@webority/analytics 0.5.1 → 0.6.0

package/dist/webority-analytics-site.global.js

@@ -1 +1 @@
-var WeborityAnalytics=(()=>{var m=Object.defineProperty;var M=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var j=Object.prototype.hasOwnProperty;var G=(t,e)=>{for(var n in e)m(t,n,{get:e[n],enumerable:!0})},K=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of $(e))!j.call(t,r)&&r!==n&&m(t,r,{get:()=>e[r],enumerable:!(o=M(e,r))||o.enumerable});return t};var P=t=>K(m({},"__esModule",{value:!0}),t);var ct={};G(ct,{CONSENT_CHANGE_EVENT:()=>y,CONSENT_COOKIE_NAME:()=>u,captureAttribution:()=>x,getAttribution:()=>R,getConsent:()=>a,initConsent:()=>N,loadTags:()=>q,onConsentChange:()=>c,requiresOptIn:()=>b,saveConsent:()=>L});var p=Object.freeze(["AT","BE","BG","HR","CY","CZ","DK","EE","FI","FR","DE","GR","HU","IE","IT","LV","LT","LU","MT","NL","PL","PT","RO","SK","SI","ES","SE","IS","LI","NO","GB","CH"]);function b(t){let e=typeof t=="string"?t.trim().toUpperCase():"";return e.length!==2||e==="XX"||e==="T1"?!0:p.includes(e)}var u="webority_cookie_consent",y="webority-consent-change",H=365,i={initialized:!1,requiresOptIn:!0,cookieDomain:null,saved:null},g=new Set;function N(t){if(typeof t?.requiresOptIn!="boolean")throw new Error("@webority/analytics: initConsent needs requiresOptIn (true or false), decided from the visitor's country.");if(t.cookieDomain!==void 0&&(typeof t.cookieDomain!="string"||!t.cookieDomain.trim()))throw new Error('@webority/analytics: initConsent cookieDomain must be a domain such as ".example.com", or left out.');i.initialized=!0,i.requiresOptIn=t.requiresOptIn,i.cookieDomain=t.cookieDomain?.trim()??null,i.saved=X(),B(),i.saved&&v(i.saved)}function l(){return i.initialized}function a(){k("getConsent");let t=i.saved;if(t)return{essential:!0,analytics:t.analytics,functional:t.functional,marketing:t.marketing,decided:!0};let e=!i.requiresOptIn;return{essential:!0,analytics:e,functional:e,marketing:e,decided:!1}}function L(t){k("saveConsent");let e={essential:!0,analytics:t?.analytics===!0,functional:t?.functional===!0,marketing:t?.marketing===!0,timestamp:new Date().toISOString()};J(e),i.saved=e,v(e),Y(a())}function c(t){return g.add(t),()=>g.delete(t)}function Y(t){for(let e of g)try{e(t)}catch(n){queueMicrotask(()=>{throw n})}typeof window?.dispatchEvent=="function"&&typeof CustomEvent=="function"&&window.dispatchEvent(new CustomEvent(y,{detail:t}))}function k(t){if(!i.initialized)throw new Error(`@webority/analytics: call initConsent before ${t}.`)}function w(){window.dataLayer=window.dataLayer||[],window.dataLayer.push(arguments)}function B(){w("consent","default",{ad_storage:"denied",ad_user_data:"denied",ad_personalization:"denied",analytics_storage:"denied",functionality_storage:"denied",personalization_storage:"denied",security_storage:"granted",wait_for_update:500,region:[...p]}),w("consent","default",{ad_storage:"granted",ad_user_data:"granted",ad_personalization:"granted",analytics_storage:"granted",functionality_storage:"granted",personalization_storage:"granted",security_storage:"granted"})}function v(t){let e=n=>n?"granted":"denied";w("consent","update",{analytics_storage:e(t.analytics),functionality_storage:e(t.functional),personalization_storage:e(t.functional),ad_storage:e(t.marketing),ad_user_data:e(t.marketing),ad_personalization:e(t.marketing)})}function X(){let t=`${u}=`,e=(document.cookie||"").split(";").map(n=>n.trim()).find(n=>n.startsWith(t));if(!e)return null;try{let n=JSON.parse(decodeURIComponent(e.slice(t.length)));return!n||typeof n!="object"?null:{essential:!0,analytics:n.analytics===!0,functional:n.functional===!0,marketing:n.marketing===!0,timestamp:n.timestamp??null}}catch{return null}}function J(t){let e=new Date(Date.now()+H*24*60*60*1e3).toUTCString(),n=i.cookieDomain?`;domain=${i.cookieDomain}`:"",o=window.location?.protocol==="https:"?";Secure":"";document.cookie=`${u}=${encodeURIComponent(JSON.stringify(t))};expires=${e};path=/${n};SameSite=Lax${o}`}var f="webority_attribution",V=2160*60*60*1e3,Q=200,C=500,W=Object.freeze({utm_source:"utmSource",utm_medium:"utmMedium",utm_campaign:"utmCampaign",utm_content:"utmContent",utm_term:"utmTerm",gclid:"gclid",gbraid:"gbraid",wbraid:"wbraid",fbclid:"fbclid",msclkid:"msclkid",li_fat_id:"liFatId"}),A=!1;function x(){U("captureAttribution"),et();let t=Z();if(!t)return;let e=I(_());z(_(),{firstTouch:e?.firstTouch??t,lastTouch:t})}function R(){return U("getAttribution"),I(_())}function Z(){let t=new URLSearchParams(window.location.search),e={};for(let[o,r]of Object.entries(W)){let O=d(t.get(o),Q);O&&(e[r]=O)}let n=d(t.get("referrer"),C)||tt();return n&&(e.referrer=n),Object.keys(e).length===0?null:(e.landingPage=d(window.location.pathname,C),e.capturedDateTimeUtc=new Date().toISOString(),e)}function tt(){let t=document.referrer;if(!t)return"";try{return new URL(t).hostname===window.location.hostname?"":d(t,C)}catch{return""}}function et(){A||(A=!0,c(t=>{let e=t.marketing?T():h(),n=t.marketing?h():T(),o=I(e);nt(e),o&&z(n,o)}))}function _(){return a().marketing?h():T()}function h(){try{return window.localStorage}catch{return null}}function T(){try{return window.sessionStorage}catch{return null}}function I(t){try{let e=t?.getItem(f);if(!e)return null;let n=JSON.parse(e),o=D(n?.firstTouch),r=D(n?.lastTouch);return!o&&!r?(t.removeItem(f),null):{firstTouch:o??r,lastTouch:r??o}}catch{return null}}function z(t,e){try{t?.setItem(f,JSON.stringify(e))}catch{}}function nt(t){try{t?.removeItem(f)}catch{}}function D(t){if(!t||typeof t!="object")return null;let e=Date.parse(t.capturedDateTimeUtc);return Number.isFinite(e)&&Date.now()-e<=V?t:null}function d(t,e){let n=String(t??"").trim();return n?n.slice(0,e):""}function U(t){if(!l())throw new Error(`@webority/analytics: call initConsent before ${t}.`)}var ot=["scroll","mousemove","touchstart","keydown","pointerdown"],F=1500,rt=3e3,it=100,s={loaded:!1,clarityId:null,clarityLoaded:!1};function q(t={}){if(!l())throw new Error("@webority/analytics: call initConsent before loadTags.");if(s.loaded)return;s.loaded=!0;let{gtmId:e,clarityId:n,ahrefsKey:o}=t;o&&S("https://analytics.ahrefs.com/analytics.js",{"data-key":o}),e&&at(()=>{window.dataLayer=window.dataLayer||[],window.dataLayer.push({"gtm.start":Date.now(),event:"gtm.js"}),S(`https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(e)}`)}),n&&(s.clarityId=n,a().analytics&&st(),c(r=>{r.analytics&&E()}))}function at(t){let e=!1,n=()=>{e||(e=!0,t())};for(let o of ot)window.addEventListener(o,n,{once:!0,passive:!0});document.readyState==="complete"?setTimeout(n,F):window.addEventListener("load",()=>setTimeout(n,F),{once:!0})}function st(){let t=()=>{window.scrollY>it&&(window.removeEventListener("scroll",t),E())};window.addEventListener("scroll",t,{passive:!0}),setTimeout(E,rt)}function E(){s.clarityLoaded||!s.clarityId||(s.clarityLoaded=!0,window.clarity=window.clarity||function(){window.clarity.q=window.clarity.q||[],window.clarity.q.push(arguments)},S(`https://www.clarity.ms/tag/${encodeURIComponent(s.clarityId)}`,{crossorigin:"anonymous"}))}function S(t,e={}){let n=document.createElement("script");n.async=!0,n.src=t;for(let[o,r]of Object.entries(e))n.setAttribute(o,r);document.head.appendChild(n)}return P(ct);})();
+var WeborityAnalytics=(()=>{var y=Object.defineProperty;var Y=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var X=Object.prototype.hasOwnProperty;var V=(t,e)=>{for(var n in e)y(t,n,{get:e[n],enumerable:!0})},Q=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of J(e))!X.call(t,i)&&i!==n&&y(t,i,{get:()=>e[i],enumerable:!(o=Y(e,i))||o.enumerable});return t};var W=t=>Q(y({},"__esModule",{value:!0}),t);var yt={};V(yt,{CONSENT_CHANGE_EVENT:()=>_,CONSENT_COOKIE_NAME:()=>l,captureAttribution:()=>$,getAttribution:()=>j,getConsent:()=>s,initConsent:()=>A,loadTags:()=>B,onConsentChange:()=>c,requiresOptIn:()=>k,saveConsent:()=>R});var w=Object.freeze(["AT","BE","BG","HR","CY","CZ","DK","EE","FI","FR","DE","GR","HU","IE","IT","LV","LT","LU","MT","NL","PL","PT","RO","SK","SI","ES","SE","IS","LI","NO","GB","CH"]);function k(t){let e=typeof t=="string"?t.trim().toUpperCase():"";return e.length!==2||e==="XX"||e==="T1"?!0:w.includes(e)}var l="webority_cookie_consent",_="webority-consent-change",L=365,r={initialized:!1,requiresOptIn:!0,strictOptIn:!1,adStorage:!0,cookieDays:L,cookieDomain:null,saved:null},C=new Set;function A(t){let e=t?.strictOptIn??!1;if(typeof e!="boolean")throw new Error("@webority/analytics: initConsent strictOptIn must be true or false, or left out.");if(e){if(t.requiresOptIn!==void 0&&t.requiresOptIn!==!0)throw new Error("@webority/analytics: initConsent strictOptIn asks every visitor to opt in, so requiresOptIn must be true or left out.")}else if(typeof t?.requiresOptIn!="boolean")throw new Error("@webority/analytics: initConsent needs requiresOptIn (true or false), decided from the visitor's country.");if(t.cookieDomain!==void 0&&(typeof t.cookieDomain!="string"||!t.cookieDomain.trim()))throw new Error('@webority/analytics: initConsent cookieDomain must be a domain such as ".example.com", or left out.');if(t.cookieDays!==void 0&&!(Number.isInteger(t.cookieDays)&&t.cookieDays>0))throw new Error("@webority/analytics: initConsent cookieDays must be a whole number of days above zero, or left out.");if(t.adStorage!==void 0&&typeof t.adStorage!="boolean")throw new Error("@webority/analytics: initConsent adStorage must be true or false, or left out.");r.initialized=!0,r.strictOptIn=e,r.requiresOptIn=e||t.requiresOptIn,r.adStorage=t.adStorage??!e,r.cookieDays=t.cookieDays??L,r.cookieDomain=t.cookieDomain?.trim()??null;let{saved:n,entryCount:o}=et();r.saved=n,r.cookieDomain&&o>1&&n&&q(n),tt(),r.saved&&U(r.saved)}function f(){return r.initialized}function v(){return r.strictOptIn}function x(){return r.adStorage}function s(){z("getConsent");let t=r.saved;if(t)return{essential:!0,analytics:t.analytics,functional:t.functional,marketing:t.marketing,decided:!0};let e=!r.requiresOptIn;return{essential:!0,analytics:e,functional:e,marketing:e,decided:!1}}function R(t){z("saveConsent");let e={essential:!0,analytics:t?.analytics===!0,functional:t?.functional===!0,marketing:t?.marketing===!0,timestamp:new Date().toISOString()};q(e),r.saved=e,U(e),Z(s())}function c(t){return C.add(t),()=>C.delete(t)}function Z(t){for(let e of C)try{e(t)}catch(n){queueMicrotask(()=>{throw n})}typeof window?.dispatchEvent=="function"&&typeof CustomEvent=="function"&&window.dispatchEvent(new CustomEvent(_,{detail:t}))}function z(t){if(!r.initialized)throw new Error(`@webority/analytics: call initConsent before ${t}.`)}function d(){window.dataLayer=window.dataLayer||[],window.dataLayer.push(arguments)}function tt(){if(r.strictOptIn){d("consent","default",{ad_storage:"denied",ad_user_data:"denied",ad_personalization:"denied",analytics_storage:"denied",functionality_storage:"denied",personalization_storage:"denied",security_storage:"granted",wait_for_update:500});return}d("consent","default",{ad_storage:"denied",ad_user_data:"denied",ad_personalization:"denied",analytics_storage:"denied",functionality_storage:"denied",personalization_storage:"denied",security_storage:"granted",wait_for_update:500,region:[...w]}),d("consent","default",{ad_storage:"granted",ad_user_data:"granted",ad_personalization:"granted",analytics_storage:"granted",functionality_storage:"granted",personalization_storage:"granted",security_storage:"granted"})}function U(t){let e=o=>o?"granted":"denied",n=t.marketing&&r.adStorage;d("consent","update",{analytics_storage:e(t.analytics),functionality_storage:e(t.functional),personalization_storage:e(t.functional),ad_storage:e(n),ad_user_data:e(n),ad_personalization:e(n)})}function et(){let t=`${l}=`,e=(document.cookie||"").split(";").map(o=>o.trim()).filter(o=>o.startsWith(t)),n=e.map(o=>nt(o.slice(t.length))).filter(Boolean);return{saved:ot(n),entryCount:e.length}}function nt(t){try{let e=JSON.parse(decodeURIComponent(t));return!e||typeof e!="object"?null:{essential:!0,analytics:e.analytics===!0,functional:e.functional===!0,marketing:e.marketing===!0,timestamp:e.timestamp??null}}catch{return null}}function ot(t){if(t.length===0)return null;let e=t.map(o=>typeof o.timestamp=="string"?Date.parse(o.timestamp):Number.NaN);if(e.some(Number.isNaN))return t.at(-1);let n=0;for(let o=1;o<t.length;o++)e[o]>=e[n]&&(n=o);return t[n]}function q(t){let e=typeof t.timestamp=="string"?Date.parse(t.timestamp):Number.NaN,n=(Number.isNaN(e)?Date.now():e)+r.cookieDays*24*60*60*1e3,o=window.location?.protocol==="https:"?";Secure":"";r.cookieDomain&&D(`${l}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/;SameSite=Lax${o}`);let i=r.cookieDomain?`;domain=${r.cookieDomain}`:"";D(`${l}=${encodeURIComponent(JSON.stringify(t))};expires=${new Date(n).toUTCString()};path=/${i};SameSite=Lax${o}`)}function D(t){document.cookie=t}var p="webority_attribution",rt=2160*60*60*1e3,it=200,I=500,at=Object.freeze({utm_source:"utmSource",utm_medium:"utmMedium",utm_campaign:"utmCampaign",utm_content:"utmContent",utm_term:"utmTerm",gclid:"gclid",gbraid:"gbraid",wbraid:"wbraid",fbclid:"fbclid",msclkid:"msclkid",li_fat_id:"liFatId"}),F=!1;function $(){K("captureAttribution"),ut();let t=st();if(!t)return;let e=T(h());G(h(),{firstTouch:e?.firstTouch??t,lastTouch:t})}function j(){return K("getAttribution"),T(h())}function st(){let t=new URLSearchParams(window.location.search),e={};for(let[o,i]of Object.entries(at)){let a=m(t.get(o),it);a&&(e[i]=a)}let n=m(t.get("referrer"),I)||ct();return n&&(e.referrer=n),Object.keys(e).length===0?null:(e.landingPage=m(window.location.pathname,I),e.capturedDateTimeUtc=new Date().toISOString(),e)}function ct(){let t=document.referrer;if(!t)return"";try{return new URL(t).hostname===window.location.hostname?"":m(t,I)}catch{return""}}function ut(){F||(F=!0,c(t=>{let e=t.marketing?S():E(),n=t.marketing?E():S(),o=T(e);lt(e),o&&G(n,o)}))}function h(){return s().marketing?E():S()}function E(){try{return window.localStorage}catch{return null}}function S(){try{return window.sessionStorage}catch{return null}}function T(t){try{let e=t?.getItem(p);if(!e)return null;let n=JSON.parse(e),o=M(n?.firstTouch),i=M(n?.lastTouch);return!o&&!i?(t.removeItem(p),null):{firstTouch:o??i,lastTouch:i??o}}catch{return null}}function G(t,e){try{t?.setItem(p,JSON.stringify(e))}catch{}}function lt(t){try{t?.removeItem(p)}catch{}}function M(t){if(!t||typeof t!="object")return null;let e=Date.parse(t.capturedDateTimeUtc);return Number.isFinite(e)&&Date.now()-e<=rt?t:null}function m(t,e){let n=String(t??"").trim();return n?n.slice(0,e):""}function K(t){if(!f())throw new Error(`@webority/analytics: call initConsent before ${t}.`)}var dt=["scroll","mousemove","touchstart","keydown","pointerdown"],P=1500,ft=3e3,mt=100,u={loaded:!1,clarityId:null,clarityLoaded:!1};function B(t={}){if(!f())throw new Error("@webority/analytics: call initConsent before loadTags.");if(u.loaded)return;u.loaded=!0;let{gtmId:e,clarityId:n,ahrefsKey:o}=t,i=v();if(o){let a=()=>b("https://analytics.ahrefs.com/analytics.js",{"data-key":o});i?H(g=>g.analytics,a):a()}if(e){let a=()=>pt(()=>{window.dataLayer=window.dataLayer||[],window.dataLayer.push({"gtm.start":Date.now(),event:"gtm.js"}),b(`https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(e)}`)});if(i){let g=x();H(N=>N.analytics||N.marketing&&g,a)}else a()}n&&(u.clarityId=n,s().analytics&&gt(),c(a=>{a.analytics&&O()}))}function H(t,e){if(t(s())){e();return}let n=c(o=>{t(o)&&(n(),e())})}function pt(t){let e=!1,n=()=>{e||(e=!0,t())};for(let o of dt)window.addEventListener(o,n,{once:!0,passive:!0});document.readyState==="complete"?setTimeout(n,P):window.addEventListener("load",()=>setTimeout(n,P),{once:!0})}function gt(){let t=()=>{window.scrollY>mt&&(window.removeEventListener("scroll",t),O())};window.addEventListener("scroll",t,{passive:!0}),setTimeout(O,ft)}function O(){u.clarityLoaded||!u.clarityId||(u.clarityLoaded=!0,window.clarity=window.clarity||function(){window.clarity.q=window.clarity.q||[],window.clarity.q.push(arguments)},b(`https://www.clarity.ms/tag/${encodeURIComponent(u.clarityId)}`,{crossorigin:"anonymous"}))}function b(t,e={}){let n=document.createElement("script");n.async=!0,n.src=t;for(let[o,i]of Object.entries(e))n.setAttribute(o,i);document.head.appendChild(n)}return W(yt);})();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webority/analytics",
-    "version": "0.5.1",
+    "version": "0.6.0",
     "license": "MIT",
     "type": "module",
     "main": "src/index.js",

package/src/consent.js

@@ -2,11 +2,14 @@ import { OPT_IN_COUNTRIES } from "./consent-regions.js";
 
 export const CONSENT_COOKIE_NAME = "webority_cookie_consent";
 export const CONSENT_CHANGE_EVENT = "webority-consent-change";
-const CONSENT_COOKIE_DAYS = 365;
+const DEFAULT_COOKIE_DAYS = 365;
 
 const consentState = {
     initialized: false,
     requiresOptIn: true,
+    strictOptIn: false,
+    adStorage: true,
+    cookieDays: DEFAULT_COOKIE_DAYS,
     cookieDomain: null,
     saved: null,
 };
@@ -18,19 +21,50 @@ const listeners = new Set();
  * knows the visitor's country (requiresOptIn(countryCode)); guessing it in the browser misplaces
  * VPN users. cookieDomain (".capnix.ai") shares one choice between the website and every portal
  * subdomain; without it the choice stays on the current host.
+ *
+ * strictOptIn asks every visitor in every region: Consent Mode is denied everywhere until they
+ * choose, loadTags holds Tag Manager and Ahrefs until consent, and requiresOptIn may be left out.
+ * adStorage says whether marketing consent also grants Google's ad_* signals: true by default,
+ * false under strictOptIn. cookieDays is the saved choice's lifetime, 365 by default.
  */
 export function initConsent(options) {
-    if (typeof options?.requiresOptIn !== "boolean") {
+    const strictOptIn = options?.strictOptIn ?? false;
+    if (typeof strictOptIn !== "boolean") {
+        throw new Error("@webority/analytics: initConsent strictOptIn must be true or false, or left out.");
+    }
+    if (strictOptIn) {
+        if (options.requiresOptIn !== undefined && options.requiresOptIn !== true) {
+            throw new Error(
+                "@webority/analytics: initConsent strictOptIn asks every visitor to opt in, so requiresOptIn must be true or left out.",
+            );
+        }
+    } else if (typeof options?.requiresOptIn !== "boolean") {
         throw new Error("@webority/analytics: initConsent needs requiresOptIn (true or false), decided from the visitor's country.");
     }
     if (options.cookieDomain !== undefined && (typeof options.cookieDomain !== "string" || !options.cookieDomain.trim())) {
         throw new Error('@webority/analytics: initConsent cookieDomain must be a domain such as ".example.com", or left out.');
     }
+    if (options.cookieDays !== undefined && !(Number.isInteger(options.cookieDays) && options.cookieDays > 0)) {
+        throw new Error("@webority/analytics: initConsent cookieDays must be a whole number of days above zero, or left out.");
+    }
+    if (options.adStorage !== undefined && typeof options.adStorage !== "boolean") {
+        throw new Error("@webority/analytics: initConsent adStorage must be true or false, or left out.");
+    }
 
     consentState.initialized = true;
-    consentState.requiresOptIn = options.requiresOptIn;
+    consentState.strictOptIn = strictOptIn;
+    consentState.requiresOptIn = strictOptIn || options.requiresOptIn;
+    consentState.adStorage = options.adStorage ?? !strictOptIn;
+    consentState.cookieDays = options.cookieDays ?? DEFAULT_COOKIE_DAYS;
     consentState.cookieDomain = options.cookieDomain?.trim() ?? null;
-    consentState.saved = readConsentCookie();
+    const { saved, entryCount } = readConsentCookie();
+    consentState.saved = saved;
+
+    // A host-only cookie from before the domain was set sits beside the shared one, and
+    // browsers list the older first. Folding them into one stops an old choice resurfacing.
+    if (consentState.cookieDomain && entryCount > 1 && saved) {
+        writeConsentCookie(saved);
+    }
 
     pushConsentDefaults();
     if (consentState.saved) {
@@ -42,6 +76,14 @@ export function isConsentInitialized() {
     return consentState.initialized;
 }
 
+export function isStrictOptIn() {
+    return consentState.strictOptIn;
+}
+
+export function isAdStorageEnabled() {
+    return consentState.adStorage;
+}
+
 /**
  * The visitor's current consent. Before they choose (decided: false) every optional category
  * follows the region default: denied where opt-in is required, granted everywhere else.
@@ -117,6 +159,19 @@ function gtag() {
 
 // Defaults must reach dataLayer before the Tag Manager container loads, or its tags fire ungated.
 function pushConsentDefaults() {
+    if (consentState.strictOptIn) {
+        gtag("consent", "default", {
+            ad_storage: "denied",
+            ad_user_data: "denied",
+            ad_personalization: "denied",
+            analytics_storage: "denied",
+            functionality_storage: "denied",
+            personalization_storage: "denied",
+            security_storage: "granted",
+            wait_for_update: 500,
+        });
+        return;
+    }
     gtag("consent", "default", {
         ad_storage: "denied",
         ad_user_data: "denied",
@@ -141,28 +196,30 @@ function pushConsentDefaults() {
 
 function pushConsentUpdate(saved) {
     const state = (granted) => (granted ? "granted" : "denied");
+    const ads = saved.marketing && consentState.adStorage;
     gtag("consent", "update", {
         analytics_storage: state(saved.analytics),
         functionality_storage: state(saved.functional),
         personalization_storage: state(saved.functional),
-        ad_storage: state(saved.marketing),
-        ad_user_data: state(saved.marketing),
-        ad_personalization: state(saved.marketing),
+        ad_storage: state(ads),
+        ad_user_data: state(ads),
+        ad_personalization: state(ads),
     });
 }
 
 function readConsentCookie() {
     const prefix = `${CONSENT_COOKIE_NAME}=`;
-    const entry = (document.cookie || "")
+    const entries = (document.cookie || "")
         .split(";")
         .map((part) => part.trim())
-        .find((part) => part.startsWith(prefix));
-    if (!entry) {
-        return null;
-    }
+        .filter((part) => part.startsWith(prefix));
+    const choices = entries.map((entry) => parseConsentEntry(entry.slice(prefix.length))).filter(Boolean);
+    return { saved: newestChoice(choices), entryCount: entries.length };
+}
 
+function parseConsentEntry(value) {
     try {
-        const parsed = JSON.parse(decodeURIComponent(entry.slice(prefix.length)));
+        const parsed = JSON.parse(decodeURIComponent(value));
         if (!parsed || typeof parsed !== "object") {
             return null;
         }
@@ -179,17 +236,52 @@ function readConsentCookie() {
     }
 }
 
+// Without a readable timestamp on every choice, the last one wins: browsers list equal-path
+// cookies oldest first.
+function newestChoice(choices) {
+    if (choices.length === 0) {
+        return null;
+    }
+    const times = choices.map((choice) => (typeof choice.timestamp === "string" ? Date.parse(choice.timestamp) : Number.NaN));
+    if (times.some(Number.isNaN)) {
+        return choices.at(-1);
+    }
+    let newest = 0;
+    for (let index = 1; index < choices.length; index++) {
+        if (times[index] >= times[newest]) {
+            newest = index;
+        }
+    }
+    return choices[newest];
+}
+
 function writeConsentCookie(saved) {
-    const expires = new Date(Date.now() + CONSENT_COOKIE_DAYS * 24 * 60 * 60 * 1000).toUTCString();
-    const domain = consentState.cookieDomain ? `;domain=${consentState.cookieDomain}` : "";
+    // The lifetime runs from the choice, so folding an old choice onto the shared domain does not extend it.
+    const chosenAt = typeof saved.timestamp === "string" ? Date.parse(saved.timestamp) : Number.NaN;
+    const expiresAt = (Number.isNaN(chosenAt) ? Date.now() : chosenAt) + consentState.cookieDays * 24 * 60 * 60 * 1000;
     const secure = window.location?.protocol === "https:" ? ";Secure" : "";
+    if (consentState.cookieDomain) {
+        // Expired before the shared write: a browser that treats the two as one cookie on the
+        // apex host then still ends up holding the shared one.
+        setCookie(`${CONSENT_COOKIE_NAME}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/;SameSite=Lax${secure}`);
+    }
+    const domain = consentState.cookieDomain ? `;domain=${consentState.cookieDomain}` : "";
+    setCookie(
+        `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(saved))};expires=${new Date(expiresAt).toUTCString()};path=/${domain};SameSite=Lax${secure}`,
+    );
+}
+
+function setCookie(text) {
     // biome-ignore lint/suspicious/noDocumentCookie: the Cookie Store API is missing from browsers our visitors use.
-    document.cookie = `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(saved))};expires=${expires};path=/${domain};SameSite=Lax${secure}`;
+    document.cookie = text;
 }
 
 export function resetConsentForTests() {
     consentState.initialized = false;
     consentState.requiresOptIn = true;
+    consentState.strictOptIn = false;
+    consentState.adStorage = true;
+    consentState.cookieDays = DEFAULT_COOKIE_DAYS;
     consentState.cookieDomain = null;
     consentState.saved = null;
     listeners.clear();

package/src/tags.js

@@ -1,4 +1,4 @@
-import { getConsent, isConsentInitialized, onConsentChange } from "./consent.js";
+import { getConsent, isAdStorageEnabled, isConsentInitialized, isStrictOptIn, onConsentChange } from "./consent.js";
 
 const INTERACTION_EVENTS = ["scroll", "mousemove", "touchstart", "keydown", "pointerdown"];
 const DEFER_AFTER_LOAD_MS = 1500;
@@ -18,6 +18,11 @@ const tagState = {
  * analytics consent, and a revoke takes effect from the next page. Ahrefs is cookieless and
  * loads straight away. GA4 is deliberately absent: it runs inside the Tag Manager container,
  * and loading it here as well counts every page view twice.
+ *
+ * Under initConsent's strictOptIn nothing loads before consent: Ahrefs waits for analytics, and
+ * Tag Manager for analytics, or for marketing when adStorage lets marketing grant ad signals,
+ * whether granted on this page or saved on an earlier one. Marketing alone without adStorage
+ * unlocks nothing in the container, and loading it would still let GA4 send cookieless pings.
  */
 export function loadTags(options = {}) {
     if (!isConsentInitialized()) {
@@ -29,17 +34,30 @@ export function loadTags(options = {}) {
     tagState.loaded = true;
 
     const { gtmId, clarityId, ahrefsKey } = options;
+    const strict = isStrictOptIn();
 
     if (ahrefsKey) {
-        appendScript("https://analytics.ahrefs.com/analytics.js", { "data-key": ahrefsKey });
+        const loadAhrefs = () => appendScript("https://analytics.ahrefs.com/analytics.js", { "data-key": ahrefsKey });
+        if (strict) {
+            whenConsented((consent) => consent.analytics, loadAhrefs);
+        } else {
+            loadAhrefs();
+        }
     }
 
     if (gtmId) {
-        runAfterFirstInteraction(() => {
-            window.dataLayer = window.dataLayer || [];
-            window.dataLayer.push({ "gtm.start": Date.now(), event: "gtm.js" });
-            appendScript(`https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(gtmId)}`);
-        });
+        const loadTagManager = () =>
+            runAfterFirstInteraction(() => {
+                window.dataLayer = window.dataLayer || [];
+                window.dataLayer.push({ "gtm.start": Date.now(), event: "gtm.js" });
+                appendScript(`https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(gtmId)}`);
+            });
+        if (strict) {
+            const ads = isAdStorageEnabled();
+            whenConsented((consent) => consent.analytics || (consent.marketing && ads), loadTagManager);
+        } else {
+            loadTagManager();
+        }
     }
 
     if (clarityId) {
@@ -55,6 +73,19 @@ export function loadTags(options = {}) {
     }
 }
 
+function whenConsented(granted, callback) {
+    if (granted(getConsent())) {
+        callback();
+        return;
+    }
+    const unsubscribe = onConsentChange((consent) => {
+        if (granted(consent)) {
+            unsubscribe();
+            callback();
+        }
+    });
+}
+
 function runAfterFirstInteraction(callback) {
     let ran = false;
     const run = () => {