From 7cec8e7e46f5ca7825ea838f9b08d2878b64cc52 Mon Sep 17 00:00:00 2001 From: Preetish <1039812+Preetish@users.noreply.github.com> Date: Sun, 11 Oct 2026 16:23:06 -0400 Subject: [PATCH] Docs: make data-switchboard-consent="granted" the default embed snippet The embed guide, the admin Setup page's copied snippet, and the example host page now include the attribute, so first touch and cookie IDs are captured out of the box. The guide explains when to remove it (sites that need a consent banner call Switchboard.setConsent instead) and to load the script on every page so landing-page campaigns are kept. The loader's own default is unchanged. Co-Authored-By: Claude Opus 5.5 --- apps/web/src/app/setup/page.tsx | 2 +- docs/decisions.md | 5 ++++- docs/embed.md | 32 +++++++++++++++++++++----------- examples/embed-demo.html | 2 +- 4 files changed, 27 insertions(+), 14 deletions(-) diff --git a/apps/web/src/app/setup/page.tsx b/apps/web/src/app/setup/page.tsx index 4649338..238d317 100644 --- a/apps/web/src/app/setup/page.tsx +++ b/apps/web/src/app/setup/page.tsx @@ -90,7 +90,7 @@ export default async function SetupPage() { {formRows.length > 0 ?

Forms

: null} {formRows.map(({ form, rules, version }) => { const url = `${base}/f/${form.slug}`; - const snippet = `
\n`; + const snippet = `
\n`; const parsed = rules ? validateRuleSet(rules) : null; return (
diff --git a/docs/decisions.md b/docs/decisions.md index f61081b..d252480 100644 --- a/docs/decisions.md +++ b/docs/decisions.md @@ -498,7 +498,10 @@ decisions. Each item notes what it supersedes. current page's UTMs stores nothing on the device. Keeping first touch in localStorage and reading `_ga`/`_fbp`/`_fbc`/`_gcl_aw`/`hubspotutk` does, so it waits for `data-switchboard-consent="granted"` or - `Switchboard.setConsent(true)`. The default is the privacy-safe one. + `Switchboard.setConsent(true)`. The loader's own default is the + privacy-safe one, but the documented snippet (and the one the Setup page + copies) includes the attribute: most B2B sites want full attribution, and + sites that need a consent banner remove it and call `setConsent` instead. - **Last touch flat, first touch nested.** Rules mostly care about the visit that converted (`attribution.utm_medium`); first touch is there for reporting and ABM rules (`attribution.first.utm_source`). diff --git a/docs/embed.md b/docs/embed.md index 2ed7f8b..16063bf 100644 --- a/docs/embed.md +++ b/docs/embed.md @@ -10,13 +10,24 @@ host and the form's slug: ```html
- + ``` The loader (about 4 KB, no dependencies) turns every `data-switchboard-form` placeholder into the form. Several placeholders on one page each get their own form. +`data-switchboard-consent="granted"` turns on full attribution: the loader +remembers where a visitor first came from across pages and visits, and reads +your analytics and ad cookie IDs. If your site has to ask visitors before +storing that (for example under GDPR), remove the attribute and let your +consent banner turn it on instead; see +[Tracking and attribution](#tracking-and-attribution). + +To capture campaigns from your landing pages, not just the page with the +form, add the script tag (without a placeholder) to every page, for example +in your site's shared layout or through your tag manager. + ## Single-page apps, modals, and tag managers - Placeholders added after the page loads (client-side routing, a modal that @@ -26,7 +37,7 @@ page each get their own form. ` + ``` - Set an accessible name for the frame with @@ -61,18 +72,17 @@ loads, it asks the loader for that data and sends it with the submission. | First touch, kept across pages and visits for 90 days | localStorage on your site | Yes | | Cookie IDs: `_ga`, `_fbp`, `_fbc`, `_gcl_aw`, `hubspotutk` | Your site's cookies | Yes | -Without consent, the loader reads only the current page's URL and referrer -and stores nothing. So if a visitor lands on `/pricing?utm_source=google` and -then clicks to `/demo`, the campaign is lost unless you've granted consent. -Grant it in one of two ways: +The snippets in this guide include `data-switchboard-consent="granted"`, so +everything in the table is captured. Without the attribute, the loader reads +only the current page's URL and referrer and stores nothing; a visitor who +lands on `/pricing?utm_source=google` and then clicks to `/demo` would arrive +with no campaign. -```html - - -``` +If your site needs consent before storing data or reading cookies, leave the +attribute off and call this from your consent banner once the visitor +accepts analytics or marketing cookies: ```js -// Your consent banner calls this once the visitor accepts analytics or marketing cookies: window.Switchboard.setConsent(true); ``` diff --git a/examples/embed-demo.html b/examples/embed-demo.html index aca978a..1a8cd5c 100644 --- a/examples/embed-demo.html +++ b/examples/embed-demo.html @@ -36,7 +36,7 @@

Your product

- +