# segment consent manager

## Cookie Logic

1. look for segment cookie
1. fallback for klaro cookie
    - true for klaro can be considered implicit consent for all of the legacy services we used, including GTM

- mechanics
  - servers tell browsers to set cookies
  - browsers send cookies that _match_, in their request
    - domain of cookie matches domain of request (including for assets)
    - connection type matches, e.g. "secure"
    - max-age not exceeded

## Notes re Cookies

RE: `SameSite` (`sameSite` in `js-cookie`)
- request from rasa.com to assets.rasa.com is "same-site"
- request from foobar.rasa.com to assets.rasa.com is "cross-site"
- `SameSite=Strict`
  - cookie will only be sent if on same site, as defined above
  - will not be sent on first load, i.e. navigation TO your site from somewhere else
- `SameSite=Lax`
  - will not be sent on cross-site request
  - WILL be sent on first navigation to matching site
- `SameSite=None`
  - will be sent in cross-site contexts
- **recommendation**
  - if using nothing at all, default to `SameSite=Lax`
  - if using `SameSite=None`, must also specify `Secure`
  - specify secure anyway

RE: `domain`
- domain defaults to the current domain *without* subdomains;
- if you include a domain, subdomains are also enabled
- the leading dot is ignored in modern browsers, but theoretically ensures maximum compatibility with older browsers

References
- [SameSite cookies explained](https://web.dev/samesite-cookies-explained/)
- [js-cookie](https://github.com/js-cookie/js-cookie)


## TODOs

- [x] parse cookies from any possible domain, set them only for top domain
- [x] consider Klaro analytics permission good for the following services: Google Analytics, Hotjar, HubSpot
- [x] remove all code to do with customPreferences; use the categories instead
- [x] create a way for the user to edit the tracking preferences afterward
- [x] make it work by category, instead of individual destination
- [x] remove the event emitter  in preferences.js ?
- [ ] make it respect california data-protection, not just EU detection
- [ ] [consider including js-cookie as script tag]([SameSite cookies explained](https://web.dev/samesite-cookies-explained/))
- [ ] consider limited application of GTM through Segment
    - [ ] maybe duplicate the container to a "beta" container with only the instrumentation, none of the GA events
    - [ ] then also add the GTM destination to the list of implicit consent, in remapping Klaro to Segment