scripts and embeds](https://c15t.com/docs/frameworks/vue/scripts).
+
+**Astro**
+
+Add the scripts to the client entrypoint from the
+[Astro quickstart](https://c15t.com/docs/frameworks/astro/quickstart), `src/c15t.client.ts`,
+which the integration finds on its own. Keep `astro.config.mjs` as it is.
+If the module already exports scripts, combine the two arrays.
+
+```ts title="src/c15t.client.ts"
+import type { C15tClientOptionsExtension } from 'c15t/astro';
+import { scripts } from './consent-scripts';
+
+export default { scripts } satisfies C15tClientOptionsExtension;
+```
+
+Vendor helpers contain callbacks, and the integration options in
+`astro.config.mjs` are serialized into the page, so do not put helpers in
+the integration's `scripts` option. The integration passes the client
+entrypoint to the one runtime every page shares, including across
+`ClientRouter` navigation.
+
+**Svelte**
+
+Import the scripts in the component that owns your existing provider and
+pass them as a top-level prop:
+
+```svelte title="src/App.svelte"
+<script lang="ts">
+  import { ConsentProvider, manifest } from 'c15t/svelte';
+  import { scripts } from './consent-scripts';
+</script>
+
+<ConsentProvider mode={manifest()} {scripts}>
+  <!-- Keep your application, consent UI and preferences link here. -->
+</ConsentProvider>
+```
+
+Retain the styles and consent UI from the [Svelte quickstart](https://c15t.com/docs/frameworks/svelte/quickstart).
+The provider owns the loader and disposes it on unmount.
+
+**SvelteKit**
+
+Add the scripts to the existing `ConsentRoot` in the root layout. Keep the
+handle and the layout load from the [SvelteKit quickstart](https://c15t.com/docs/frameworks/sveltekit/quickstart).
+
+```svelte title="src/routes/+layout.svelte"
+<script lang="ts">
+  import { ConsentRoot } from 'c15t/svelte';
+  import { scripts } from '../consent-scripts';
+
+  let { children, data } = $props();
+</script>
+
+<ConsentRoot state={data.consent} {scripts}>
+  {@render children()}
+  <!-- Keep your consent UI and preferences link here. -->
+</ConsentRoot>
+```
+
+Import vendor helpers in the layout component, not in `+layout.server.ts`:
+a server load cannot send functions to the browser. Prerendered, static and
+SPA-mode pages use the same `scripts` prop. If you pass an externally owned
+`runtime` to the provider, register scripts when creating that runtime instead.
+
+**HTML**
+
+The helpers in `@c15t/integrations` are ES modules that need a bundler. On a
+page that loads the c15t script tag, paste the vendor's own snippet instead
+and keep it inert until its category is allowed:
+
+```html
+<script type="text/plain" data-c15t-category="measurement">
+  // The vendor's snippet, unchanged
+</script>
+```
+
+Use the category this guide names for the vendor. c15t runs the snippet
+once that category is allowed, and reloads the page when the visitor
+withdraws it. Helper options on this page, such as `loadMode`, do not apply
+to a pasted snippet. See [HTML scripts](https://c15t.com/docs/frameworks/html/scripts).
+
+**JavaScript**
+
+Pass the scripts to `init()` from `@c15t/browser`, next to your mode:
+
+```ts
+import { init, manifest } from '@c15t/browser';
+import { scripts } from './consent-scripts';
+
+const consent = init({
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep the mode from your quickstart. With
+`createConsentRuntime` from `c15t/runtime`, pass `scripts` to it instead.
+A kernel you create yourself needs a loader from
+`c15t/modules/script-loader`. Attach one loader per kernel. See
+[JavaScript scripts](https://c15t.com/docs/frameworks/javascript/scripts).
+
+## Options
+
+| Option      | Default                                   | Behavior                                                                                                                                                                                                        |
+| ----------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `tagId`     | Required                                  | Public tag ID, trimmed and URL-encoded into the filename. If it's missing or blank, c15t logs an error and never loads the tag.                                                                                 |
+| `events`    | None                                      | Plain event objects, such as `{ event: 'conversion', name: 'purchase' }`, queued once on the first grant. Use the fields from your account's event tags. Strings, including `{{...}}`, stay literal event data. |
+| `scriptUrl` | `https://b-code.liadm.com/<tagId>.min.js` | Loader URL override. A blank value uses the default.                                                                                                                                                            |
+
+## Loading and revocation
+
+When `marketing` is allowed, the helper sets `window.liQ` to an empty array,
+pushes any `events` onto it in order, then adds one async loader. If your page
+already defines `liQ`, the helper keeps it and pushes the events onto it. Once
+it loads, LiveConnect replaces the array with its own client.
+
+For later events, call `window.liQ.push` with a plain event object, and only
+while marketing and any vendor consent stay granted. A function queue or
+method-and-arguments tuples don't match LiveConnect's event format.
+
+Where GDPR applies, LiveIntent documents further TCF requirements, along with
+GPP and legacy US privacy signals. c15t's marketing category doesn't replace a
+TC string. Zeta's guide names purposes 1 to 4, but the public example bundle
+served during testing required more purposes and special features. Confirm
+your account's production tag and requirements with LiveIntent. Don't request
+extra purposes just to satisfy the public example.
+
+LiveIntent documents no stop or withdrawal command for the full runtime. On
+withdrawal, the helper keeps the loader element and sends no withdrawal event.
+Keep c15t's default `reloadOnConsentRevoked` enabled. With reload disabled,
+existing clients, listeners and sync frames can keep running until the visitor
+navigates. If the visitor grants consent again on the same page, the helper
+reuses the loader and doesn't push `events` a second time.
+
+## Cookies and storage
+
+The served code writes the `_lc2_fpi`, `_lc2_fpi_js`, `_li_dcdm_c`, `_li_ss`
+and `lidids.*` cookies, and `_li_duid` and `_li_ss` in local storage. Some
+cookies request lifetimes up to 730 days, which browsers can shorten. Partner
+and account settings can add storage.
+
+For CSP, the main hosts are `b-code.liadm.com`, `idx.liadm.com`,
+`rp.liadm.com`, `rpr.liadm.com` and `i.liadm.com`.
+
+## Verify LiveIntent
+
+In a fresh browser profile, deny consent and allow only an unrelated category.
+Filter Network by `liadm.com` and confirm that no requests, globals, cookies,
+local storage or session storage appear. Grant `marketing` and check the loader
+URL against your account's base tag. Withdraw consent and confirm the page
+reloads. LiveIntent must stay blocked on the new page. Check storage in
+DevTools as well as Network.
+
+Sources: [base tag guide](https://support.liveintent.com/liveconnect-implementation-guide/),
+[Shopify tag example](https://support.liveintent.com/shopify-liveconnect-implementation/),
+[event tags](https://support.liveintent.com/liveconnect-event-tags/),
+[privacy requirements](https://knowledgebase.zetaglobal.com/gswz/privacy-with-liveintent)
+and [services privacy policy](https://www.liveintent.com/privacy-policy/).
+
+Test in a private window with an opt-in policy. Open DevTools Network, disable
+the cache and filter by the vendor's domain:
+
+1. Load the page. No request goes to the vendor before you choose.
+2. Click Reject, then reload. There is still no vendor request.
+3. Open Privacy settings and allow the helper's category. The vendor script
+   loads without a page reload.
+4. Turn the category off again and save. c15t reloads the page, and the new
+   page makes no vendor request.
+
+c15t reloads on revocation because removing a script element does not stop
+code that already ran. The vendor's listeners, timers and queued events stay
+alive until the page unloads. If you set `reloadOnConsentRevoked: false`, stop
+the vendor yourself. Register a callback-only script whose `onConsentChange`
+calls the vendor's opt-out API, as shown in
+[custom integrations](./building-integrations.md), and check the
+permission before each of your own event calls. The reload does not delete
+cookies the vendor already set; see
+[clear on revocation for your framework](./overview.md#vendor-switches-and-cookie-cleanup).
+
+The helper lists its vendor by name in the preference dialog, so a visitor can
+turn it off inside an allowed category. See
+[vendor consent for your framework](./overview.md#vendor-switches-and-cookie-cleanup). The
+[consent verification guide](../guides/verify-consent.md) covers navigation,
+expiry and hosting checks.

package/docs/integrations/lucky-orange.md

@@ -0,0 +1,336 @@
+---
+title: Lucky Orange
+description: Load Lucky Orange after measurement consent, configure its tracking
+  settings, and verify loading and withdrawal with c15t.
+seoTitle: Lucky Orange cookie consent with c15t
+seoDescription: Load Lucky Orange only after measurement consent. The c15t
+  luckyOrange helper sets its privacy consent status and turns it off on
+  withdrawal.
+icon: chart-line
+group: integrations
+---
+
+Lucky Orange records sessions and builds heatmaps. The c15t `luckyOrange`
+helper waits until the `measurement` category is allowed before it creates the
+`LOQ` queue and loads Lucky Orange. Once Lucky Orange's privacy module is
+ready, the helper grants consent through `LO.privacy.setConsentStatus(true)`.
+
+When the visitor withdraws, the helper calls `setConsentStatus(false)`.
+Recording code already on the page can't be unloaded, so keep c15t's default
+page reload.
+
+## Configure Lucky Orange
+
+In the Lucky Orange dashboard, turn on **Require Consent**. With it on, Lucky
+Orange waits for the consent the helper grants through its privacy API. Copy
+your site ID, then delete the original Lucky Orange snippet and any tag manager
+copy, so Lucky Orange can't load outside c15t.
+
+| Package manager | Command                          |
+| :-------------- | :------------------------------- |
+| npm             | `npm install @c15t/integrations` |
+| pnpm            | `pnpm add @c15t/integrations`    |
+| yarn            | `yarn add @c15t/integrations`    |
+| bun             | `bun add @c15t/integrations`     |
+
+```ts title="src/consent-scripts.ts"
+import { luckyOrange } from '@c15t/integrations/lucky-orange';
+
+export const scripts = [luckyOrange({ siteId: 'YOUR_SITE_ID' })];
+```
+
+## Register the scripts
+
+Complete your [framework quickstart](https://c15t.com/docs/frameworks) first. Keep its Inth
+endpoint, policy, styles and consent UI. Remove the vendor's original script,
+SDK initializer or tag-manager entry, so the vendor loads only through c15t.
+
+The vendor pages put the helper in `src/consent-scripts.ts`. If your framework
+quickstart already has a `scripts` array, such as the one in `c15t.config.ts`
+in the Next.js guide, add the helper to that array instead of creating a
+second file.
+The `scripts` export is a configuration, not an initializer. Add it to the c15t provider you already have, at the registration
+point for your framework below. These are edits to that provider, not a second
+provider.
+
+**Next.js**
+
+Add the configuration to `scripts` in `c15t.config.ts`, next to
+`next.config.ts`:
+
+```ts title="c15t.config.ts"
+import { defineConsentConfig } from 'c15t/next';
+import { scripts } from './src/consent-scripts';
+
+export default defineConsentConfig({ scripts });
+```
+
+Keep the rest of your config, such as `mode` and `routePrefix`, in the
+same call. `ConsentRoot` reads the config in the browser, so the layout
+keeps passing only `state`. App Router, Pages Router and static export all
+read the same file. See
+[Next.js scripts and embeds](https://c15t.com/docs/frameworks/next/scripts).
+
+**TanStack Start**
+
+Import the configuration into your root route and pass it to the existing
+`ConsentRoot` as a top-level prop. Keep the loader from the
+[TanStack Start quickstart](https://c15t.com/docs/frameworks/tanstack-start/quickstart):
+
+```tsx title="src/routes/__root.tsx"
+import { scripts } from '../consent-scripts';
+
+<ConsentRoot state={consent} scripts={scripts}>
+```
+
+Import vendor helpers in the root route module, not in a server function.
+A server function's return value must be serializable, and script
+configurations carry callbacks. See
+[TanStack Start scripts](https://c15t.com/docs/frameworks/tanstack-start/scripts).
+
+**React**
+
+Add the configuration to the existing `ConsentProvider` options, next to
+`mode`:
+
+```tsx title="src/consent.tsx"
+import { scripts } from './consent-scripts';
+
+<ConsentProvider options={{ mode, scripts }}>
+```
+
+`mode` is the `manifest()` value from the
+[React quickstart](../frameworks/react/quickstart.md). Keep the banner,
+dialog and preferences link inside the provider. See
+[React scripts and embeds](../frameworks/react/scripts.md).
+
+**Nuxt**
+
+Register the scripts under the `c15t` key in `app/app.config.ts`. Adjust the
+relative import to where you created `consent-scripts.ts`:
+
+```ts title="app/app.config.ts"
+import { scripts } from '../src/consent-scripts';
+
+export default defineAppConfig({
+  c15t: { scripts },
+});
+```
+
+The Nuxt module merges this over its options in `nuxt.config.ts` and starts
+one script loader in the browser after hydration, once it has applied the
+visitor's stored choice and privacy signals. Keep `scripts` out of
+`nuxt.config.ts`, which reaches the browser as JSON and drops the vendor
+callbacks. Write the vendor IDs into `consent-scripts.ts`. See
+[Nuxt scripts and embeds](https://c15t.com/docs/frameworks/nuxt/scripts).
+
+**Vue**
+
+Pass the scripts to the existing `c15tVue` plugin call in `src/main.ts`:
+
+```ts title="src/main.ts"
+import { c15tVue, manifest } from 'c15t/vue/vue-plugin';
+import { scripts } from './consent-scripts';
+
+app.use(c15tVue, {
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep your existing `mode` and other options. The plugin starts one
+script loader when the app mounts, after it has applied the visitor's stored
+choice. Do not also call `createScriptLoader` from a component. See
+[Vue scripts and embeds](https://c15t.com/docs/frameworks/vue/scripts).
+
+**Astro**
+
+Add the scripts to the client entrypoint from the
+[Astro quickstart](https://c15t.com/docs/frameworks/astro/quickstart), `src/c15t.client.ts`,
+which the integration finds on its own. Keep `astro.config.mjs` as it is.
+If the module already exports scripts, combine the two arrays.
+
+```ts title="src/c15t.client.ts"
+import type { C15tClientOptionsExtension } from 'c15t/astro';
+import { scripts } from './consent-scripts';
+
+export default { scripts } satisfies C15tClientOptionsExtension;
+```
+
+Vendor helpers contain callbacks, and the integration options in
+`astro.config.mjs` are serialized into the page, so do not put helpers in
+the integration's `scripts` option. The integration passes the client
+entrypoint to the one runtime every page shares, including across
+`ClientRouter` navigation.
+
+**Svelte**
+
+Import the scripts in the component that owns your existing provider and
+pass them as a top-level prop:
+
+```svelte title="src/App.svelte"
+<script lang="ts">
+  import { ConsentProvider, manifest } from 'c15t/svelte';
+  import { scripts } from './consent-scripts';
+</script>
+
+<ConsentProvider mode={manifest()} {scripts}>
+  <!-- Keep your application, consent UI and preferences link here. -->
+</ConsentProvider>
+```
+
+Retain the styles and consent UI from the [Svelte quickstart](https://c15t.com/docs/frameworks/svelte/quickstart).
+The provider owns the loader and disposes it on unmount.
+
+**SvelteKit**
+
+Add the scripts to the existing `ConsentRoot` in the root layout. Keep the
+handle and the layout load from the [SvelteKit quickstart](https://c15t.com/docs/frameworks/sveltekit/quickstart).
+
+```svelte title="src/routes/+layout.svelte"
+<script lang="ts">
+  import { ConsentRoot } from 'c15t/svelte';
+  import { scripts } from '../consent-scripts';
+
+  let { children, data } = $props();
+</script>
+
+<ConsentRoot state={data.consent} {scripts}>
+  {@render children()}
+  <!-- Keep your consent UI and preferences link here. -->
+</ConsentRoot>
+```
+
+Import vendor helpers in the layout component, not in `+layout.server.ts`:
+a server load cannot send functions to the browser. Prerendered, static and
+SPA-mode pages use the same `scripts` prop. If you pass an externally owned
+`runtime` to the provider, register scripts when creating that runtime instead.
+
+**HTML**
+
+The helpers in `@c15t/integrations` are ES modules that need a bundler. On a
+page that loads the c15t script tag, paste the vendor's own snippet instead
+and keep it inert until its category is allowed:
+
+```html
+<script type="text/plain" data-c15t-category="measurement">
+  // The vendor's snippet, unchanged
+</script>
+```
+
+Use the category this guide names for the vendor. c15t runs the snippet
+once that category is allowed, and reloads the page when the visitor
+withdraws it. Helper options on this page, such as `loadMode`, do not apply
+to a pasted snippet. See [HTML scripts](https://c15t.com/docs/frameworks/html/scripts).
+
+**JavaScript**
+
+Pass the scripts to `init()` from `@c15t/browser`, next to your mode:
+
+```ts
+import { init, manifest } from '@c15t/browser';
+import { scripts } from './consent-scripts';
+
+const consent = init({
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep the mode from your quickstart. With
+`createConsentRuntime` from `c15t/runtime`, pass `scripts` to it instead.
+A kernel you create yourself needs a loader from
+`c15t/modules/script-loader`. Attach one loader per kernel. See
+[JavaScript scripts](https://c15t.com/docs/frameworks/javascript/scripts).
+
+## Options
+
+| Option      | Default                                                     | Behavior                                                                                                                                              |
+| ----------- | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `siteId`    | Required                                                    | Lucky Orange site ID. Trimmed and URL-encoded into the default loader URL. If it's missing or blank, c15t logs an error and never loads Lucky Orange. |
+| `category`  | `measurement`                                               | Consent category or condition that must be allowed before the loader runs.                                                                            |
+| `scriptUrl` | `https://tools.luckyorange.com/core/lo.js?site-id=<siteId>` | Custom or proxied loader URL. A blank value uses the default.                                                                                         |
+
+A proxy `scriptUrl` must keep `lo.js` in its path. Lucky Orange finds the site
+ID by looking for script URLs that contain that file name. A renamed proxy path
+hasn't been tested.
+
+## Loading and revocation
+
+When the category is allowed, the helper creates `window.LOQ` as an array, or
+uses the one your page already defines. It pushes a `ready` callback onto the
+queue, then adds the loader. When Lucky Orange calls back, the helper waits for
+its privacy module and then sets the consent status to the visitor's current
+choice. If the visitor withdrew in the meantime, the helper sets it to `false`,
+so a late callback can't grant consent.
+
+If the privacy module fails to start, the helper logs
+`luckyOrange: privacy initialization failed.` with the error and never calls
+`setConsentStatus`. This holds even if c15t disposed the helper while it was
+waiting.
+
+On withdrawal, the helper keeps the loader on the page and calls
+`setConsentStatus(false)`. If the visitor grants consent again on the same
+page, it calls `setConsentStatus(true)` without loading Lucky Orange a second
+time. Calling `luckyOrange()` again with equal options, such as on a rerender,
+returns the same script.
+
+The helper doesn't call `optOut()`. That writes an opt-out cookie that lasts
+two years and gets in the way if the visitor grants consent again. c15t hasn't
+confirmed that `setConsentStatus(false)` stops every active recording, and
+removing a script can't unload recording code. Keep `reloadOnConsentRevoked`
+enabled. The next page, with consent denied, doesn't load Lucky Orange.
+
+## Cookies and storage
+
+Lucky Orange can set the `lo-domain-check`, `lo-opt-out`, `lo-uid` and
+`lo-visits` cookies, and `lo-session`, `lo-messenger` and `lo-visitor` in local
+storage. Some cookies last two years. Lucky Orange documents Do Not Track
+support. c15t hasn't tested how Do Not Track or an existing Lucky Orange
+opt-out interacts with the helper, so check both with your own account.
+
+## Verify Lucky Orange
+
+Filter the DevTools Network panel by `luckyorange.com`. Before consent, and
+with only an unrelated category allowed, check that no loader, `LOQ`, `LO`,
+cookie or storage entry appears. Allow measurement, wait for the privacy module
+and check that `LO.privacy.getConsentStatus()` returns `true`. Withdraw consent
+and confirm the page reloads with Lucky Orange blocked.
+
+If you set `reloadOnConsentRevoked: false`, withdraw consent while the loader is
+still downloading, and confirm that no late callback grants consent. With your
+own account, check recording state after withdrawal and a new grant. Keep
+Require Consent turned on.
+
+If the console shows `luckyOrange: privacy initialization failed.`, Lucky
+Orange never received a consent status.
+
+Sources: [browser library](https://developers.luckyorange.com/libraries/browser),
+[privacy tools](https://developers.luckyorange.com/libraries/browser/privacy-tools)
+and [cookies and storage](https://developers.luckyorange.com/libraries/browser/cookies-storage).
+
+Test in a private window with an opt-in policy. Open DevTools Network, disable
+the cache and filter by the vendor's domain:
+
+1. Load the page. No request goes to the vendor before you choose.
+2. Click Reject, then reload. There is still no vendor request.
+3. Open Privacy settings and allow the helper's category. The vendor script
+   loads without a page reload.
+4. Turn the category off again and save. c15t reloads the page, and the new
+   page makes no vendor request.
+
+c15t reloads on revocation because removing a script element does not stop
+code that already ran. The vendor's listeners, timers and queued events stay
+alive until the page unloads. If you set `reloadOnConsentRevoked: false`, stop
+the vendor yourself. Register a callback-only script whose `onConsentChange`
+calls the vendor's opt-out API, as shown in
+[custom integrations](./building-integrations.md), and check the
+permission before each of your own event calls. The reload does not delete
+cookies the vendor already set; see
+[clear on revocation for your framework](./overview.md#vendor-switches-and-cookie-cleanup).
+
+The helper lists its vendor by name in the preference dialog, so a visitor can
+turn it off inside an allowed category. See
+[vendor consent for your framework](./overview.md#vendor-switches-and-cookie-cleanup). The
+[consent verification guide](../guides/verify-consent.md) covers navigation,
+expiry and hosting checks.