Enable privacy apps when applying Goggle Tag recipe

I think this is similar to my notes in the multilingual meta issue about recipes needing to optionally integrate with each other? Not sure if the analytics reipes should depend on the privacy recipes, or vice versa.

Also, simpleConfigUpdate should not be used on config entities, there is an issue to block that. It might cause bugs, because doing so will bypass config entity hooks for example.

A reasonable solution for this particular case, I think, is to have the drupal_cms_analytics recipe depend on and apply the drupal_cms_privacy_basic recipe, explicitly import these two Klaro apps, and then set their status to TRUE.

So, a representative snippet of drupal_cms_analytics' recipe.yml:

recipes:
  - drupal_cms_privacy_basic
install:
  - klaro
config:
  import:
    klaro:
      - klaro.klaro_app.ga
      - klaro.klaro_app.gtm
  actions:
    klaro.klaro_app.ga:
      enable: []
    klaro.klaro_app.gtm:
      enable: []

Agreed, I think it makes sense for GTM to depend on privacy.

Assigning to @dharizza for implementation when ✨ Add Google Tag recipe Active lands.

Something to consider, when addressing this to enable the consent management services for GA and GTM, is also the visibility of the consent management widget.

As a default, the privacy track has made that widget invisible, i.e. most users won't notice it, ever. This is suitable for most sites, as users find cookie banners and other widget annoying. For good reasons.

However, for GA and GTM, the priority might be different. If a site wants to track users, it is more interested in getting their consent. Therefore, it might be suitable to enable the widget to show to all users by default on those sites that apply the analytics recipe.

If that's the case, then the recipe should also enable that with this:

config:
  actions:
    klaro.settings:
      simpleConfigUpdate:
        dialog_mode: notice

The analytics recipe is in so this can now proceed.

FYI: The user generated callbacks will be blocked by CSP module.

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src * 'unsafe-inline' 'report-sample'".

Looks straightforward, but a couple of things need to be changed.

Looks solid to me! Tests are passing, so I feel good about it.

Great privacy improvement! Merged into 0.x. Thanks!

Automatically closed - issue fixed for 2 weeks with no activity.