Consent Manager 2.0.0 Patch 3
- Author DEBTech
- Creation date
Changelog v1.0.4
New Features — Google Revenue Fix
- Google Additional Consent (AC) Spec:
addtlConsentcookie is now set alongsideeuconsent-v2— 199 Google AC vendors (Google #229, Xandr #80, Index Exchange #126, Criteo #154, Amazon #7, LiveRamp #12 etc.) can now bid in auctions- GVL Import: Now also fetches Google's
commonly-used-providers.jsonand storesgoogle_ac_idper vendor — fully automatic, no manual setup- __tcfapiLocator iframe: IAB-required cross-frame locator so iframed ad scripts (Prebid, Google GPT, etc.) can discover the CMP
- postMessage handler: Full cross-frame TCF API — ad iframes can query consent via postMessage (both in head stub and CMP JS)
- ping command in stub: Head stub now responds to
pingimmediately (before CMP loads) withcmpStatus: 'stub'
New Features — Dashboard
- Re-request Consent: Dashboard button to invalidate all existing consents — increases consent version, all visitors see the banner again on next visit
- Reset Statistics: Dashboard button to delete all consent stats and logs with one click
- Consent version display: Shows current consent version in the dashboard Consent Management section
New Features — Validator
Validator extended from 8 to 12 checks with 4 new Google integration tests:
- __tcfapiLocator iframe present
- Cross-frame postMessage handler active
- Google Additional Consent (AC) cookie support
- Active Google AC vendors count
Bug Fixes
- Fixed 4 missing phrase definitions (
deb_consent_vendor_special_purposes,_explain,deb_consent_vendor_features,_explain) — previously showed raw phrase keys in vendor edit form- Fixed
__tcfapi getTCDataresponse now includesaddtlConsentfield for programmatic access
Technical
- New DB column:
google_ac_id(UINT, nullable) onxf_deb_consent_vendor- New config key:
consent_versioninxf_deb_consent_config- Head stub rewritten: TCF API stub with ping, __tcfapiLocator iframe, postMessage handler
- CMP JS:
restoreConsent()now checks cmpVersion against consentVersion for re-consent- CMP JS:
persistConsent()encodes current consentVersion as cmpVersion in TC string- New Repository method:
Vendor::findByAcId()
Update Guide: v1.0.3 → v1.0.4
v1.0.4 fixes a revenue problem: Many important ad bidders (Google, Xandr, Criteo, Index Exchange, Amazon, etc.) were not bidding even though the TCF string was correctly set.
Root causes & fixes:
- Google Additional Consent (AC): The
addtlConsentcookie was missing — ~199 vendors from Google's "commonly used providers" list require this cookie in addition toeuconsent-v2- Cross-Frame TCF: The
__tcfapiLocatoriframe and postMessage handler were missing — ad scripts in iframes (Google GPT, Prebid, etc.) could not discover the CMP- Re-Consent: After the update, all existing users must re-consent so the new
addtlConsentcookie gets set
Step 1: Upload ZIP & install
Code:Admin Panel → Setup → Add-ons → Install/upgrade add-on → Upload DEB-ConsentManager-1.0.4.zip
The upgrade automatically creates:
- New DB column
google_ac_idin the vendor table- Updated head stub template modification (with __tcfapiLocator + postMessage)
- New phrases (EN + DE)
Step 2: Import GVL (load Google AC IDs)
Code:Admin Panel → Consent Manager → Dashboard → "GVL Import" → Click "Start Import"
This imports:
- IAB Global Vendor List (updates vendor data)
- NEW: Google's
commonly-used-providers.json→ setsgoogle_ac_idfor ~199 vendors
Verification: After import, check the vendor list → the "AC" column should show green ID badges for many vendors.
Step 3: Activate vendors
Code:Admin Panel → Consent Manager → Vendors → "Activate All"
Step 4: Re-request consent (IMPORTANT!)
IMPORTANT: Existing users have the old cookie WITHOUTaddtlConsent. To set the new cookie, all users must re-consent.
Code:Admin Panel → Consent Manager → Dashboard → Scroll to "Consent Management" → Click "Re-request Consent"
This increases the consent version. On the next page load, every visitor will see the consent banner again.
Step 5: Run validator
Code:Admin Panel → Consent Manager → Dashboard → "Run Validation"
Expected result: 12/12 checks passed, including:
__tcfapiLocator iframe
Step 6: Browser verification
- Clear cookies (or use incognito window)
- Open your site → Banner must appear
- Click "Accept"
- DevTools → Application → Cookies— check:
euconsent-v2= setaddtlConsent=2~7.11.12.15...229...- DevTools → Console — enter:
→ Must output the AC stringCode:window.__tcfapi('getTCData', 2, function(d, s) { console.log('addtlConsent:', d.addtlConsent); });
Optional: Reset statistics
To start with fresh numbers after the update:
Code:Admin Panel → Consent Manager → Dashboard → "Consent Management" → "Reset Statistics"
Deletes all consent logs and statistics.
Troubleshooting
Banner does not appear after re-consent:
- Check consent version (Dashboard → "Current consent version: 2")
- Clear browser cache (Ctrl+Shift+R)
- Check addon is enabled (Settings → "Enable Consent Manager")
addtlConsent cookie missing:
- Run GVL import (Vendor list → AC column)
- Activate vendors
- Clear browser cache and re-consent
Validator shows less than 12/12:
- __tcfapiLocator missing: Recompile templates or reinstall add-on
- AC Vendors = 0: Run GVL import
- postMessage missing: Check head stub template modification
Technical comparison
Component v1.0.3 v1.0.4 Cookies euconsent-v2euconsent-v2+addtlConsentHead Stub Simple queue + __tcfapiLocator + postMessage + ping Validator 8 checks 12 checks (+ Google integration) Vendor DB iab_vendor_id+ google_ac_idDashboard KPIs + Charts + Logs + Re-Consent + Stats Reset CMP JS No version check cmpVersion ↔ consentVersion comparison
Bug Fixes:
- Fixed consent toggle states not restored when reopening the consent dialog (e.g. "Select basic ads"
showing OFF even though it was saved as ON)
- Fixed public JavaScript file (js/addons/) not being updated during build - only the source copy
(src/addons/) was updated, causing the live server to serve the old version
Deleted cookie → Banner appears
Clicked "Customize" → Layer 2 opens
Enabled Purpose 2 "Select basic ads" → Toggle ON
Clicked "Save Selection" → Banner closes
Navigated to /consent/ → Clicked "Change Cookie Settings"
Dialog reopens → P1: ON, P2: ON, rest OFF
Note for Cloudflare users:
If you use Cloudflare, please purge your Cloudflare cache after installing this update
(Dashboard > Caching > Purge Everything). Clearing only the browser cache is not sufficient
as Cloudflare caches JavaScript files independently. Without purging, your visitors may
still receive the old JavaScript file.
Bug Fixes:
- Fixed ads not showing after consent was given (Google Consent Mode remained 'denied' on page load)
- Fixed Layer 2 Accept/Save/Reject buttons not working when reopened via "Change Cookie Settings"
- Fixed footer cookie settings link not clickable on mobile browsers (touch target too small)
- Fixed admin permission not auto-assigned to super admins on fresh install
- Fixed Layer 3 (Vendor Details) showing empty list
- Fixed Cookie Declaration link using button color instead of text color
- Fixed vendor privacy links using button color instead of text color
- Fixed duplicate font-size declaration in button CSS
- Fixed Dark Mode using wrong selectors
root/.xfDark instead of XF 2.3 data-color-scheme)
- Fixed banner description text using opacity hack instead of proper secondary color
- Fixed purpose names showing raw phrase keys (deb_consent_purpose_{$purposeId}_name) in banner Layer 2
- Fixed IP address not displayed in dashboard and consent logs (missing Entity getter)
- Fixed date without time in log entries (date() changed to datetime())
- Fixed purpose settings having no effect on banner, consent page or vendor list
New Features:
- Vendor list in Layer 3 with search field and pagination (50 per page)
- IP address column in dashboard recent logs and consent log page
- Full datetime (date + time) in all log views
- Purpose settings now fully functional: disabled purposes are hidden from banner, consent page and vendor list
- Vendor list filtered by enabled purposes (vendors with only disabled purposes are removed)
- Vendor purpose badges filtered to show only enabled purposes
Improvements:
- All links use text color with underline on hover only
- Footer link has 44px min-height on mobile for reliable touch targets
- Google Consent Mode signals restored to 'granted' on every page load when cookie exists
- Banner event listeners always attached regardless of consent state for re-consent flow
- Dynamic purpose rendering via xf:foreach instead of hardcoded HTML
- Purpose names and descriptions resolved via XF phrases for proper translations
- Improved mobile responsive: smaller title, reduced modal padding, vendors stack vertically
- Dark Mode uses correct XF 2.3 selector [data-color-scheme="dark"]