Add consent verification as last step of Google Analytics 4 migration

[jennlove-um]

Thank you for contributing to this project!

Add a consent verification as required for users in the European Economic Area (EEA).

Link to U-M guidance - https://vpcomm.umich.edu/resources/cookie-disclosure/

[jonespm]

From @jaydonkrooss

Test plan for Google Analytics OneTrust consent integration. You will need:

Access to the Google Analytics realtime dashboards: Dev or Test
A free-to-use VPN that allows you to spoof your location (eg. TunnelBear or Windscribe). For TunnelBear you can also just use the Chrome extension, but you need to create a free account on their page. The extension is probably the easiest to use. Remember to turn it off after testing.

SETUP: Once you have a VPN installed and configured, you need to make sure that Google Analytics activity is not blocked, so make sure to turn OFF any automatic analytics & tracking blocking on both your VPN and browser (such as if you're using Brave). For example, turn off "Ad + trackers" blocking in the preferences of Windscribe like so:

Scenario 1: for a user in a non-EU country, the integration automatically enables GA tracking and does NOT show the consent banner.

Have your VPN disabled or enabled for a country not in the EU
start an incognito browser and navigate to MyLA Dev or Test. As you remain on the home page, you should not see a popup window at the bottom of the page
Log in to officehours normally and navigate to any link on the page (such as "Manage Queues" or "Preferences")
Check the google analytics realtime dashboard. You should see recent activity for your location

Scenario 2: for a user in an EU country, consent popup should appear and when accepting tracking preferences, activity should be tracked.

Have VPN enabled to an EU country like Germany or Sweden
start an incognito browser and navigate to MyLA Dev or Test. you will see a popup window to accept or deny cookies
Click accept cookies, then log in and navigate to any other page past the home screen
Check google analytics. There should be new activity, and the location of the activity should be the selected EU country.

Scenario 3: repeat the steps above for EU users but instead DENY the tracking preferences. if you log in and navigate to any other pages, there should be NO activity found in google analytics

Scenario 4: repeat the steps for EU users but don't select anything on the banner. If you log in and navigate to other pages, the banner will continue to appear, but again, NO activity should be tracked in the realtime dashboard

One other thing worth checking is that the privacy policy link that exists on the banner properly navigates to the U-M Privacy page

[jaydonkrooss]

Canvas Test is enabled now, and testing on my end looks good, would appreciate someone to verify. Additionally:

Have your VPN disabled or enabled for a country not in the EU start an incognito browser and navigate to MyLA Dev or Test
Have VPN enabled to an EU country like Germany or Sweden start an incognito browser and navigate to MyLA Dev or Test.

One thing I'll note for MyLA is that you'll have to close all open incognito browsers before starting one of these scenarios. Make sure to open the LTI through canvas first, for instance on Canvas Test log in, then navigate to whichever course has "MyLA Test" installed and enabled in the course nav bar.

[jennlove-um]

this can't be tested in myla-beta. Gonzalo's testing has already proven it works in myla-test. I'm going to move this to Done.

[jonespm]

We could add a GA account for beta if you wanted but I'm fine with accepting Gonzalo's testing here.