Skip to content

[pull] master from supabase:master#792

Merged
pull[bot] merged 2 commits into
code:masterfrom
supabase:master
Mar 27, 2026
Merged

[pull] master from supabase:master#792
pull[bot] merged 2 commits into
code:masterfrom
supabase:master

Conversation

@pull

@pull pull Bot commented Mar 27, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

sudayavarman and others added 2 commits March 27, 2026 10:17
Updated standard uploads documentation to include curl examples
)

## Problem

After PR #43221 gated `TelemetryTagManager` behind consent, the EU
cookie consent banner started reappearing on every page load and when
navigating between apps (www, studio, docs).

Back in late February we changed `TelemetryTagManager` to only load when
the user has accepted consent. This was the right call for GDPR — don't
load tracking scripts before consent. But it created a chicken-and-egg
problem with how the Usercentrics SDK stores consent.

## What happened

When a user clicks Accept, the SDK writes `uc_settings` +
`uc_user_interaction: true` to localStorage. Then the GTM script loads
(now that consent is granted), and its Usercentrics integration
immediately replaces those keys with a compressed `ucString` + `ucData`
format — deleting the originals.

On the next page load, `UC.init()` only knows how to read `uc_settings`.
It can't find it (GTM deleted it), so it treats the user as brand new
and shows the banner again. Before #43221, GTM loaded on every page
unconditionally, so its integration was already present during
`UC.init()` and could interpret the compressed format.

Confirmed via production console monitoring — the exact sequence after
clicking Accept:

```
setItem("uc_settings", ...)           // SDK writes consent
setItem("uc_user_interaction", "true") // SDK marks interaction
removeItem("uc_settings")             // GTM deletes SDK format
removeItem("uc_user_interaction")     // GTM deletes SDK format
setItem("ucString", ...)              // GTM writes compressed format
setItem("ucData", ...)                // GTM writes compressed format
```

## Changes

- Read `ucData` from localStorage **before** `UC.init()` to detect prior
consent in the compressed format
- If the SDK wants to show the banner but `ucData` shows all services
were previously accepted, silently re-accept instead of re-prompting
- Added try/catch around the SDK initialization (was fire-and-forget
with no error handling, any failure was completely silent)
- Error fallback also honors prior `ucData` consent if the SDK fails to
initialize

## Testing

Can't fully reproduce on staging previews because CSP blocks the GTM
script there (so the storage migration never fires). Verified the root
cause via production console monitoring with localStorage
monkey-patching, and confirmed the `ucData` format persists across page
loads on production.

Closes FE-2648
@pull pull Bot locked and limited conversation to collaborators Mar 27, 2026
@pull pull Bot added the ⤵️ pull label Mar 27, 2026
@pull pull Bot merged commit 1cccc74 into code:master Mar 27, 2026
2 of 12 checks passed
@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Mar 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

⤵️ pull documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants