Cookie consent and Meta Pixel

ElecParts stores anonymous visitor choices in first-party localStorage under elecparts.cookie-consent. The record contains the category decisions, schema version, and decision timestamp. It is not sent to the application server. Essential storage is always on; Analytics is omitted while no Analytics provider is deployed; Marketing is off unless the visitor opts in.

Increment CONSENT_SCHEMA_VERSION in resources/js/consent/consentStore.ts when a material change to categories, providers, or purposes requires visitors to make a fresh choice. Older or malformed records are treated as undecided.

Production setup

The ElecParts Meta Pixel ID is fixed in config/tracking.php as 1137441855528330; no Meta-specific environment variables are required. The integration is enabled automatically only when Laravel is running in the production environment. In every environment, a visitor's explicit Marketing consent and the existing page eligibility checks are still required before the Pixel script is loaded or an event is sent.

Before production tracking is activated, verify the Pixel in Meta Events Manager under Data Sources and confirm that Automatic Advanced Matching and automatic event configuration are disabled for this Pixel. The site code also calls fbq('set', 'autoConfig', false, pixelId) before initialization, passes no form values, and sends no event parameters.

To disable tracking altogether, change enabled to false in config/tracking.php, then rebuild or clear Laravel's cached configuration as appropriate and redeploy. No Pixel script, image beacon, initialization, or event is rendered in the HTML when tracking is disabled or the visitor has not opted in.

The official snippet was reviewed and reduced to the consent-gated bootstrap, the supplied Pixel ID, PageView, and CompleteRegistration. Its unconditional <noscript> image beacon was omitted because consent cannot be verified for a no-JavaScript visitor. The code does not use advanced matching, custom parameters, Conversions API, Google Tag Manager, or any other provider. The implementation files are resources/js/consent/metaPixel.ts, resources/js/consent/consentStore.ts, and resources/js/components/CookieConsentManager.vue.

Event scope and withdrawal

• PageView is limited to the landing page and the clean, non-invitation registration page. The landing URL may contain only fbclid and utm_source, utm_medium, utm_campaign, utm_content, or utm_term values that match the conservative alphanumeric/period/underscore/tilde/hyphen allowlist. Unknown or duplicate query keys, values containing characters outside that allowlist, and any fragment are excluded. Registration and verification URLs must have no query string.
• Meta Pixel requests may include the current document URL and document.referrer automatically. Server and client checks both reject referrers containing query or fragment data, invalid URLs, credentials, and non-public paths; an external referrer is allowed only at its origin root. Unsafe contexts are suppressed rather than rewriting the referrer or relying on undocumented Pixel options. The current landing URL may still include the validated advertising parameters so Meta can associate fbclid and UTM attribution.
• If Marketing is accepted while an eligible page is open, one PageView is sent for that page. Repeated actions, component remounts, and reactive updates do not duplicate it; earlier pages viewed before consent are not replayed.
• CompleteRegistration is sent without parameters on the one-time successful self-service registration redirect, only if Marketing consent was stored when the form was submitted and remains enabled on the verification page. Failed, duplicate, invited, unconsented, and repeated visits do not generate it.
• Tenant inventory, purchasing, BOM, project, and central internal account/admin routes do not mount the consent UI or Pixel tracker.
• Withdrawing Marketing stores the new choice, calls Meta's consent-revocation command if the Pixel was initialized, expires accessible _fbp and _fbc cookies, and reloads the document. A browser cannot reverse data already disclosed.

Manual validation checklist

• In a clean browser profile, load /, /cookie-policy, /privacy-policy, /login, /register, and /verify-email. Before a choice, check DevTools Network for no connect.facebook.net, facebook.com/tr, _fbp, or _fbc activity. Confirm the banner is centered and compact, has equally visible Reject optional and Accept marketing actions, and has no customization dialog.
• Reject optional, navigate between Blade and central Inertia pages, and reload. Confirm the choice persists and no Meta request/event appears.
• Accept Marketing on an eligible landing page. Confirm the Pixel script is inserted once and that the current page produces exactly one PageView; accept again or remount the component and confirm there is no duplicate. Confirm no event is replayed for an earlier page visited before consent.
• Open Cookie Settings from the public and legal footer buttons and the central guest link. Confirm the saved choice is identified, closing settings preserves it, and the two actions let the visitor switch it. Check that public in-page anchors still scroll normally.
• With consent stored, verify /?fbclid=...&utm_source=...&utm_medium=...&utm_campaign=... is eligible. Verify unknown or duplicate keys, email/token values, fragments, and referrers with query or fragment data prevent script initialization and events.
• Submit a valid self-service registration while consented. Confirm one CompleteRegistration after the server redirect, with no customer or business data in event parameters. Repeat without consent and through an invite URL; confirm no conversion event.
• Reopen Cookie Settings from the public footer and central guest floating control. Turn Marketing off and confirm revocation, accessible _fbp/_fbc removal, reload, and no further Pixel requests.
• Test desktop and narrow mobile widths, light and dark appearance, at 200% zoom, keyboard focus and close-without-changing behavior, and screen-reader names/status messages. Check pointer cursors on consent actions, policy links, and footer/settings triggers.
• With Meta Pixel Helper and Events Manager Test Events, verify the configured ID and event count in the production-like environment. Do not run these tools against local, dev, or test builds.

Legal review before production enablement

Technical consent controls do not by themselves establish legal compliance. Before enabling production tracking, confirm the applicable consent/legal basis and wording for German/EU visitors, the relevant Meta contracting entity and controller roles, transfer mechanism/safeguards, retention disclosures, the Pixel's account-level automatic matching/event settings, and any required records or notices. Meta's current Privacy Policy, Cookie Policy, and Pixel GDPR implementation guidance should be reviewed at launch. The public policies describe the current implementation but do not make a blanket compliance claim.