(function() { const CONSENT_KEY = 'wheretowatch-cookie-consent'; const BANNER_DELAY = 10000; // 10s delay before banner appears (after page becomes interactive) /* ================================================================= SHARED CONSENT COOKIE (cross-subdomain) ----------------------------------------------------------------- localStorage is per-ORIGIN, so a choice made on www never reached german./french./british./... . The consent record is therefore ALSO stored in a first-party cookie scoped to the registrable domain, so every app subdomain reads the same decision. - The name is new (wtw-consent) on purpose: it can never collide with the legacy host-only key, so no stale value is mixed in. - Domain=.wheretowatch.stream is applied ONLY on wheretowatch.stream and its subdomains; any other host (localhost, previews, IPs) keeps the exact legacy host-only behaviour. - Not HttpOnly: this script must read it. Value is a compact, non-secret string: v1.. - The cookie is a MIRROR, never the only copy: localStorage keeps working, so a blocked/cleared cookie degrades to old behaviour. ================================================================= */ const CONSENT_COOKIE = 'wtw-consent'; const CONSENT_COOKIE_MAX_AGE = 31536000; // 1 year, in seconds const CONSENT_COOKIE_DOMAIN = '.wheretowatch.stream'; // Domain attribute for the shared cookie, or '' for host-only. function consentCookieDomain() { try { var host = (location.hostname || '').toLowerCase(); var suffix = CONSENT_COOKIE_DOMAIN; if (host === suffix.slice(1)) return suffix; if (host.length > suffix.length && host.slice(-suffix.length) === suffix) return suffix; } catch (e) { /* never break the consent flow */ } return ''; } // "v1.<3 bits>." - compact enough for every request. function encodeConsentCookie(c) { try { var bits = (c.analytics ? '1' : '0') + (c.preferences ? '1' : '0') + (c.advertising ? '1' : '0'); var ts = (typeof c.timestamp === 'number' && isFinite(c.timestamp)) ? Math.floor(c.timestamp) : Date.now(); return 'v1.' + bits + '.' + ts.toString(36); } catch (e) { return ''; } } // Returns a full consent record, or null when absent/malformed. function parseConsentCookie(raw) { try { if (!raw) return null; var parts = String(raw).split('.'); if (parts.length !== 3 || parts[0] !== 'v1' || parts[1].length !== 3) return null; for (var i = 0; i < 3; i++) { var bit = parts[1].charAt(i); if (bit !== '0' && bit !== '1') return null; } var ts = parseInt(parts[2], 36); if (!isFinite(ts) || ts <= 0) ts = Date.now(); return { essential: true, analytics: parts[1].charAt(0) === '1', preferences: parts[1].charAt(1) === '1', advertising: parts[1].charAt(2) === '1', timestamp: ts }; } catch (e) { return null; } } function readCookieValue(name) { try { var all = (document.cookie || '').split(';'); var prefix = name + '='; for (var i = 0; i < all.length; i++) { var part = all[i].trim(); if (part.indexOf(prefix) === 0) { try { return decodeURIComponent(part.slice(prefix.length)); } catch (e2) { return ''; } } } } catch (e) { /* never break the consent flow */ } return ''; } function writeConsentCookie(c) { try { var value = encodeConsentCookie(c); if (!value) return; var attrs = '; Path=/; Max-Age=' + CONSENT_COOKIE_MAX_AGE + '; SameSite=Lax'; if (location.protocol === 'https:') attrs += '; Secure'; var domain = consentCookieDomain(); if (domain) attrs += '; Domain=' + domain; document.cookie = CONSENT_COOKIE + '=' + encodeURIComponent(value) + attrs; } catch (e) { /* never break the consent flow */ } } // Get elements const banner = document.getElementById('cookie-consent-banner'); const modal = document.getElementById('cookie-manager-modal'); const acceptAllBtn = document.getElementById('cookie-accept-all'); const acceptEssentialBtn = document.getElementById('cookie-accept-essential'); const dismissBtn = document.getElementById('cookie-dismiss'); const settingsLink = document.getElementById('cookie-settings-link'); const closeManagerBtn = document.getElementById('cookie-manager-close'); const saveManagerBtn = document.getElementById('cookie-manager-save'); const analyticsCheckbox = document.getElementById('cookie-analytics'); const preferencesCheckbox = document.getElementById('cookie-preferences'); const advertisingCheckbox = document.getElementById('cookie-advertising'); // Load consent: the shared cookie wins (it is the cross-subdomain // record), then localStorage (legacy + same-origin mirror). A cookie // read is mirrored back into localStorage so every code path below // keeps operating on the exact same shape. Corrupt or unreadable // storage is ignored instead of aborting the script (a bad // localStorage value used to kill the whole consent boot). function readStoredConsent() { var fromCookie = parseConsentCookie(readCookieValue(CONSENT_COOKIE)); if (fromCookie) { try { localStorage.setItem(CONSENT_KEY, JSON.stringify(fromCookie)); } catch (e) {} return fromCookie; } try { var raw = localStorage.getItem(CONSENT_KEY); if (!raw) return null; var parsed = JSON.parse(raw); if (!parsed || typeof parsed !== 'object') return null; return parsed; } catch (e) { return null; } } let consent = readStoredConsent(); // One-time migration for visitors who consented BEFORE the shared // cookie existed: copy their localStorage record into the cookie so // the other subdomains pick it up. Skipped for legacy records that // predate the advertising category (no boolean) - the cookie must // never invent an ad decision. if (consent && typeof consent.advertising === 'boolean') { var existingConsentCookie = readCookieValue(CONSENT_COOKIE); if (!existingConsentCookie || !parseConsentCookie(existingConsentCookie)) { writeConsentCookie(consent); } } // Region-aware consent: EU/EEA/UK/CH users must opt IN to advertising // cookies (GDPR + Google EU regulations policy). Everyone else gets // ads by default. The server renders data-eu on the banner. var isEU = (banner && banner.getAttribute('data-eu') === 'true'); var defaultAdvertising = !isEU; /* ================================================================= ADSENSE TAG + GOOGLE CMP LOADING ----------------------------------------------------------------- The AdSense tag does two jobs: 1. It delivers Google's certified consent message (CMP) to EEA/UK/CH users and emits the TC string AdSense policy requires (fixes "Exigence de consentement : absence de CMP"). 2. It serves the ads for our units. The tag is therefore loaded UNCONDITIONALLY (all regions) and is NEVER removed once loaded - removing it would also remove the CMP. Only our manual ad UNITS are consent-gated, via window.__adsEnabled: - Non-EU: units default ON (user can disable in the manager). - EEA/UK/CH: units OFF until Google's CMP reports advertising consent (followTcfConsent) or the user opts in via the manager. Loading the tag before consent does not serve a personalized ad; Google's CMP controls that. Loading is idempotent. ================================================================= */ var ADSENSE_SRC = 'https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2167344122409975'; var ADSENSE_ID = 'adsbygoogle-script'; // Preconnect to the ad hosts right before the tag loads (idempotent; // never emitted by a non-JS/bot client). function ensureAdPreconnect() { try { var hosts = [ 'https://pagead2.googlesyndication.com', 'https://googleads.g.doubleclick.net', 'https://tpc.googlesyndication.com' ]; for (var i = 0; i < hosts.length; i++) { var pid = 'ads-preconnect-' + i; if (!document.getElementById(pid)) { var l = document.createElement('link'); l.id = pid; l.rel = 'preconnect'; l.href = hosts[i]; l.crossOrigin = 'anonymous'; document.head.appendChild(l); var d = document.createElement('link'); d.id = pid + '-dns'; d.rel = 'dns-prefetch'; d.href = hosts[i]; document.head.appendChild(d); } } } catch (e) { /* never break the consent flow */ } } // Load the AdSense tag. Kept loaded on EEA/UK/CH (it carries the CMP). function ensureAdsenseLoaded() { try { ensureAdPreconnect(); if (!document.getElementById(ADSENSE_ID)) { var s = document.createElement('script'); s.id = ADSENSE_ID; s.src = ADSENSE_SRC; s.async = true; s.crossOrigin = 'anonymous'; document.head.appendChild(s); } } catch (err) { // Silent failure - never break the consent flow } } // Remove the tag (non-EEA opt-out only). Restores the legacy // "no tag = no ads at all" behavior, including Google Auto Ads. // NEVER called on EEA/UK/CH (would remove the certified CMP too). function removeAdsenseTag() { try { var el = document.getElementById(ADSENSE_ID); if (el && el.parentNode) el.parentNode.removeChild(el); } catch (err) { // Silent failure - never break the consent flow } } // Gate our manual ad UNITS only (single source of truth for the // AdUnit components in components/ad-unit-client.tsx). function setAdsEnabled(enabled) { enabled = !!enabled; try { window.__adsEnabled = enabled; window.dispatchEvent(new CustomEvent('wtw-ads-state', { detail: { enabled: enabled } })); } catch (e2) { /* never break the consent flow */ } } // Ask Google's CMP to reopen its consent UI (EEA/UK/CH) so Google's // record stays in sync when the user opts out in our manager. function showGoogleConsentRevocation() { try { if (window.googlefc && typeof window.googlefc.showRevocationMessage === 'function') { window.googlefc.showRevocationMessage(); } } catch (e) { /* never break the consent flow */ } } // Mirror Google's TCF decision (EEA/UK/CH) onto our units. Bounded // retry while the CMP script boots; honors only real EEA signals so a // non-EEA user's explicit opt-out is never overridden. // Optional gate: when gate is passed, the FIRST TCF answer resolves // it (units follow the real TCF decision). If no answer arrives // within gate.timeoutMs (blocked/slow CMP, or gdprApplies !== true), // units fall back to gate.fallback (on EEA this is fail-closed false: // an uncovered request could never serve anyway). The listener stays // attached for ongoing sync either way. Single bounded timer, always // cleared on resolve - no leak. function followTcfConsent(attempt, gate) { attempt = attempt || 0; try { if (gate && !gate.armed) { gate.armed = true; gate.timer = setTimeout(function () { if (!gate.resolved) { gate.resolved = true; gate.timer = null; setAdsEnabled(gate.fallback); } }, gate.timeoutMs); } if (typeof window.__tcfapi === 'function') { window.__tcfapi('addEventListener', 2, function (tcData, success) { if (!success || !tcData || tcData.gdprApplies !== true) { // TCF does not apply (e.g. VPN exit outside EEA) -> resolve // the gate to the stored choice immediately. if (gate && !gate.resolved) { gate.resolved = true; if (gate.timer) { clearTimeout(gate.timer); gate.timer = null; } setAdsEnabled(gate.fallback); } return; } var ok = !!(tcData.purpose && tcData.purpose.consents && tcData.purpose.consents[1]); if (gate && !gate.resolved) { gate.resolved = true; if (gate.timer) { clearTimeout(gate.timer); gate.timer = null; } } setAdsEnabled(ok); }); return; } if (attempt < 60) { setTimeout(function () { followTcfConsent(attempt + 1, gate); }, 500); } else if (gate && !gate.resolved) { // __tcfapi never appeared (fully blocked) -> stored choice. gate.resolved = true; setAdsEnabled(gate.fallback); } } catch (e) { /* never break the consent flow */ } } // Initial AdSense state: // - Legacy consent (recorded before the advertising category existed, // i.e. consent.advertising is undefined) means the user already // clicked Accept All or Accept minimum on a previous visit. // Non-EEA keeps advertising ON (unchanged) — ads only turn off // when explicitly disabled in the cookie manager. EEA/UK/CH can // no longer imply ads-ON: without a TC string those requests // count as uncovered, so legacy falls back to the region default // (off) until Google's CMP answers via TCF. // - Fresh consent -> honor the stored advertising choice. // - No consent -> region default (EU off until a button is clicked, // non-EU on). var storedAdvertising = consent ? (typeof consent.advertising === 'boolean' ? consent.advertising : !isEU) : defaultAdvertising; // Tag policy: // - EEA/UK/CH: ALWAYS loaded (it carries Google's certified CMP). // - non-EEA: loaded only when advertising is ON; removed when the user // opted out, restoring the legacy no-tag = no-ads (incl. Auto Ads). if (isEU || storedAdvertising) { ensureAdsenseLoaded(); } else { removeAdsenseTag(); } if (isEU) { // EEA/UK/CH: units start OFF until Google's CMP answers (the first // TCF event carries the real decision). FAIL-CLOSED: if no TCF // answer arrives within 5s (CMP blocked/slow/absent) units stay // OFF (fallback=false) instead of falling back to a stored "true". // A TC-less activation could never serve an ad anyway (Google // withholds without a TC string), but keeping units off guarantees // we never emit an uncovered EEA request. Non-EEA path unchanged. setAdsEnabled(false); followTcfConsent(0, { fallback: false, timeoutMs: 5000, resolved: false, armed: false, timer: null }); } else { setAdsEnabled(storedAdvertising); } // Show banner after delay if no consent. // EEA/UK/CH: Google's certified CMP (delivered by the AdSense tag) is // the consent authority for advertising. If it is ACTIVE (TCF API // present) we suppress our own banner to avoid two conflicting dialogs. // If it is NOT active (not loaded, blocked, or message not published) we // fall back to our banner so EEA users still get a cookie notice - a // fail-safe, never "no notice". Non-EU behaviour is unchanged. function showBanner() { if (!(banner && !consent)) return; setTimeout(() => { if (isEU && typeof window.__tcfapi === 'function') return; banner.style.display = 'block'; }, BANNER_DELAY); } // Hide banner function hideBanner() { if (banner) { banner.style.display = 'none'; } } // Show modal function showModal() { if (modal) { modal.style.display = 'block'; // Load current settings (or region defaults before first save) analyticsCheckbox.checked = consent ? (consent.analytics || false) : false; preferencesCheckbox.checked = consent ? (consent.preferences || false) : false; // The advertising row is hidden on EEA/UK/CH (Google's certified // CMP owns ad consent), so the checkbox may not exist there. if (advertisingCheckbox) { // Row exists only outside EEA/UK/CH (where defaultAdvertising // is true), so this is identical to before; written with the // region default so it can never imply consent by accident. advertisingCheckbox.checked = consent ? (typeof consent.advertising === 'boolean' ? consent.advertising : defaultAdvertising) : defaultAdvertising; } } } // Hide modal function hideModal() { if (modal) { modal.style.display = 'none'; } } // Save consent function saveConsent(newConsent) { // Advertising value resolution: // - an explicit boolean (button/checkbox) wins; // - otherwise (EEA/UK/CH where our advertising row is hidden) keep the // previous value, or the region default -> never silently opt out. var advertising if (typeof newConsent.advertising === 'boolean') { advertising = newConsent.advertising } else if (consent && typeof consent.advertising === 'boolean') { advertising = consent.advertising } else { advertising = defaultAdvertising } // Only an explicit user opt-out (the toggle actually existed and was // unchecked) should open Google's revocation UI - not a routine // analytics/preferences save on EEA. var explicitOptOut = !!advertisingCheckbox && newConsent.advertising === false consent = { essential: true, analytics: newConsent.analytics || false, preferences: newConsent.preferences || false, advertising: advertising, timestamp: Date.now() }; localStorage.setItem(CONSENT_KEY, JSON.stringify(consent)); // Mirror the decision into the shared cookie so every subdomain // (and any future one) honours it. Best-effort: a blocked cookie // must never stop the save from completing. writeConsentCookie(consent); // EEA/UK/CH keep the tag (CMP); non-EEA removes it on opt-out. if (isEU || consent.advertising) { ensureAdsenseLoaded(); } else { removeAdsenseTag(); } setAdsEnabled(consent.advertising); // EEA/UK/CH: keep Google's own consent record in sync on opt-out. if (explicitOptOut) showGoogleConsentRevocation(); hideBanner(); hideModal(); } // Event listeners if (acceptAllBtn) { acceptAllBtn.addEventListener('click', () => { // Accept All explicitly enables advertising (ads ON for all regions). saveConsent({ essential: true, analytics: true, preferences: true, advertising: true }); }); } if (acceptEssentialBtn) { acceptEssentialBtn.addEventListener('click', () => { // "Accept minimum" means minimum: EEA/UK/CH saves advertising OFF // (an EEA "essential" click must never emit personalized-ad // requests without a TC string). Non-EEA keeps ads ON (unchanged). // The manager then opens so the user can review/disable them. saveConsent({ essential: true, analytics: false, preferences: false, advertising: !isEU }); showModal(); }); } if (dismissBtn) { dismissBtn.addEventListener('click', hideBanner); } if (settingsLink) { settingsLink.addEventListener('click', (e) => { e.preventDefault(); showModal(); }); } if (closeManagerBtn) { closeManagerBtn.addEventListener('click', hideModal); } if (saveManagerBtn) { saveManagerBtn.addEventListener('click', () => { saveConsent({ essential: true, analytics: analyticsCheckbox.checked, preferences: preferencesCheckbox.checked, // May be absent on EEA/UK/CH (row hidden) -> preserve prior value. advertising: advertisingCheckbox ? advertisingCheckbox.checked : undefined }); }); } /* =================================================================== COUNTRY OVERRIDE HANDLER (new, fully backward compatible) ----------------------------------------------------------------- - Only attaches if the

Cookie Notice

Cookie Preferences

Essential Cookies

Analytics Cookies

Preferences Cookies

Advertising Cookies

Ryan Rottman

Biography

Known For: Movies

The House Bunny

Billionaire Boys Club

Known For: TV Shows

The Middle

90210

Ryan Rottman

Biography

Known For: Movies

The House Bunny

Billionaire Boys Club

Known For: TV Shows

The Middle

90210

Love Song For My Texas Ranger

Christmas Wonderland

My Southern Family Christmas

Happy Holidays from Cherry Lane

Diagnosis Delicious

Sister of the Bride

Deported

Zac Efron's Pool Party

Aloha Also Means Goodbye

Stuntmen

Birds of a Feather

Christmas for Keeps

The Long Walk Home

White Dwarf

Victorious

Greek

The Lying Game

Guidance

Gigantic

Happyland