The Storylane embeds on /live-demo and /interactive-demo-mcp load a third-party iframe and script unconditionally on page render. The visitor never opts in, which docs/embed-contract.md records as known privacy debt.
The remediation is a click-to-load pattern: render a static preview (thumbnail or styled placeholder) in the same aspect-ratio box, and mount the iframe and the enhancement script only after an explicit visitor click. The aspect-ratio wrapper in StorylaneEmbed.astro already gives the preview its box, so the change is contained to that component.
Context in docs/embed-contract.md (Storylane section), which also explains why the previous marketing-consent gate on the enhancement script was removed rather than extended: it never covered the iframe and its parse-time check locked out consenting first-time visitors.
🤖 Generated with Claude Code
The Storylane embeds on /live-demo and /interactive-demo-mcp load a third-party iframe and script unconditionally on page render. The visitor never opts in, which docs/embed-contract.md records as known privacy debt.
The remediation is a click-to-load pattern: render a static preview (thumbnail or styled placeholder) in the same aspect-ratio box, and mount the iframe and the enhancement script only after an explicit visitor click. The aspect-ratio wrapper in StorylaneEmbed.astro already gives the preview its box, so the change is contained to that component.
Context in docs/embed-contract.md (Storylane section), which also explains why the previous marketing-consent gate on the enhancement script was removed rather than extended: it never covered the iframe and its parse-time check locked out consenting first-time visitors.
🤖 Generated with Claude Code