From 0b9ae0017009af27e662356407d8ed9c565cbb4c Mon Sep 17 00:00:00 2001
From: Erosika <eri@plasticlabs.ai>
Date: Tue, 25 Aug 2026 16:45:18 -0400
Subject: [PATCH] feat(docs): PostHog loads only with a granting consent answer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DEV-2465 open question 5, option d. Mintlify's built-in integration
loaded PostHog unconditionally on all 249 docs pages — a visitor who
declined on the homepage was tracked one click later in the docs. The
integration key comes out of docs.json; docs/posthog-consent.js loads
PostHog directly instead, only when the CookieConsent cookie grants
Statistics (or holds Cookiebot's -1 marker), and listens for the
consent events so a grant on the docs banner itself loads it too.

Trade recorded on the ticket: this bypasses the ph.mintlify.com proxy,
so ad blockers reduce docs PostHog volume. Verify after deploy that
Mintlify's page CSP allows us-assets.i.posthog.com; if it blocks,
fall back to option c.
---
 docs/docs.json          |  3 ---
 docs/posthog-consent.js | 43 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)
 create mode 100644 docs/posthog-consent.js

diff --git a/docs/docs.json b/docs/docs.json
index e0873acb..b1dad2ba 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -630,9 +630,6 @@
     }
   },
   "integrations": {
-    "posthog": {
-      "apiKey": "phc_1yrzzcgywqXGcerkkI4g7C0YfyPMcAKNOOvGcjTCiUk"
-    },
     "gtm": {
       "tagId": "GTM-NSPT9PJF"
     }
diff --git a/docs/posthog-consent.js b/docs/posthog-consent.js
new file mode 100644
index 00000000..214c6b1c
--- /dev/null
+++ b/docs/posthog-consent.js
@@ -0,0 +1,43 @@
+// Loads PostHog only when the CookieConsent cookie grants Statistics; the
+// cookie is host-scoped, so a landing-page answer covers the docs.
+;(function () {
+  var KEY = 'phc_1yrzzcgywqXGcerkkI4g7C0YfyPMcAKNOOvGcjTCiUk'
+  var loaded = false
+
+  function granted() {
+    var m = document.cookie.match(/CookieConsent=([^;]*)/)
+    if (!m) return false
+    var v = decodeURIComponent(m[1])
+    // "-1" is Cookiebot's consent-not-required marker.
+    return v === '-1' || /statistics\s*:\s*true/.test(v)
+  }
+
+  function loadPosthog() {
+    if (loaded) return
+    loaded = true
+    var s = document.createElement('script')
+    s.src = 'https://us-assets.i.posthog.com/static/array.js'
+    s.async = true
+    s.onload = function () {
+      window.posthog.init(KEY, {
+        api_host: 'https://us.i.posthog.com',
+        ui_host: 'https://us.posthog.com',
+        cross_subdomain_cookie: true,
+        person_profiles: 'identified_only',
+      })
+    }
+    document.head.appendChild(s)
+  }
+
+  if (granted()) {
+    loadPosthog()
+    return
+  }
+  // A grant made on the docs banner itself (step 2) loads it live.
+  var events = ['CookiebotOnConsentReady', 'CookiebotOnAccept']
+  for (var i = 0; i < events.length; i++) {
+    window.addEventListener(events[i], function () {
+      if (granted()) loadPosthog()
+    })
+  }
+})()