Consent Manager 2.0.4

[DEBTech]

DEBTech updated Consent Manager with a new update entry:

2.0.1

Version 2.0.1 — March 30, 2026

New Features

• IP Anonymization — New setting to control how visitor IP addresses are stored in consent logs. Options: Anonymized (last octet removed, default), Hashed (SHA-256, irreversible), Do not store, or Full IP. Recommended setting for GDPR compliance: Anonymized.
• Privacy Notice on /consent page — Automatic privacy notice explaining what data is collected, how the IP is handled (adapts to the selected setting), and...

Read the rest of this update entry...

 

[Max Fridman]

@Kirby I'm tagging you because you're usually the most knowledgeable about the GDPR. Do you think this implementation is okay?

 

[Stubentiger]

Hi @DEBTech,

the new setup guide for version 2.0.1 is fantastic! If you follow the steps exactly, setting up the revenue overview is also straightforward.

Thank you & best regards!

 

[Stubentiger]

Hi @DEBTech ,

can you tell me where to look for the following problem:

I'm using the current version 2.0.1 of the add-on. I've integrated my Google AdSense code snippets via the XenForo templates for advertising (Container content: Above, Container sidebar: Above). The HTML code for the AdSense ad units (JavaScript) is located here.

The ads are delivered as expected.

When I use the add-on's TCF 2.2 Banner Validator function, 8 out of 9 checks are successful. Only the AdSense integration fails with the message "AdSense Manager not active — adsbygoogle.js must be loaded manually."

What's the problem here?

Thank you for your support.

 

[johnny82]

Hello @DEBTech and thank's for working on this useful addon. Just one question. Does it work on a shared hosting?

 

[DEBTech]

Hi @DEBTech ,

can you tell me where to look for the following problem:

I'm using the current version 2.0.1 of the add-on. I've integrated my Google AdSense code snippets via the XenForo templates for advertising (Container content: Above, Container sidebar: Above). The HTML code for the AdSense ad units (JavaScript) is located here.

The ads are delivered as expected.

When I use the add-on's TCF 2.2 Banner Validator function, 8 out of 9 checks are successful. Only the AdSense integration fails with the message "AdSense Manager not active — adsbygoogle.js must be loaded manually."

What's the problem here?

Thank you for your support.

That's not a problem, your setup is correct.

The validator check "AdSense Manager not active" simply means that our separate AdSense Manager Pro addon is not installed. It's an informational hint, not an error. Since you've integrated your AdSense code manually via XenForo ad templates, everything works as expected.

The important part is that Google Funding Choices detects the AdSense code on your page and shows the consent banner. If ads are being delivered and the banner appears, your setup is working correctly.

8 out of 9 checks passing with only this informational message is a perfectly fine result. You can safely ignore it.

In a future update I'll adjust this check to also detect manually embedded adsbygoogle.js so it doesn't show as a failed check when AdSense is loaded without our addon.


@johnny82,
Yes, it works on any hosting that runs XenForo, including shared hosting. There are no special server requirements beyond what XenForo itself needs (PHP 8.1+ and MySQL).

 

[Stubentiger]

Hello @DEBTech,
I've noticed a few things in the Consent Manager statistics that I'm not quite sure how to interpret. The banner impressions are supposed to be displayed on a 30-day basis. That can't be right. My impression is that these are the daily impressions. Is that correct?

Furthermore, this seems to contradict the rest of the data. An ad blocker rate of over 600% is mathematically impossible. Can you shed some light on this?



Thank you for your help.

 

[DEBTech]

DEBTech updated Consent Manager with a new update entry:

2.0.2

Security

• Fixed: Public compliance export endpoint was accessible without authentication. The CSV export is now only available to admins with the debConsentAdmin permission.
• Fixed: CSRF protection is now enforced on the consent update endpoint. Previously disabled for all public POST actions, CSRF is now only skipped for fire-and-forget counters (impressions, adblock).
• Fixed: All public POST endpoints (consent update, impression, adblock) now require XMLHttpRequest...

Read the rest of this update entry...

 

[Stubentiger]

Since the last update (Version 2.0.2), I have been receiving the error message Validation Error: Unexpected token '<'," for the Cookie Scanner and Configuration Validation functions.

 

[sps-forum]

Since the last update (Version 2.0.2), I have been receiving the error message Validation Error: Unexpected token '<'," for the Cookie Scanner and Configuration Validation functions.

Same problem

 

[DEBTech]

DEBTech updated Consent Manager with a new update entry:

2.0.3

### Bug Fixes
- Fixed consent decisions not being saved after the CSRF hardening introduced in v2.0.2.
The Google Funding Choices tracker now sends XenForo's _xfToken with the consent/update request, so accept, reject, and custom consent actions are stored correctly again.

- Fixed the dashboard validator returning an HTML admin page instead of JSON.
The validator request now explicitly includes _xfResponseType=json and the current XenForo...

Read the rest of this update entry...

 

[Max Fridman]

Someone that uses this add-on on a fairly large board can give some feedbacks?

 

[sps-forum]

If >900k threads is lage, then yes.
And it was a disaster... the cron requested a new consent every day...

 

[Max Fridman]

If >900k threads is lage, then yes.
And it was a disaster... the cron requested a new consent every day...

Yes. Ok as expected, thanks for the sad but useful feedback.

 

[DEBTech]

DEBTech updated Consent Manager with a new update entry:

2.0.4

his is fixed in 2.0.4:

• missing last_reset values are now initialized without invalidating existing consent
• existing installations get a safe baseline during the upgrade
• fresh installs now create consent_version with a proper last_reset timestamp

The scheduled re-consent option remains disabled by default. If enabled, it now counts from the install/upgrade baseline instead of treating missing legacy data as overdue.

Read the rest of this update entry...

 

[Stubentiger]

I get the following problems when using the Cookie Scanner function in versions 2.0.3 and 2.0.4:

Cookie Domain Source Status Description
Error — HTTP ? Client error: GET https://example.com resulted in a 403 Forbidden response:
FCCDCF example.com JS ✓ Google (Analytics)
debcm_cv example.com JS ✓ DEBtech Consent Manager (consent version)
__gads example.com JS ✓ DoubleClick/Google Marketing (Marketing)
__gpi example.com JS ✓ Google AdSense (Marketing)
__eoi example.com JS ✓ Google AdSense (Security)
FCNEC example.com JS ✓ Google (Analytics)
xf_csrf example.com JS ✓ Xenforo (Security)
debcm_imp example.com JS ? Not declared — may need to be added to consent configuration
debcm_ab example.com JS ? Not declared — may need to be added to consent configuration