ConsentManager repeatedly showing the paywall popup after consent

[seia-soto]

Some websites using consent manager repeatedly show the popup even autoconsent closed it via API. I haven't investigated about the internals of these websites but they're pretty many as reported in ghostery/broken-page-reports.

https://github.com/seia-soto/broken-page-reports/blob/main/filters/fixes.txt#L691-L698

! https://github.com/ghostery/broken-page-reports/issues/588
! https://github.com/ghostery/broken-page-reports/issues/601
! https://github.com/ghostery/broken-page-reports/issues/639
! https://github.com/ghostery/broken-page-reports/issues/647
! https://github.com/ghostery/broken-page-reports/issues/667
! https://github.com/ghostery/broken-page-reports/issues/666
nordbayern.de,next-mobility.de,morgenpost.de,derwesten.de,interspar.at,azerty.nl##body[style^="overflow"]:style(overflow: auto !important)
nordbayern.de,next-mobility.de,morgenpost.de,derwesten.de###cmpbox2

The following video shows the current problem:

1. clears browser cookie including third-parties to see consent properly
2. autoconsent detects the popup
3. autoconsent removes the popup and reports successful signal
4. autoconsent workflow is now done but website populates another popup

Screen.Recording.2024-06-14.at.3.40.28.PM.mp4

[muodov]

@seia-soto thanks for reporting!

The particular pop-up on the video seems to be a paywall. We had some examples in #387, but there are many more. At the moment these pop-ups are out of scope for autoconsent.
Are all the reported sites paywalls?

[seia-soto]

@seia-soto thanks for reporting!

The particular pop-up on the video seems to be a paywall. We had some examples in #387, but there are many more. At the moment these pop-ups are out of scope for autoconsent. Are all the reported sites paywalls?

I think so. I can see the same behavior across the reported websites (e.g. another popup after cookie consent). In this case, I believe blocking the request to CMP script should be the best at the moment. Otherwise, I can add some mitigations in the CMP handler source but what I felt from the source-code is the situation will go tricky.

[muodov]

@seia-soto if the pop-up can be hidden by request blocking, that's probably the best way. However, it's out of scope for the autoconsent library at the moment, so I'm going to close this issue. What to do with paywalls is still an open question, for now we're just ignoring them and tracking these examples internally (Github issues are mostly outdated, sorry).