Privacy And Cookie Consent
Privacy owns the versioned visitor choice, preferences dialog, footer access, required Google Analytics disclosure, and consent checks that govern first-party attribution cookies.
On this page
Where to look
| Area | Maintainer reference |
|---|---|
| Consent contract | Implementation referencesrc/features/privacy/shared/cookie-consent.ts |
| Consent UI | Implementation referencesrc/features/privacy/ui/cookie-consent.tsx |
| Preference access | Implementation referencesrc/features/privacy/ui/cookie-preferences-button.tsx |
| Application wiring | Implementation referencesrc/app/layout.tsx, src/app/(marketing)/_components/marketing-footer.tsx |
| Request enforcement | Implementation referencesrc/proxy.ts, src/lib/tracking/utm.ts |
| Storage names | Implementation referencesrc/config/app-identity.ts |
Implementation reference3 areas
These Product code locations explain how the documented behavior is implemented. Expand them when you are ready to customize or maintain this area.
Versioned decision
The shared contract serializes accepted or declined decisions into a versioned cookie that both browser UI and request code can parse.
src/features/privacy/shared/cookie-consent.tssrc/config/app-identity.ts
Visitor controls
The banner offers Accept and Customize choices; the footer can reopen saved preferences without erasing the prior decision.
src/features/privacy/ui/cookie-consent.tsxsrc/features/privacy/ui/cookie-preferences-button.tsx
Attribution enforcement
The request proxy creates first-touch, last-touch, landing, and session attribution cookies only after acceptance and clears old values when attribution is disabled.
src/proxy.tssrc/lib/tracking/utm.ts
Reference paths are relative to the Shipflash-Product checkout.
Consent flow
- 1
Read the current version
The client reads the versioned consent cookie and migrates a supported legacy local-storage decision once.
Relevant Product code
src/features/privacy/shared/cookie-consent.tssrc/features/privacy/ui/cookie-consent.tsx
- 2
Present a reversible choice
Customize opens a dialog without saving or closing the banner. Accept or save preferences records an explicit decision.
Relevant Product code
src/features/privacy/ui/cookie-consent.tsx
- 3
Apply the choice at the request boundary
The proxy fails closed for optional first-party attribution: no accepted decision means no new tracking cookies.
Relevant Product code
src/proxy.ts
- 4
Keep preferences reachable
The marketing footer dispatches the privacy event so visitors can review or change a saved choice later.
Relevant Product code
src/features/privacy/ui/cookie-preferences-button.tsxsrc/app/(marketing)/_components/marketing-footer.tsx
Versioned consent parsing
Use this example as a starting point, then adapt it to your product's rules and configuration.
Unknown and stale values resolve to no decision so optional attribution fails closed and the visitor can choose again.
export const cookieConsentValues = {
accepted: `v${COOKIE_CONSENT_VERSION}:accepted`,
declined: `v${COOKIE_CONSENT_VERSION}:declined`,
} as const;
export function parseCookieConsent(
value: string | null | undefined,
): CookieConsentDecision | null {
if (value === cookieConsentValues.accepted) return "accepted";
if (value === cookieConsentValues.declined) return "declined";
return null;
}
export function serializeCookieConsent(
decision: CookieConsentDecision,
): string {
return cookieConsentValues[decision];
}Source reference
src/features/privacy/shared/cookie-consent.ts
Privacy rules
- Do not record a decision when Customize is opened or dismissed.
- Keep required Google Analytics, session, and security cookies separate from optional attribution.
- Use the configured website brand name in visitor-facing consent copy.
- Clear optional cookies when a visitor saves preferences with attribution disabled.
- Increment the consent version only when purposes materially change and re-consent is required.
- Review every new analytics provider for script, cookie, data-transfer, and regional-consent requirements.