Possible race condition

[ahegyes]

Hi there!

I discovered the other day that, when visiting wpvip.com from within an EU country where GDPR applies, the advertising trackers are still fired before I consent to them using the banner. See here:

If I reload the page or simply navigate to a different page, then the trackers are not loaded anymore. This tells me that it's likely a race condition where the trackers get loaded before the geolocation is set up. On the second page load, the geolocation cookies are set, and thus the trackers aren't loaded.

This is still problematic because the first load of the trackers is already a GDPR violation.

[ahegyes]

I think I've found the issue.

So gtmInit(); is called at the top of this file. That means that it runs synchronously as the script is loaded, whereas the <CookieBanner/> React component is only rendered on DOMContentLoaded (see last line).

gtmInit() will make a call to getTrackingPrefs() which is defined here. The function getTrackingPrefs() return prefsAllowAll if !isCountryGdpr && !isCountryCcpa which is determined based on the set cookies (see first line of the function).

If the cookies aren't present, then isCountryGdpr() and isCountryCcpa() both return false, thus returning prefsAllowAll. The cookies, however, are being set on the first page load by the <CookieBanner/> component which is loaded asynchronously after the DOM finished loading.

So, on the first page load, the gtmInit() function, which runs synchronously, doesn't have any cookie information and defaults to allowing everything. It explains why it all works on the second page load, after the cookies are set ... and why it also works in testing when one changes the cookie value, because the issue presents itself when there is not cookie ...

[ahegyes]

I confirmed with a JavaScript debugger that this is exactly what's going on.