Amphtml: amp-embed not always blocking tracking with data-block-on-consent flag

[samanthamorco]

My team works with an ad partner that uses amp-embed to display their ad unit instead of amp-ad.

We're not using taboola (instead we're using Outbrain), but this is a sample code I found on the AMP documentation which is similar to how our ad partner requires us to show the amp-embed, so it roughly looks like this:

  <amp-embed data-block-on-consent
    type="taboola"
    width="400"
    height="300"
    layout="responsive"
    data-publisher="amp-demo"
    data-mode="thumbnails-a"
    data-placement="Ads Example"
    data-article="auto">
  </amp-embed>

Before the consent gate is passed, we're using Ghostery to check if there are any trackers on the page before a user passes through our consent gate. data-block-on-consent seems to successfully block other tracking units, such as DFP ads and Google Analytics, but the Outbrain ad partner utilizing the amp-embed shows up on the tracker about 90% of the time even before a user passes through the consent gate. Also, if a user denies cookies, this ad partner's trackers still show up even though everything else is blocked.

It seems like there is a bug with how data-block-on-consent works with amp-embed.

To replicate the issue, you can put the above amp-embed in the geolocation playground:
https://ampbyexample.com/playground/#url=https%3A%2F%2Fampbyexample.com%2Fuser_consent%2Fgeolocation-based_consent_flow%2Fsource%2F

[hrkhal]

We're also experiencing the same issues with the data-block-on-consent attr not working as intended with amp-embed.

Incidentally we're using the same Taboola type as listed in the above example.

[jpettitt]

This may be related to https://github.com/ampproject/amphtml/issues/13716#issuecomment-388605061

[zhouyx]

@samanthamorco Thanks for filing this.
This is a bug introduced from https://github.com/ampproject/amphtml/pull/14938#discussion_r187726114. We are working on a fix.
Closed in favor of #15269