From 2f8fed3323447b750d28959b2f5d131183cc1159 Mon Sep 17 00:00:00 2001
From: Greg Barnes <gregdbarnes@gmail.com>
Date: Tue, 26 Nov 2024 10:05:56 +0000
Subject: [PATCH] Updates cookie page and cookie banner. Adds Google Analytics
 scripts with new GTM env variable.

---
 README.md                                     |  8 +--
 local.env.example                             |  3 +
 orp/config/context_processors.py              |  6 ++
 orp/config/settings/base.py                   |  9 +++
 orp/core/cookies.py                           | 37 +++++------
 orp/core/forms.py                             | 21 +++---
 .../templates/accessibility_statement.html    |  6 +-
 orp/core/templates/cookies.html               | 56 ++++++++--------
 orp/core/templatetags/cookie_tags.py          | 10 +--
 orp/core/views.py                             | 64 +++++++++++--------
 orp/templates/base.html                       | 15 +++++
 orp/templates/cookie_banner.html              | 14 ++--
 12 files changed, 143 insertions(+), 106 deletions(-)
 create mode 100644 orp/config/context_processors.py

diff --git a/README.md b/README.md
index 79e28ea..5e7bdb2 100644
--- a/README.md
+++ b/README.md
@@ -44,12 +44,14 @@ Navigate a browser to:
     http://localhost:8081
 
 ## Local development environment
+
 While the `docker-compose` configuration is the quickest way to get started, it
 can also be useful to create a development environment on your local machine.
 However, your mileage may vary depending on your operating system. The following
 instructions are for OSX.
 
 ### Prerequisites
+
 As we are using python package `psycopg-c`, you need the PostgreSQL client
 development headers (e.g. the `libpq-dev` package) installed on your system.
 On Mac you can run the following command to install `libpq`:
@@ -74,6 +76,7 @@ On Mac you can run the following command to install `libpq`:
   you'll require including `engine`, `build` and `compose`.
 
 ### Install Poetry
+
 We use [Poetry](https://python-poetry.org/) to manage dependencies. Follow the
 guidance in the [official documentation](https://python-poetry.org/docs/). On
 OSX, run the following commands to install Poetry:
@@ -99,7 +102,6 @@ With your Poetry shell active:
 > Code quality checks are also performed when pushing your code to origin
 > but pre-commit hooks catch issues early and will improve Developer Experience.
 
-
 ### Update database tables
 
 > To update local database tables, you need to set the `DATABASE_URL` environment variable. You can set it in the terminal or in the `.env` file.
@@ -113,7 +115,3 @@ With your Poetry shell active:
 > If you want to migrate a single app then navigate /orp/orp and use the following command:
 
     $ poetry run python manage.py migrate <app_name>
-
-
-
-poetry add boto3 awswrangler
diff --git a/local.env.example b/local.env.example
index 3d2dad8..c6c1bd4 100644
--- a/local.env.example
+++ b/local.env.example
@@ -13,3 +13,6 @@ DJANGO_SECRET_KEY=orp-secret
 DATABASE_URL=postgres://postgres:postgres@db:5432/orp  # pragma: allowlist secret
 DB_MAX_CONNS=1
 POSTGRES_HOST_AUTH_METHOD=trust
+
+# Google analytics
+GOOGLE_ANALYTICS_TAG_MANAGER_ID=XXX-XXXXXXX  # Check passman or ask a colleague
diff --git a/orp/config/context_processors.py b/orp/config/context_processors.py
new file mode 100644
index 0000000..df3bb9a
--- /dev/null
+++ b/orp/config/context_processors.py
@@ -0,0 +1,6 @@
+from django.conf import settings
+
+
+def google_tag_manager(request):
+    """Context processor to add Google Tag Manager ID to all templates."""
+    return {"gtm_id": settings.GOOGLE_ANALYTICS_TAG_MANAGER_ID}
diff --git a/orp/config/settings/base.py b/orp/config/settings/base.py
index f1b0405..ec5f4b2 100644
--- a/orp/config/settings/base.py
+++ b/orp/config/settings/base.py
@@ -92,6 +92,7 @@
                 "django.template.context_processors.request",
                 "django.contrib.auth.context_processors.auth",
                 "django.contrib.messages.context_processors.messages",
+                "config.context_processors.google_tag_manager",
             ],
         },
     },
@@ -251,3 +252,11 @@
 }
 
 HOSTNAME = HOSTNAME_MAP.get(ENVIRONMENT.lower(), HOSTNAME_MAP["prod"])
+
+# Google Analytics (GA)
+# Note: please consult the performance team before changing these settings
+COOKIE_PREFERENCES_SET_NAME: str = "cookie_preferences_set"
+COOKIE_ACCEPTED_GA_NAME: str = "accepted_ga_cookies"
+GOOGLE_ANALYTICS_TAG_MANAGER_ID = env(
+    "GOOGLE_ANALYTICS_TAG_MANAGER_ID", default=None
+)
diff --git a/orp/core/cookies.py b/orp/core/cookies.py
index 9b36980..27b92de 100644
--- a/orp/core/cookies.py
+++ b/orp/core/cookies.py
@@ -2,35 +2,28 @@
 from django.http import HttpRequest, HttpResponse
 
 
-def set_analytics_consent_cookie(
-    response: HttpResponse, analytics_consent: bool
-) -> None:
-    """Set analytics consent cookie.
+def set_ga_cookie_policy(response: HttpResponse, preference: str) -> None:
+    """Set Google Analytics (GA) policy.
 
-    Sets the analytics consent cookie on the response object.
+    Sets the cookies that are required for Google Tag Manager (GTM) to
+    function correctly.
     """
     response.set_cookie(
-        settings.ANALYTICS_CONSENT_NAME,
-        value=str(analytics_consent),
+        key=settings.COOKIE_ACCEPTED_GA_NAME,
+        value=preference,
         max_age=365 * 24 * 60 * 60,
     )
-
-
-def get_analytics_consent(request: HttpRequest) -> bool:
-    """Get analytics consent.
-
-    Returns the analytics consent boolean value from the request object.
-    """
-    analytics_consent = request.COOKIES.get(
-        settings.ANALYTICS_CONSENT_NAME, None
+    response.set_cookie(
+        key=settings.COOKIE_PREFERENCES_SET_NAME,
+        value="true",
+        max_age=365 * 24 * 60 * 60,
     )
-    return True if analytics_consent == "True" else False
 
 
-def analytics_form_initial_mapping(analytics_consent: bool) -> dict:
-    """Analytics mapping.
+def get_ga_cookie_preference(request: HttpRequest) -> str:
+    """Get Google Analytics (GA) cookie preference.
 
-    Returns a dictionary with the analytics consent value, which is used to
-    initialise the analytics cookie form.
+    Returns value of the GA cookie preference if it exists, otherwise
+    returns "false".
     """
-    return {settings.ANALYTICS_CONSENT_NAME: analytics_consent}
+    return request.COOKIES.get(settings.COOKIE_ACCEPTED_GA_NAME, "false")
diff --git a/orp/core/forms.py b/orp/core/forms.py
index 86ee628..69358e0 100644
--- a/orp/core/forms.py
+++ b/orp/core/forms.py
@@ -1,20 +1,21 @@
 from django import forms
 
 
-class CookiePageConsentForm(forms.Form):
-    """Consent Form.
+class CookiePreferenceForm(forms.Form):
+    """Cookie page preference form.
 
-    Radio Select Form for setting analytics cookie consent in the cookies page.
+    Radio Select Form for setting Google Analytics (GA) consent cookies. This
+    form is rendered in the cookies page.
+
+    Note: We want to set the value of the GA cookie to "true" or "false" rather
+    than a boolean values so that the GTM script can read the value correctly.
     """
 
-    ANALYTICS_CHOICES = [
-        (True, "Yes"),
-        (False, "No"),
-    ]
-    analytics_consent = forms.ChoiceField(
-        choices=ANALYTICS_CHOICES,
+    cookie_preference = forms.ChoiceField(
         label="Do you want to accept analytics cookies?",
-        widget=forms.RadioSelect(),
+        choices=(("true", "Yes"), ("false", "No")),
+        widget=forms.RadioSelect,
+        required=False,
     )
 
 
diff --git a/orp/core/templates/accessibility_statement.html b/orp/core/templates/accessibility_statement.html
index 40f5343..85bdfa4 100644
--- a/orp/core/templates/accessibility_statement.html
+++ b/orp/core/templates/accessibility_statement.html
@@ -68,10 +68,10 @@ <h2 class="govuk-heading-m">Feedback and contact information</h2>
             </a>
           </li>
         </ul>
-        <p>We’ll consider your request and get back to you in 5 days.</p>
+        <p>We'll consider your request and get back to you in 5 days.</p>
         <h2 class="govuk-heading-m">Reporting accessibility problems with this service</h2>
         <strong class="govuk-tag govuk-tag--yellow">TBD</strong>
-        <p>We’re always looking to improve the accessibility of this service. If you find any
+        <p>We're always looking to improve the accessibility of this service. If you find any
           problems that are not listed on this page or think we're not meeting accessibility
           requirements:
         </p>
@@ -97,7 +97,7 @@ <h2 class="govuk-heading-m">Enforcement procedure</h2>
             Equality Advisory and Support Service (EASS).
           </a>
         </p>
-        <h2 class="govuk-heading-m">Technical information about this service’s accessibility</h2>
+        <h2 class="govuk-heading-m">Technical information about this service's accessibility</h2>
         <strong class="govuk-tag govuk-tag--red">Verify content</strong>
         <p>The Department of Business and Trade is committed to making this service accessible,
           in accordance with the Public Sector Bodies (Websites and Mobile Applications) (No. 2)
diff --git a/orp/core/templates/cookies.html b/orp/core/templates/cookies.html
index 74af911..5d4b231 100644
--- a/orp/core/templates/cookies.html
+++ b/orp/core/templates/cookies.html
@@ -6,7 +6,7 @@
 {% block body_content %}
 <div class="govuk-width-container">
     <main class="govuk-main-wrapper govuk-main-wrapper--l" id="main-content" role="main">
-        {% if analytics_cookie_name in request.GET %}
+        {% if cookie_preference_name in request.GET %}
         <div class="govuk-notification-banner govuk-notification-banner--success" role="alert"
             aria-labelledby="govuk-notification-banner-title" data-module="govuk-notification-banner">
             <div class="govuk-notification-banner__header">
@@ -47,24 +47,22 @@ <h2 class="govuk-heading-l">Essential cookies</h2>
                     </thead>
                     <tbody class="govuk-table__body">
                         <tr class="govuk-table__row">
-                            <th class="govuk-table__header govuk-!-width-one-quarter app-!-vertical-align-top"
-                                scope="row">
-                                {{analytics_cookie_name}}
+                            <th class="govuk-table__header govuk-!-width-one-quarter app-!-vertical-align-top" scope="row">
+                                accepted_ga_cookies
                             </th>
                             <td class="govuk-table__cell app-!-vertical-align-top">
-                                Saves your analytics cookie consent settings
+                                Saves your cookie consent settings.
                             </td>
                             <td class="govuk-table__cell app-!-vertical-align-top govuk-!-width-one-quarter">
                                 1 year
                             </td>
                         </tr>
                         <tr class="govuk-table__row">
-                            <th class="govuk-table__header govuk-!-width-one-quarter app-!-vertical-align-top"
-                                scope="row">
-                                csrftoken
+                            <th class="govuk-table__header govuk-!-width-one-quarter app-!-vertical-align-top" scope="row">
+                                cookie_preferences_set
                             </th>
                             <td class="govuk-table__cell app-!-vertical-align-top">
-                                Helps prevent Cross-Site Request Forgery (CSRF) attacks
+                                Lets us know that you've saved your cookie consent settings.
                             </td>
                             <td class="govuk-table__cell app-!-vertical-align-top govuk-!-width-one-quarter">
                                 1 year
@@ -73,13 +71,13 @@ <h2 class="govuk-heading-l">Essential cookies</h2>
                         <tr class="govuk-table__row">
                             <th class="govuk-table__header govuk-!-width-one-quarter app-!-vertical-align-top"
                                 scope="row">
-                                session
+                                csrftoken
                             </th>
                             <td class="govuk-table__cell app-!-vertical-align-top">
-                                Used to keep you signed in when publishing a report
+                                Helps prevent Cross-Site Request Forgery (CSRF) attacks
                             </td>
                             <td class="govuk-table__cell app-!-vertical-align-top govuk-!-width-one-quarter">
-                                20 hours
+                                1 year
                             </td>
                         </tr>
                     </tbody>
@@ -87,8 +85,7 @@ <h2 class="govuk-heading-l">Essential cookies</h2>
 
                 <h2 class="govuk-heading-l">Analytics cookies (optional)</h2>
                 <p class="govuk-body">
-                    With your permission, we use Google Analytics to collect data about how you use Check when large
-                    businesses pay their suppliers. This information helps us to improve our service.
+                    With your permission, we use Google Analytics to collect data about how you use {{service_name}}. This information helps us to improve our service.
                 </p>
                 <div class="govuk-inset-text">
                     Google is not allowed to use or share our analytics data with anyone.
@@ -148,26 +145,30 @@ <h2 class="govuk-heading-l">Analytics cookies (optional)</h2>
                         </tr>
                     </tbody>
                 </table>
-
                 <h2 class="govuk-heading-l">Change your cookie settings</h2>
                 <form method="post" novalidate>
                     {% csrf_token %}
                     <div class="govuk-form-group">
                         <fieldset class="govuk-fieldset">
                             <legend class="govuk-fieldset__legend govuk-fieldset__legend--s">
-                                {{ form.analytics_consent.label }}
+                                {{ form.cookie_preference.label }}
                             </legend>
-                            <div class="govuk-radios" data-module="govuk-radios">
-                                {% for value, text in form.analytics_consent.field.choices %}
-                                <div class="govuk-radios__item">
-                                    <input class="govuk-radios__input" id="analytics-consent-{{ value }}"
-                                        name="{{ form.analytics_consent.name }}" type="radio" value="{{ value }}"
-                                        {% if form.analytics_consent.value == value %}checked{% endif %}>
-                                    <label class="govuk-label govuk-radios__label" for="analytics-consent-{{ value }}">
-                                        {{ text }}
-                                    </label>
-                                </div>
-                                {% endfor %}
+                            <div class="govuk-radios govuk-radios--inline" data-module="govuk-radios">
+                                {% with field=form.cookie_preference %}
+                                    {% for choice in field.field.widget.choices %}
+                                    <div class="govuk-radios__item">
+                                        <input class="govuk-radios__input"
+                                               id="cookie-preference-{{ forloop.counter }}"
+                                               name="{{ field.html_name }}"
+                                               type="radio"
+                                               value="{{ choice.0 }}"
+                                               {% if field.value == choice.0 %}checked{% endif %}>
+                                        <label class="govuk-label govuk-radios__label" for="cookie-preference-{{ forloop.counter }}">
+                                            {{ choice.1 }}
+                                        </label>
+                                    </div>
+                                    {% endfor %}
+                                {% endwith %}
                             </div>
                         </fieldset>
                     </div>
@@ -175,6 +176,7 @@ <h2 class="govuk-heading-l">Change your cookie settings</h2>
                         Save cookie settings
                     </button>
                 </form>
+
             </div>
         </div>
     </main>
diff --git a/orp/core/templatetags/cookie_tags.py b/orp/core/templatetags/cookie_tags.py
index e676380..43cbbbf 100644
--- a/orp/core/templatetags/cookie_tags.py
+++ b/orp/core/templatetags/cookie_tags.py
@@ -15,23 +15,25 @@ def render_cookie_banner(context) -> str:
     is not rendered.
     """
     request = context["request"]
-    if settings.ANALYTICS_CONSENT_NAME not in request.COOKIES:
+    if settings.COOKIE_PREFERENCES_SET_NAME not in request.COOKIES:
         return render_to_string(
             "cookie_banner.html",
             {
                 "service_name": settings.SERVICE_NAME,
-                "analytics_cookie_name": settings.ANALYTICS_CONSENT_NAME,
+                "cookie_preference_name": settings.COOKIE_ACCEPTED_GA_NAME,
                 "request": request,
                 "show_cookie_banner": True,
                 "show_confirmation_message": False,
             },
         )
-    elif "cookie_preferences" in request.GET:
+    elif "hide_banner" in request.GET:
         return render_to_string(
             "cookie_banner.html",
             {
                 "service_name": settings.SERVICE_NAME,
-                "cookie_preferences": request.GET.get("cookie_preferences"),
+                "cookie_preference": request.GET.get(
+                    settings.COOKIE_ACCEPTED_GA_NAME
+                ),
                 "request": request,
                 "show_cookie_banner": False,
                 "show_confirmation_message": True,
diff --git a/orp/core/views.py b/orp/core/views.py
index 72c6f3f..bf19ff8 100644
--- a/orp/core/views.py
+++ b/orp/core/views.py
@@ -2,14 +2,11 @@
 from django.http import HttpRequest, HttpResponse, HttpResponseRedirect
 from django.shortcuts import redirect, render
 from django.urls import reverse
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.views.decorators.http import require_http_methods, require_safe
 
-from .cookies import (
-    analytics_form_initial_mapping,
-    get_analytics_consent,
-    set_analytics_consent_cookie,
-)
-from .forms import CookiePageConsentForm
+from .cookies import get_ga_cookie_preference, set_ga_cookie_policy
+from .forms import CookiePreferenceForm
 from .healthcheck import application_service_health
 
 
@@ -81,32 +78,29 @@ def accessibility_statement(request: HttpRequest) -> HttpResponse:
 
 @require_http_methods(["GET", "POST"])
 def cookies(request: HttpRequest) -> HttpResponse:
-    """Cookies.
+    """Cookie policy page view.
 
     Returns the cookies page. If the request method is POST, the analytics
     consent cookie is set and the user is redirected back to the cookies page.
     """
     context = {
         "service_name": settings.SERVICE_NAME,
-        "analytics_cookie_name": settings.ANALYTICS_CONSENT_NAME,
+        "cookie_preference_name": settings.COOKIE_ACCEPTED_GA_NAME,
     }
     if request.method == "POST":
-        form = CookiePageConsentForm(request.POST)
+        form = CookiePreferenceForm(request.POST)
         if form.is_valid():
-            analytics_consent = form.cleaned_data[
-                settings.ANALYTICS_CONSENT_NAME
-            ]
-            context[settings.ANALYTICS_CONSENT_NAME] = analytics_consent
+            preference = form.cleaned_data["cookie_preference"]
             response = redirect(reverse("cookies"))
-            set_analytics_consent_cookie(response, analytics_consent)
+            set_ga_cookie_policy(response, preference)
             response[
                 "Location"
-            ] += f"?{settings.ANALYTICS_CONSENT_NAME}={analytics_consent}"
+            ] += f"?{settings.COOKIE_ACCEPTED_GA_NAME}={preference}"
             return response
     else:
-        analytics_consent = get_analytics_consent(request)
-        form = CookiePageConsentForm(
-            initial=analytics_form_initial_mapping(analytics_consent)
+        preferences_value = get_ga_cookie_preference(request)
+        form = CookiePreferenceForm(
+            initial={"cookie_preference": preferences_value}
         )
     context["form"] = form
     return render(request, template_name="cookies.html", context=context)
@@ -114,20 +108,28 @@ def cookies(request: HttpRequest) -> HttpResponse:
 
 @require_http_methods(["GET"])
 def set_cookie_banner_preference(request) -> HttpResponseRedirect:
-    """Set cookie banner preference.
+    """Set cookie preferences banner.
 
-    Sets analytics cookie preference and redirects to the current page.
-    The redirect URL includes the `cookie_preferences` query parameter.
-    This parameter is used to display a confirmation message banner.
+    Sets the user Google Analytics (GA) cookie preference and then redirects
+    to the current page. The redirect URL includes the `hide_banner`
+    query parameter. This parameter is used to display a confirmation message
+    banner.
     """
-    analytics_consent = request.GET.get(settings.ANALYTICS_CONSENT_NAME)
-    current_page = request.GET.get("current_page") or "/"
-    separator = "?" if "?" not in current_page else "#"
+    preference = request.GET.get(settings.COOKIE_ACCEPTED_GA_NAME, "false")
+    current_page = request.GET.get("current_page")
+    if not url_has_allowed_host_and_scheme(
+        url=current_page,
+        allowed_hosts={request.get_host()}.union(settings.ALLOWED_HOSTS),
+        require_https=request.is_secure(),
+    ):
+        current_page = "/"
+    separator = "?" if "?" not in current_page else "&"
     current_page = (
-        f"{current_page}{separator}cookie_preferences={analytics_consent}"
+        f"{current_page}{separator}hide_banner=true"
+        f"&{settings.COOKIE_ACCEPTED_GA_NAME}={preference}"
     )
     response = redirect(current_page)
-    set_analytics_consent_cookie(response, analytics_consent)
+    set_ga_cookie_policy(response, preference)
     return response
 
 
@@ -138,5 +140,11 @@ def hide_cookie_banner(request) -> HttpResponseRedirect:
     Redirects to the current page without any query parameters,
     effectively hiding the cookie banner.
     """
-    current_page = request.GET.get("current_page") or "/"
+    current_page = request.GET.get("current_page")
+    if not url_has_allowed_host_and_scheme(
+        url=current_page,
+        allowed_hosts={request.get_host()}.union(settings.ALLOWED_HOSTS),
+        require_https=request.is_secure(),
+    ):
+        current_page = "/"
     return redirect(current_page)
diff --git a/orp/templates/base.html b/orp/templates/base.html
index 5467834..ca586a6 100644
--- a/orp/templates/base.html
+++ b/orp/templates/base.html
@@ -4,6 +4,15 @@
 <html lang="en">
 
 <head>
+  <!-- Google Tag Manager -->
+  <script nonce="{{ request.csp_nonce }}">
+    (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer', '{{ gtm_id }}');
+  </script>
+  <!-- End Google Tag Manager -->
   <title>{% block head_title %}Placeholder Head Title{% endblock %} - GOV.UK</title>
 
   <meta charset="utf-8">
@@ -21,6 +30,12 @@
 
 <body class="govuk-template__body">
   <script>document.body.className += ' js-enabled' + ('noModule' in HTMLScriptElement.prototype ? ' govuk-frontend-supported' : '');</script>
+  <!-- Google Tag Manager (noscript) -->
+  <noscript>
+    <iframe src="https://www.googletagmanager.com/ns.html?id={{ gtm_id }}"
+    height="0" width="0" style="display:none;visibility:hidden"></iframe>
+  </noscript>
+  <!-- End Google Tag Manager (noscript) -->
   {% render_cookie_banner %}
   <header class="govuk-header" data-module="govuk-header">
     <div class="govuk-header__container govuk-width-container">
diff --git a/orp/templates/cookie_banner.html b/orp/templates/cookie_banner.html
index 51c03f3..e40d1d3 100644
--- a/orp/templates/cookie_banner.html
+++ b/orp/templates/cookie_banner.html
@@ -14,13 +14,13 @@ <h2 class="govuk-cookie-banner__heading govuk-heading-m">
       </div>
     </div>
     <div class="govuk-button-group">
-      <a href="{% url 'set-cookie-banner-preference' %}?{{analytics_cookie_name}}=True&current_page={{ request.path|urlencode }}"
-        class="govuk-button" data-module="govuk-button">
-        Accept analytics cookies
+      <a href="{% url 'set-cookie-banner-preference' %}?{{cookie_preference_name}}=true&current_page={{ request.path|urlencode }}"
+          class="govuk-button" data-module="govuk-button">
+          Accept analytics cookies
       </a>
-      <a href="{% url 'set-cookie-banner-preference' %}?{{analytics_cookie_name}}=False&current_page={{ request.path|urlencode }}"
-        class="govuk-button" data-module="govuk-button">
-        Reject analytics cookies
+      <a href="{% url 'set-cookie-banner-preference' %}?{{cookie_preference_name}}=false&current_page={{ request.path|urlencode }}"
+          class="govuk-button" data-module="govuk-button">
+          Reject analytics cookies
       </a>
       <a class="govuk-link" href="/cookies">View cookies</a>
     </div>
@@ -34,7 +34,7 @@ <h2 class="govuk-cookie-banner__heading govuk-heading-m">
     <div class="govuk-grid-row">
       <div class="govuk-grid-column-two-thirds">
         <div class="govuk-cookie-banner__content">
-          <p class="govuk-body">You've {% if cookie_preferences == 'True' %} accepted {% else %}
+          <p class="govuk-body">You've {% if cookie_preference == 'true' %} accepted {% else %}
             rejected {% endif %} additional cookies. You can <a class="govuk-link" href="/cookies">change your cookie
               settings</a> at any time.
           </p>