// GTM — Consent Initialization Tag (fires first) window.dataLayer = window.dataLayer || []; function gtag() { dataLayer.push(arguments); } // Set denied defaults BEFORE OneTrust loads gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied', functionality_storage: 'granted', security_storage: 'granted', wait_for_update: 2000 // ms to wait for CMP }); // OneTrust callback — updates consent function OptanonWrapper() { const groups = window.OnetrustActiveGroups; gtag('consent', 'update', { ad_storage: groups.includes('C0004') ? 'granted' : 'denied', analytics_storage: groups.includes('C0002') ? 'granted' : 'denied', ad_user_data: groups.includes('C0004') ? 'granted' : 'denied', ad_personalization: groups.includes('C0004') ? 'granted' : 'denied' }); } // OneTrust group IDs (default) // C0001 = Strictly Necessary // C0002 = Performance / Analytics // C0003 = Functional // C0004 = Targeting / Advertising

from flask import Flask, request, jsonify from google.cloud import firestore, pubsub_v1 import hashlib, datetime, json app = Flask(__name__) db = firestore.Client() publisher = pubsub_v1.PublisherClient() TOPIC = "projects/ai-fix-pro/topics/consent-events" @app.route('/consent/record', methods=['POST']) def record_consent(): data = request.get_json() uid = data['user_id'] consent = { 'uid': uid, 'ad_storage': data.get('ad_storage'), 'analytics_storage': data.get('analytics_storage'), 'ad_user_data': data.get('ad_user_data'), 'tcf_string': data.get('tcf_string'), 'jurisdiction': data.get('jurisdiction', 'EU'), 'timestamp': datetime.datetime.utcnow().isoformat(), 'version': '2.0', 'ip_hash': hashlib.sha256( request.remote_addr.encode()).hexdigest() } # Store in Firestore (immutable append) ref = db.collection('consent').document(uid) ref.collection('versions').add(consent) ref.set({'latest': consent}, merge=True) # Publish to downstream systems publisher.publish(TOPIC, json.dumps(consent).encode()) return jsonify({'status': 'ok', 'uid': uid}), 200 @app.route('/consent/status/<uid>') def get_status(uid): doc = db.collection('consent').document(uid).get() if doc.exists: return jsonify(doc.to_dict()['latest']) return jsonify({'status': 'no_record'}), 404

// sGTM Custom Variable — calls GCP Consent API const sendHttpGet = require('sendHttpGet'); const getEventData = require('getEventData'); const JSON = require('JSON'); const returnValue = require('returnValue'); const runAsyncTask = require('runAsyncTask'); const userId = getEventData('user_id'); if (!userId) { returnValue(null); return; } runAsyncTask(() => { sendHttpGet( `https://consent.yourdomain.com/consent/status/${userId}`, (statusCode, headers, body) => { if (statusCode === 200) { const consent = JSON.parse(body); returnValue({ ad_granted: consent.ad_storage === 'granted', analytics_granted: consent.analytics_storage === 'granted', tcf_string: consent.tcf_string, jurisdiction: consent.jurisdiction }); } else { returnValue({ ad_granted: false, analytics_granted: false }); } } ); });