# Cookie Consent Integration

## Why a consent cookie?

AdManta operates in two modes depending on whether the visitor has given consent:

| Feature | Without cookie | With `seco_` cookie |
| --- | --- | --- |
| Impressions counted | Yes | Yes |
| Clicks counted (total) | Yes | Yes |
| Unique click tracking | No | Yes |
| Click deduplication | No | Yes |
| Zone frequency cap | No | Yes |
| seco\_ cookie set | No | Yes (6 months) |

> Basic ad serving always works without cookies. The `seco_` cookie is **only set via your explicit consent call** — AdManta never sets it automatically.

## How the cookie is set and removed

> Grant consent
>
> Fire a 1×1 pixel request to the consent endpoint. The server sets the `seco_` cookie in the response:
>
> `GET https://your-server.com/go/consent/`

> Revoke consent
>
> Fire a pixel request to the revoke endpoint. The server deletes the cookie immediately:
>
> `GET https://your-server.com/go/consent/revoke/`

> The cookie is read at **click time**, not at impression time. So if a visitor accepts cookies after the ad is already visible on the page, their next click will already be tracked as unique — no page reload required.

## Consent banner integration

Add the following snippets to your consent tool (e.g. Cookiebot, Usercentrics, custom banner).
Call the **accept** snippet in the "all accepted" callback and the **revoke** snippet in the "declined / withdraw" callback.

Accept
Call when the visitor accepts cookies

```
(function() {
  new Image(1, 1).src = 'https://your-server.com/go/consent/?t=' + Date.now();
})();
```

The `?t=` cache-buster ensures the request is always sent, even if the browser has cached a previous response.

Revoke
Call when the visitor declines or withdraws consent

```
(function() {
  new Image(1, 1).src = 'https://your-server.com/go/consent/revoke/?t=' + Date.now();
})();
```

> No CORS configuration needed. `new Image()` is a cross-origin image request — browsers send cookies for it and don't enforce CORS restrictions.

## Example: generic cookie banner

Here is a minimal example for a custom cookie banner with accept/decline buttons:

```
<script>
// Called when user clicks "Accept all"
function onCookieAccept() {
  (function() {
    new Image(1, 1).src = 'https://your-server.com/go/consent/?t=' + Date.now();
  })();
  // ... rest of your accept logic
}

// Called when user clicks "Decline" or withdraws consent
function onCookieDecline() {
  (function() {
    new Image(1, 1).src = 'https://your-server.com/go/consent/revoke/?t=' + Date.now();
  })();
  // ... rest of your decline logic
}
</script>
```

## Cookie specification

| Attribute | Value |
| --- | --- |
| Name | `seco_` |
| Domain | Your AdManta domain (e.g. `m.yourdomain.com`) |
| Path | `/go/` |
| Expires | 6 months from grant date |
| HttpOnly | Yes – not accessible via JavaScript |
| SameSite | None + Secure, so the cookie also reaches the ad server when ads are embedded on another site (plain-http development falls back to Lax). Browsers that block third-party cookies (e.g. Safari, Firefox strict mode) will not send it – those visitors are served anonymously. |
| Value | UUID v4 (e.g. `f47ac10b-58cc-4372-a567-0e02b2c3d479`) – no PII |
| Category | Statistics / Functional – requires explicit consent under GDPR |

## Privacy policy declaration

Suggested language for your cookie notice or privacy policy:

> AdManta Statistics Cookie (`seco_`)
>
> This cookie is set by our ad server after you have accepted statistics cookies. It stores a random, anonymous session identifier (UUID) that is used to count unique ad clicks and apply frequency caps (limiting how often an ad is shown to you). The cookie is valid for 6 months and contains no personally identifiable information.

## Live test

Use these links to manually test the consent endpoints:

[Grant consent](https://your-server.com/go/consent/?t=test)
[Revoke consent](https://your-server.com/go/consent/revoke/?t=test)

After clicking "Grant consent", open your browser's DevTools → Application → Cookies and look for the `seco_` cookie on your AdManta domain.