ampproject / ampproject/amphtml

amp-consent: Unable to decache userConsent string added by AMP inside localStorage

Open
#38,508 5 comments 0 reactions 0 assignees View on GitHub
Component: amp-consent P3: When Possible Stale Type: Feature Request WG: components WG: runtime
Dominant language
JavaScript
Stars
14.9k
Forks
4.1k
PR merge metrics
No merged PRs in 30d

Description

### Description

We are using OneTrust CMP and right now the consent string send to our ad server has expired for some users meaning no ads are served for them.

So we would like the OneTrust popin to be retriggered without user gesture to allow them to reconsent and update the consent string.
Unfortunately the consent string is cached in a localStorage set by AMP (`amp-store:{xxx}`) and it prevents the OneTrust popin to be displayed.

We are collecting consent on client side via an iframe based on the following OneTrust documentation : https://community.cookiepro.com/s/article/UUID-94cf9b13-1998-d989-a5e0-d01a73a2e0a7?language=en_US

The only way I figured out to reset the AMP localstorage is to use `checkConsentHref` prop but based on AMP documentation, it is not mandatory for users who are collecting consent on client side :
`Note that [checkConsentHref](https://amp.dev/documentation/components/amp-consent/#checkconsenthref) is not mandatory if you collect consent and store consent completely at client side.`

So how can we remove this localStorage without using `checkConsentHref` ?

Another solution was to use the OneTrust AMP component but it is deprecated by OneTrust as no conform to new GDPR rules:
```
Update on AMP and TCF 2.0 Global Deprecation
Please note: if you are not utilizing the built-in integration with the amp-consent component, which is being deprecated, you are not impacted by this announcement.
...
```

### Alternatives Considered

1. Trigger click to display the popin (`document.getElementById('post-consent-ui').click();`)

Not working
In your `amp-script` documentation it says we can use `click` method : https://github.com/ampproject/worker-dom/blob/main/web_compat_table.md
Tested with and without user gesture, the `click` has no effect on the target element even if the element is defined.
By triggering the command directly in the Chrome console it is working fine.

2. Remove AMP consent localstorage

Not working
Message saying it is not allowed.

### Questions

What would you suggest in order to deal with this problem?
If no solution, could it be a new option of `amp-consent` component to disable the localstorage? I didn't find any other options to prevent it to be created.

Contributor guide

Open the contributing guide

Research direction

Review amp-consent's checkConsentHref and client-side consent flow first; compare the documented localStorage behavior with amp-script's click and storage restrictions. Done should be a documented supported way to refresh consent without an unnecessary checkConsentHref, or a clearly scoped option if the behavior must change.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.