feat(analytics-controller): add optional pre-consent event queue - #9252
Merged
gauthierpetetin merged 3 commits intoJun 25, 2026
Conversation
Add an opt-in pre-consent event queue to AnalyticsController, gated by the new isPreConsentQueueEnabled option (disabled by default). Track events received while the user is undecided are persisted and replayed on opt-in, or discarded on opt-out. Adds a consentDecisionMade state field, a selectConsentDecisionMade selector, and a resetConsentDecision action. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gauthierpetetin
temporarily deployed
to
default-branch
June 24, 2026 11:39 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b05a866. Configure here.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds an opt-in “pre-consent” track-event queue to AnalyticsController, allowing clients to persist track events while the user is undecided and then replay them on opt-in (or discard on opt-out), gated behind a new isPreConsentQueueEnabled option (default off).
Changes:
- Introduces
consentDecisionMadeandpreConsentEventQueuecontroller state, with metadata and reconciliation/replay/clear logic. - Adds
resetConsentDecisionto the controller API/messenger actions, plus a newselectConsentDecisionMadeselector. - Extends the Jest test suite and updates the package changelog.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/analytics-controller/src/selectors.ts | Adds selectConsentDecisionMade selector for distinguishing undecided vs explicit opt-out. |
| packages/analytics-controller/src/index.ts | Exports the new AnalyticsControllerResetConsentDecisionAction type. |
| packages/analytics-controller/src/AnalyticsController.ts | Adds pre-consent queue state/metadata, feature flag, queueing/replay/cleanup logic, and resetConsentDecision. |
| packages/analytics-controller/src/AnalyticsController.test.ts | Adds/updates tests for consentDecisionMade, pre-consent queue behavior, and the new selector. |
| packages/analytics-controller/src/AnalyticsController-method-action-types.ts | Adds resetConsentDecision method action type and includes it in the union. |
| packages/analytics-controller/CHANGELOG.md | Documents the new optional pre-consent queue feature. |
Comments suppressed due to low confidence (1)
packages/analytics-controller/src/AnalyticsController.ts:421
initialStateis built by spreadinggetDefaultAnalyticsControllerState()(which setsconsentDecisionMade: false) over the providedstate. For persisted states from beforeconsentDecisionMadeexisted, this forcesconsentDecisionMadetofalse("undecided"). If a client later enablesisPreConsentQueueEnabled, users who previously had onlyoptedIn: falsewill start persisting pre-consent events, which is a backward-compatibility behavior change and may conflict with prior opt-out expectations. Consider defaultingconsentDecisionMadetotruewhen the incomingstatedoes not specify it, preserving the legacy "disabled means drop" behavior unless clients explicitly opt into the undecided state.
isPreConsentQueueEnabled = false,
}: AnalyticsControllerOptions) {
const initialState: AnalyticsControllerState = {
...getDefaultAnalyticsControllerState(),
...state,
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Drop a stale persisted pre-consent queue on init when the queue is disabled, so it can never be replayed by a later enabled instance. - Add a deriveStateFromMetadata test asserting preConsentEventQueue is persisted but excluded from logs, debug snapshots, and UI. - Move selectConsentDecisionMade tests into selectors.test.ts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
NicolasMassart
approved these changes
Jun 24, 2026
NicolasMassart
left a comment
NicolasMassart
left a comment
Contributor
There was a problem hiding this comment.
Really clean implementation of the pre-consent queue! Nice work!
Contributor
Author
|
@metamaskbot publish-previews |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
pull Bot
pushed a commit
to dmrazzy/core
that referenced
this pull request
Jun 25, 2026
## Explanation Monorepo release that publishes the analytics pre-consent queue work: - **`@metamask/analytics-controller`** → **1.2.0** (minor) - Adds an optional pre-consent event queue to `AnalyticsController` (disabled by default via `isPreConsentQueueEnabled`), with a `consentDecisionMade` state field, `selectConsentDecisionMade` selector, and `resetConsentDecision` action ([MetaMask#9252](MetaMask#9252)). - Bumps `@metamask/utils` from `^11.9.0` to `^11.11.0` ([MetaMask#9074](MetaMask#9074)). Root `package.json` is bumped from `1072.0.0` to `1073.0.0`. There are no application source changes in this diff. ## References - MetaMask#9252 - MetaMask#9074 ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
Merged
7 tasks
pull Bot
pushed a commit
to Reality2byte/metamask-extension
that referenced
this pull request
Jul 28, 2026
…taMask#43869) ## **Description** Move consent decision state and pre-consent event queue from MetaMetricsController to AnalyticsController. It replaces this state: - MetaMetricsController's `completedMetaMetricsOnboarding` - MetaMetricsController's `eventsBeforeMetricsOptIn` by this state: - AnalyticsController's `consentDecisionMade` - AnalyticsController's `preConsentEventQueue` It leverage pre-consent event queue feature added to AnalyticsController in this PR: MetaMask/core#9252 (and this PR: MetaMask/core#9284) ## **Changelog** CHANGELOG entry: null ## **Related issues** Contributes to: MetaMask/MetaMask-planning#7337 ## **Manual testing steps** 1. Start the on-boarding until you land on MetaMetrics screen 2. Open inspector > Application > Extension storage > Local > AnalyticsController 3. Confirm `consentDecisionMade` is set to false 4. Confirm `preConsentEventQueue` includes a list of events 5. Get your analyticsId, open the Segment debugger, past your analyticsId in the search bar and confirm there are no events listed 6. Opt in to MetaMetrics on the MetaMetrics screen 7. Confirm the events previously listed in `preConsentEventQueue` now show up in Segment 8. Refresh the inspector 9. Confirm `consentDecisionMade` is now set to true 10. Confirm `preConsentEventQueue` is now empty ## **Screenshots/Recordings** NA ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches privacy/consent and what gets sent before/after opt-in, plus a persisted migration that reshapes queued events; incorrect gating could leak or drop analytics/Sentry data. > > **Overview** > **Analytics consent and pre-consent buffering now live on `AnalyticsController`**, replacing `MetaMetricsController.completedMetaMetricsOnboarding` and `eventsBeforeMetricsOptIn`. Call sites (background metrics gates, cookie handler, participation checks, Sentry) read **`consentDecisionMade`** and **`optedIn`** from analytics state only. > > **`MetaMetricsController` no longer queues or replays pre-consent events**—those messenger actions and state fields are removed. **`setParticipateInMetaMetrics`** delegates opt-in/out to `AnalyticsController:optIn` / `optOut`, uses **`resetConsentDecision`** when set to `null`, and still flushes/clears **trace** buffering locally. Init enables **`isPreConsentQueueEnabled`** on analytics (package bump to `@metamask/analytics-controller` ^1.2.1). > > **Install and OAuth paths** stop manual buffering: **`App Installed`** always goes through `trackEvent`, and OAuth injects **`trackEvent`** instead of `addEventBeforeMetricsOptIn`. Extension **`trackEvent`** only bails when basic external services are disabled; consent gating is assumed downstream in the controller queue. > > **Migration #220** copies consent from the old flag, migrates buffered events into `preConsentEventQueue` (including anonymous splits for sensitive properties), and strips the legacy MetaMetrics fields. Fixtures, types, and e2e metrics tests are updated to the new shape. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c0532b1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Adds an opt-in pre-consent event queue to AnalyticsController, gated by the new
isPreConsentQueueEnabledoption (disabled by default).Track events received while the user is undecided are persisted and replayed on opt-in, or discarded on opt-out.
References
Fixes: N/A
Checklist
Note
Medium Risk
Touches analytics consent and what gets stored or sent before/after opt-in/out; opt-out and reset now purge more persisted data, but the feature is off by default and track-only for the pre-consent path.
Overview
Adds an opt-in pre-consent flow to
AnalyticsControllerviaisPreConsentQueueEnabled(default off). When enabled, track events fired while the user is undecided (consentDecisionMadefalse) are stored in persistedpreConsentEventQueueinstead of being dropped; they are replayed on opt-in (through the normal delivery path, includingeventQueuewhen persistence is on) and discarded on opt-out.Introduces
consentDecisionMade(default false, set byoptIn/optOut),selectConsentDecisionMade, andresetConsentDecision(undecided again; clears delivery and pre-consent queues).optOutnow also clears queued delivery and pre-consent events.initreconciles stale persisted pre-consent queues (replay if opted in, clear if opted out or feature disabled).Legacy behavior is unchanged when the flag is off: undecided users still do not get events queued or sent.
Reviewed by Cursor Bugbot for commit 5133205. Bugbot is set up for automated code reviews on this repo. Configure here.