Tracking V2: connect iFrame and consent

Tracking V2: connect iFrame and consent

For website embedding, Tracking V2 must receive your website’s actual session and consent. The booking process does not adopt an independent replacement session in the iframe. This setup is intended for the person or agency managing the website, Google Tag Manager and consent management.

First configure the tracking destinations in edoobox and use the current embedding code from Preview / Share.

Prepare the V2 web GTM container

1. In edoobox, export GTM V2 container.
2. In Google Tag Manager, open the appropriate web container and select Admin → Import container.
3. Import the JSON file as an addition to the existing container and check conflicts before confirming. Google’s process distinguishes ‘Merge’ and ‘Overwrite’; a complete overwrite removes previous tags, triggers and variables. See Google: Import a container.
4. Ensure a Google tag for the same measurement ID exists on your website. The edoobox module does not install an additional GA4 property.
5. Disable previous edoobox purchase tags for the same account. Retain the permitted browser funnel and consent setup.
6. Check the container in preview and publish the prepared changes.

The V2 export contains browser events only. Purchases, payments, cancellations and refunds come through server-side sending from edoobox.

Add the website helper alongside the iframe

Leave the edoobox embedding code in place and then load the two additional scripts on your website. Use the host of the edoobox environment actually used:

<script src="https://app2.edoobox.com/js/home/tools/booking-analytics-v2.js"></script>
<script src="https://app2.edoobox.com/js/home/tools/booking-analytics-embedded-v2.js"></script>

Then register the specific iframe:

edooboxBookingAnalyticsEmbedV2.register({
    iframeId: 'edoobox_customer',
    bookingOrigin: 'https://app2.edoobox.com',
    measurementId: 'G-CUSTOMERID',
    googleEnabled: true,
    microsoftEnabled: false,
    openaiEnabled: false,
    getConsent: function () {
        return readCurrentConsentFromYourCmp();
    }
});

In the example, readCurrentConsentFromYourCmp() is a placeholder for your CMP integration. Replace the function with actual consent access. The callback must return an object in this format:

{
    analytics_storage: 'denied',
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied'
}

Set a value to granted only if a corresponding valid decision exists. Missing or unknown values are treated as refusal.

Map parameters correctly

Parameter	Configuration
iframeId	The unique ID of the actual iframe DOM element. It must match exactly.
bookingOrigin	Protocol and host of the booking page, including a port if applicable; without a path or trailing slash.
measurementId	The same GA4 measurement ID as in the active edoobox configuration.
googleEnabled / microsoftEnabled / openaiEnabled	Exactly the same activated providers as in the edoobox account.
getConsent	Returns the current CMP state on every call.

For Ads without Google, set googleEnabled: false and omit measurementId. For several edoobox accounts, register each iframe separately with its own destinations. Changes to provider selection must be reflected both in edoobox and website registration.

The iframe needs your website’s origin referrer, for example using referrerpolicy="origin" or the usual default strict-origin-when-cross-origin. With no-referrer, no parent context is adopted. Use the exact origin instead of a wildcard.

Pass on consent and withdrawal

After every CMP change, request a new capture for this iframe:

edooboxBookingAnalyticsEmbedV2.refresh('edoobox_customer');

This applies both after consent and after withdrawal. Analytics and advertising are handled separately. Advertising attribution requires both ad_storage: 'granted' and ad_user_data: 'granted'. Withdrawal also removes stored advertising identifiers from the booking context.

The module does not capture an allowed Google session if the website has merely entered a measurement ID without providing a corresponding Google tag. Booking does not wait for a successful tracking retrieval.

Direct edoobox page and your own CMP

In a direct participant view, the edoobox cookie banner can provide explicit consent. Without a banner, V2 starts with refusal. If your own CMP is used, provide this function before initialisation:

window.edooboxAnalyticsConsent = function (measurementId) {
    return readCurrentConsentFromYourCmp();
};

For a later change, pass the current state:

window.dispatchEvent(new CustomEvent('edoobox:analytics-consent', {
    detail: {
        measurement_id: 'G-CUSTOMERID',
        consent: readCurrentConsentFromYourCmp()
    }
}));

For Ads without Google, use measurement_id: '' in the direct consent event. The example belongs on the page actually managed or in its appropriate integration; do not enter it as arbitrary HTML in verification meta tags.

Three checks before going live

1. Refusal: Start with consent denied. No consent-dependent analytics or advertising events for this process may be transmitted.
2. Consent: Allow the intended purposes. Check the browser funnel and a controlled definitive booking in the destination system.
3. Withdrawal: Withdraw consent during the process and update the helper. Check that no renewed permission arises from an old context.

Check on desktop and smartphone and after navigating between offer overview and booking. With multiple iframes, an event must be attributed only to the intended account and tracking destination.

Next: Events and troubleshooting · Cookie banner · Configure providers

Check the actual parent context in the CMS

Registration requires the actual edoobox iFrame as a DOM element on the page where the helpers run. An additional embedding frame from a website builder can change this access. Check the actual published CMS layout; an outer placeholder with the same visible size is not automatically the correct element.

Load helpers only once per managed page and register each edoobox instance with a unique ID. Return a fresh current CMP evaluation in the callback, rather than consent frozen at page load. After switching provider or account, registration and saved destination configuration must match.