CookieHub 2.10
CookieHub 2.10 adds Canadian province support and corrects how the widget signals US state privacy choices to vendors through IAB GPP, Global Privacy Control and Do Not Track.
It also fixes automatic cookie blocking on Firefox, IAB TCF consent after a revision bump, and the onAllow and onRevoke events.
What's new
Canadian province support
The Dashboard region configuration now includes all thirteen Canadian provinces and territories and a new region group, Canada required opt-in provinces. Consent can now be configured by province the way it already can by US state.
The group covers the provinces whose law requires opt-in consent. Quebec is currently the only one. Quebec visitors resolve to the new group, and every other Canadian visitor resolves to Canada as before.
Existing Canadian configurations are unchanged until you add the new group or a province to your domain.
Google Consent Mode and Global Privacy Control with implied consent
When the visitor's browser sends Global Privacy Control, the Google Consent Mode defaults for categories set to implied consent, such as analytics_storage, are now denied. Previously they were granted regardless of GPC, so Google tags received a granted default for a visitor who had signalled an opt-out.
The category itself is no longer granted before interaction either, so scripts that depend on it do not run. This applies to categories marked Used for tracking (DNT). Do Not Track is handled the same way.
This does not yet apply to installs using the GTM community template. There, the Consent Mode defaults come from the template's settings, and Google Tag Manager does not allow a template to read the Global Privacy Control signal. A visitor with GPC who has not answered keeps the defaults set in the template until they make a choice. A fix in a later widget version will apply GPC once CookieHub has loaded.
US privacy signals
CookieHub 2.10 corrects several signals sent to vendors in US privacy regions:
- A visitor who opts out of sale and sharing is now also signalled as opted out of targeted advertising in the IAB GPP usnat section. Targeted advertising is a separate right in seventeen US states.
- A live Global Privacy Control or Do Not Track signal now takes precedence over a choice stored from a previous visit. Opt-outs that come from GPC are recorded in the consent log as such.
- The Check "Allow sale and sharing" by default region setting now sets the value sent to vendors, not only the Allow sale and sharing of personal information checkbox. The checkbox and the signal always agree.
- The legacy US Privacy (USP) string now returns the not-applicable value outside CCPA regions, so visitors under GDPR no longer receive a US privacy signal.
Updated "Do not sell or share" default text
The default "Do not sell or share my personal data" text has been rewritten to cover sale, sharing and targeted advertising rather than California alone, in every language.
Domains using the default text receive the new wording when they next publish.
Automatic cookie blocking on Firefox
Automatic cookie blocking blocked no scripts on Firefox, because the browser removed the event it relied on. Scripts loaded before consent are now blocked on Firefox as on other browsers.
A dynamically injected script that had already run is also no longer run a second time when the visitor gives consent.
Consent origin in the consent log
Consent events now record how they originated: a visitor action, a region default, a GPC signal, or closing the consent dialog when it is configured to allow or deny on close. The origin is shown in the consent log in the Dashboard.
Other improvements and fixes
CookieHub 2.10 also includes the following fixes:
- Bumping the revision now clears the stored IAB TCF consent as well as showing the consent dialog again, so vendors are told there is no consent until the visitor answers, and the purpose and vendor switches are no longer pre-checked.
- Granular IAB TCF saves now write vendor legitimate interests, so vendors relying on legitimate interest are signalled as such.
- The onRevoke event now fires when a category is withdrawn after Allow all, and onAllow is no longer skipped when moving to Allow all.
Recommended checks
Domains with Automatic Updates enabled in domain settings receive CookieHub 2.10 automatically. Other domains are offered the upgrade in the Dashboard.
We recommend reviewing the following if they apply to your implementation.
Regions that start visitors opted out of sale and sharing
The Check "Allow sale and sharing" by default region setting is checked by default, and domains that keep it checked are unaffected.
If you have unchecked it for a region, a visitor who has not made a choice is now signalled to vendors as opted out of sale, sharing and targeted advertising, which is what the setting was meant to do. Previously only the checkbox appeared unchecked, while vendors were still told the visitor had not opted out. Accept all does not opt them back in; only the Allow sale and sharing of personal information checkbox does.
Customized "Do not sell or share" labels
If you have customized the "Do not sell or share" labels, your text is kept. Review it against the new default, which covers sale, sharing and targeted advertising.
Custom code using onAllow and onRevoke
If your website listens for the onAllow or onRevoke events from the JavaScript API, including the cookiehub_onAllow and cookiehub_onRevoke document events, they now also fire in the cases described above. Check that your code handles a category being allowed or revoked in these cases.
Included automatically in CookieHub 2.10
The following updates are included automatically when CookieHub 2.10 is loaded:
- Google Consent Mode defaults denied for implied categories under Global Privacy Control.
- Corrected IAB GPP, GPC, Do Not Track and USP signals.
- Automatic cookie blocking on Firefox.
- IAB TCF fixes for revision bumps and vendor legitimate interests.
- Consent origin in the consent log.
- JavaScript API event fixes.
Canadian provinces and the Canada required opt-in provinces group are available in the Dashboard region configuration and take effect when you add them to your domain.
For the full technical list of changes, see the CookieHub 2.10 change log.
Need help?
If you have questions about the update or need help reviewing your setup, contact us at support@cookiehub.com.