From 1f3f084f4d992853b106d14392829ac0b70b397c Mon Sep 17 00:00:00 2001
From: Greg Anderson <greg.anderson@owasp.org>
Date: Thu, 24 Sep 2026 22:16:34 -0600
Subject: [PATCH] docs: load analytics and marketing tags only after cookie
 consent

The docs site loaded the Reo and Apollo trackers for every visitor with
no consent prompt. It now loads HubSpot's cookie banner (the portal
already has an opt-in policy for docs.defectdojo.com) and waits for the
visitor's choice before loading anything else:

- Google Consent Mode v2 defaults to denied.
- GA4 and the defectdojo.com tag container load on accept, matching
  defectdojo.com. Apollo now comes from that container, and Reo loads
  with it.
- Withdrawing consent clears the tags' first-party cookies and reloads
  the page. Reo cookies left by the old ungated tag are removed for
  visitors who have not consented.
- The footer gains "Privacy policy" and "Cookie settings" links in all
  eight languages. Cookie settings reopens the banner.
- Development builds (hugo server) load no tags at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/assets/scss/common/_custom.scss          |  14 ++-
 docs/i18n/de.toml                             |   6 +
 docs/i18n/en.toml                             |   6 +
 docs/i18n/es.toml                             |   6 +
 docs/i18n/fr.toml                             |   6 +
 docs/i18n/it.toml                             |   6 +
 docs/i18n/ja.toml                             |   6 +
 docs/i18n/pt-br.toml                          |   6 +
 docs/i18n/zh-hans.toml                        |   6 +
 docs/layouts/_partials/footer/footer.html     |   4 +
 .../layouts/_partials/head/script-header.html | 112 ++++++++++++++++--
 11 files changed, 167 insertions(+), 11 deletions(-)

diff --git a/docs/assets/scss/common/_custom.scss b/docs/assets/scss/common/_custom.scss
index b8223307136..8728346a27f 100644
--- a/docs/assets/scss/common/_custom.scss
+++ b/docs/assets/scss/common/_custom.scss
@@ -1412,7 +1412,8 @@ body.home .site-footer {
     margin-bottom: 0.375rem;
   }
 
-  a {
+  a,
+  .footer-link-button {
     color: var(--dd-dim-dark);
     font-size: 0.875rem;
     text-decoration: none;
@@ -1423,6 +1424,17 @@ body.home .site-footer {
       text-decoration: none;
     }
   }
+
+  // "Cookie settings" reopens the consent banner, so it is a button styled
+  // to match the footer links.
+  .footer-link-button {
+    padding: 0;
+    border: 0;
+    background: none;
+    font-family: inherit;
+    line-height: inherit;
+    cursor: pointer;
+  }
 }
 
 .footer-social {
diff --git a/docs/i18n/de.toml b/docs/i18n/de.toml
index 7fb6c3ad99a..cb5b08cb013 100644
--- a/docs/i18n/de.toml
+++ b/docs/i18n/de.toml
@@ -123,6 +123,12 @@ other = "Status"
 [footer_link_support]
 other = "Support"
 
+[footer_link_privacy_policy]
+other = "Datenschutzerklärung"
+
+[footer_link_cookie_settings]
+other = "Cookie-Einstellungen"
+
 [footer_rights]
 other = "Alle Rechte vorbehalten."
 
diff --git a/docs/i18n/en.toml b/docs/i18n/en.toml
index 29c7445acd7..e51eadd78a4 100644
--- a/docs/i18n/en.toml
+++ b/docs/i18n/en.toml
@@ -123,6 +123,12 @@ other = "Status"
 [footer_link_support]
 other = "Support"
 
+[footer_link_privacy_policy]
+other = "Privacy policy"
+
+[footer_link_cookie_settings]
+other = "Cookie settings"
+
 [footer_rights]
 other = "All rights reserved."
 
diff --git a/docs/i18n/es.toml b/docs/i18n/es.toml
index e4a12781eb8..e68d520b4b8 100644
--- a/docs/i18n/es.toml
+++ b/docs/i18n/es.toml
@@ -123,6 +123,12 @@ other = "Estado"
 [footer_link_support]
 other = "Soporte"
 
+[footer_link_privacy_policy]
+other = "Política de privacidad"
+
+[footer_link_cookie_settings]
+other = "Configuración de cookies"
+
 [footer_rights]
 other = "Todos los derechos reservados."
 
diff --git a/docs/i18n/fr.toml b/docs/i18n/fr.toml
index 20827db9d34..56c3a4bb698 100644
--- a/docs/i18n/fr.toml
+++ b/docs/i18n/fr.toml
@@ -123,6 +123,12 @@ other = "Statut"
 [footer_link_support]
 other = "Support"
 
+[footer_link_privacy_policy]
+other = "Politique de confidentialité"
+
+[footer_link_cookie_settings]
+other = "Paramètres des cookies"
+
 [footer_rights]
 other = "Tous droits réservés."
 
diff --git a/docs/i18n/it.toml b/docs/i18n/it.toml
index 16f3fdbb50b..21268b3cb5c 100644
--- a/docs/i18n/it.toml
+++ b/docs/i18n/it.toml
@@ -184,6 +184,12 @@ other = "Stato"
 [footer_link_support]
 other = "Supporto"
 
+[footer_link_privacy_policy]
+other = "Informativa sulla privacy"
+
+[footer_link_cookie_settings]
+other = "Impostazioni dei cookie"
+
 [footer_rights]
 other = "Tutti i diritti riservati."
 
diff --git a/docs/i18n/ja.toml b/docs/i18n/ja.toml
index 0054867d9ec..ed6a71493de 100644
--- a/docs/i18n/ja.toml
+++ b/docs/i18n/ja.toml
@@ -184,6 +184,12 @@ other = "ステータス"
 [footer_link_support]
 other = "サポート"
 
+[footer_link_privacy_policy]
+other = "プライバシーポリシー"
+
+[footer_link_cookie_settings]
+other = "Cookie 設定"
+
 [footer_rights]
 other = "無断複製・転載を禁じます。"
 
diff --git a/docs/i18n/pt-br.toml b/docs/i18n/pt-br.toml
index 98a936fd73d..ce042040968 100644
--- a/docs/i18n/pt-br.toml
+++ b/docs/i18n/pt-br.toml
@@ -184,6 +184,12 @@ other = "Status"
 [footer_link_support]
 other = "Suporte"
 
+[footer_link_privacy_policy]
+other = "Política de privacidade"
+
+[footer_link_cookie_settings]
+other = "Configurações de cookies"
+
 [footer_rights]
 other = "Todos os direitos reservados."
 
diff --git a/docs/i18n/zh-hans.toml b/docs/i18n/zh-hans.toml
index bdfe00d4df0..b067d6d465f 100644
--- a/docs/i18n/zh-hans.toml
+++ b/docs/i18n/zh-hans.toml
@@ -184,6 +184,12 @@ other = "服务状态"
 [footer_link_support]
 other = "支持"
 
+[footer_link_privacy_policy]
+other = "隐私政策"
+
+[footer_link_cookie_settings]
+other = "Cookie 设置"
+
 [footer_rights]
 other = "保留所有权利。"
 
diff --git a/docs/layouts/_partials/footer/footer.html b/docs/layouts/_partials/footer/footer.html
index b8c638fcf96..f92f4526cc2 100644
--- a/docs/layouts/_partials/footer/footer.html
+++ b/docs/layouts/_partials/footer/footer.html
@@ -43,6 +43,10 @@ <h6 class="footer-heading">{{ i18n "footer_heading_company" }}</h6>
           <li><a href="https://trust.defectdojo.com" rel="noopener">{{ i18n "footer_link_trust_center" }}</a></li>
           <li><a href="https://status.defectdojo.com" rel="noopener">{{ i18n "footer_link_status" }}</a></li>
           <li><a href="mailto:support@defectdojo.com">{{ i18n "footer_link_support" }}</a></li>
+          <li><a href="https://defectdojo.com/privacy-policy" rel="noopener">{{ i18n "footer_link_privacy_policy" }}</a></li>
+          {{- if hugo.IsProduction }}
+          <li><button type="button" class="footer-link-button" onclick="(window._hsp = window._hsp || []).push(['showBanner'])">{{ i18n "footer_link_cookie_settings" }}</button></li>
+          {{- end }}
         </ul>
       </div>
 
diff --git a/docs/layouts/_partials/head/script-header.html b/docs/layouts/_partials/head/script-header.html
index b977aee216a..e05d662a8e8 100644
--- a/docs/layouts/_partials/head/script-header.html
+++ b/docs/layouts/_partials/head/script-header.html
@@ -1,12 +1,104 @@
 <!-- Insert scripts NOT needed by stylesheets here -->
-<!-- Start of Reo Javascript -->
-<script type="text/javascript">
-  !function(){var e,t,n;e="a92cfcfa51eca96",t=function(){Reo.init({clientID:"a92cfcfa51eca96"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.defer=!0,n.onload=t,document.head.appendChild(n)}();
+{{/*
+  Analytics and marketing tags load only after the visitor consents through the
+  HubSpot cookie banner (portal 22466695, which holds the banner policy for
+  docs.defectdojo.com). defectdojo.com follows the same rule. Before consent,
+  only the HubSpot script runs, and it shows the banner. Development builds
+  (hugo server) skip all of this so local previews never load trackers.
+
+  If the docs.defectdojo.com banner policy is ever removed in HubSpot, the
+  HubSpot script reports consent as granted by default, so keep that policy
+  enabled.
+*/}}
+{{ if hugo.IsProduction -}}
+<script>
+  (function () {
+    window.dataLayer = window.dataLayer || [];
+    function gtag() { window.dataLayer.push(arguments); }
+    window.gtag = window.gtag || gtag;
+
+    // Google Consent Mode v2: everything is denied until the visitor accepts.
+    gtag('consent', 'default', {
+      ad_storage: 'denied',
+      ad_user_data: 'denied',
+      ad_personalization: 'denied',
+      analytics_storage: 'denied',
+      wait_for_update: 500
+    });
+
+    var loaded = { analytics: false, marketing: false };
+
+    function addScript(src, onload) {
+      var s = document.createElement('script');
+      s.src = src;
+      s.async = true;
+      if (onload) s.onload = onload;
+      document.head.appendChild(s);
+    }
+
+    // Same GA4 property defectdojo.com loads directly.
+    function loadAnalytics() {
+      if (loaded.analytics) return;
+      loaded.analytics = true;
+      addScript('https://www.googletagmanager.com/gtag/js?id=G-1WVHC6RCD2');
+      window.gtag('js', new Date());
+      window.gtag('config', 'G-1WVHC6RCD2', { anonymize_ip: true });
+    }
+
+    // The defectdojo.com tag container (Google Ads, LinkedIn Insight, Reddit,
+    // Apollo and GA4 events), plus Reo.
+    function loadMarketing() {
+      if (loaded.marketing) return;
+      loaded.marketing = true;
+      window.dataLayer.push({ 'gtm.start': new Date().getTime(), event: 'gtm.js' });
+      addScript('https://www.googletagmanager.com/gtm.js?id=GTM-5GRLWWW7');
+      addScript('https://static.reo.dev/a92cfcfa51eca96/reo.js', function () {
+        window.Reo.init({ clientID: 'a92cfcfa51eca96' });
+      });
+    }
+
+    // First-party cookies the tags above set: Google (_ga, _gid, _gcl_),
+    // Reddit (_rdt_), Reo (__sec_) and LinkedIn (li_, _li).
+    function clearCookies(pattern) {
+      var host = window.location.hostname;
+      var root = host.split('.').slice(-2).join('.');
+      document.cookie.split(';').forEach(function (pair) {
+        var name = pair.split('=')[0].trim();
+        if (!pattern.test(name)) return;
+        [host, '.' + root, ''].forEach(function (domain) {
+          document.cookie = name + '=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/' +
+            (domain ? '; domain=' + domain : '');
+        });
+      });
+    }
+
+    var _hsp = window._hsp = window._hsp || [];
+    _hsp.push(['addPrivacyConsentListener', function (consent) {
+      var categories = consent.categories || {};
+      var analytics = !!(consent.allowed || categories.analytics);
+      var marketing = !!(consent.allowed || categories.advertisement);
+
+      window.gtag('consent', 'update', {
+        analytics_storage: analytics ? 'granted' : 'denied',
+        ad_storage: marketing ? 'granted' : 'denied',
+        ad_user_data: marketing ? 'granted' : 'denied',
+        ad_personalization: marketing ? 'granted' : 'denied'
+      });
+
+      // A script that is already running cannot be unloaded, so a withdrawal
+      // clears the tags' cookies and reloads the page, which then starts with
+      // nothing loaded.
+      if ((loaded.analytics && !analytics) || (loaded.marketing && !marketing)) {
+        clearCookies(/^(_ga|_gid|_gcl_|_rdt_|__sec_|li_|_li)/);
+        window.location.reload();
+        return;
+      }
+      // Reo loaded here without consent before this change; drop its cookies.
+      if (!marketing) clearCookies(/^__sec_/);
+      if (analytics) loadAnalytics();
+      if (marketing) loadMarketing();
+    }]);
+  })();
 </script>
-<!-- End of Reo Javascript -->
-<script>function initApollo() {
-    var n = Math.random().toString(36).substring(7), o = document.createElement("script");
-    o.src = "https://assets.apollo.io/micro/website-tracker/tracker.iife.js?nocache=" + n, o.async = !0, o.defer = !0,
-      o.onload = function () { window.trackingFunctions.onLoad({ appId: "68ffca00b8c4dc001de5fec3" }) },
-      document.head.appendChild(o)
-  } initApollo();</script>
\ No newline at end of file
+<script id="hs-script-loader" async defer src="https://js.hs-scripts.com/22466695.js"></script>
+{{- end }}