From 887b7c2de8efc107c9a8a6ad5d092e3b77eaba24 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Wed, 6 May 2026 23:46:48 +0300
Subject: feat(cookiebot): drop GTM noscript fallback for prior-consent
 compliance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `<noscript>` GTM iframe loads via a direct HTTP request to
googletagmanager.com/ns.html and bypasses both Cookiebot's auto-blocker
and Google Consent Mode v2 entirely — Consent Mode is JS-only
(`gtag('consent', 'default')` and the update API), so a noscript
request can't carry consent state. Under strict prior-consent (GDPR),
JS-disabled visitors get no analytics rather than unconsented analytics.

Addresses CodeRabbit review feedback on PR #1872.

\xf0\x9f\xa4\x96 Generated by [robots](https://vyos.io)
---
 docs/_templates/layout.html | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'docs/_templates/layout.html')

diff --git a/docs/_templates/layout.html b/docs/_templates/layout.html
index 4cd4e352..53963445 100644
--- a/docs/_templates/layout.html
+++ b/docs/_templates/layout.html
@@ -67,9 +67,11 @@
 {% endblock %}
 
 {% block body %}
-    {# GTM noscript fallback #}
-    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-T5VQHRT"
-                      height="0" width="0" style="display:none;visibility:hidden"
-                      title="Google Tag Manager"></iframe></noscript>
+    {# No GTM <noscript> iframe fallback. The fallback iframe loads via
+       a direct HTTP request and bypasses Cookiebot's auto-blocker and
+       Google Consent Mode v2 entirely (consent state is set via the JS
+       gtag API which a noscript request can't run). For strict
+       prior-consent compliance under GDPR, JS-disabled visitors get no
+       analytics rather than unconsented analytics. #}
     {{ super() }}
 {% endblock %}
-- 
cgit v1.2.3