“Disabling cookies” and “Disabling Munchkin” are different (though of course related) things
“We’re consistently seeing only one pageview per visit,” noted the Marketo admin. “We can’t be offending everybody, so maybe something’s up with our cookie banner?” She was right, people weren’t abandoning immediately. Rather, broken cookie consent JS was blocking the Munchkin _mkto_trk cookie for everyone, but not blocking Munchkin itself. How not to manage cookie consentThe code, like others of its type, was jaw-droppingly intrusive: it redefined document.cookie and proxied cookieStore to eavesdrop on set-cookie calls. (A crazy thing to just drop into a site, not that tricks used by other cookie apps[1] are much better!) _mkto_trk was on its cookie blocklist, but munchkin.js was always loaded + initialized. That leads to a half-baked outcome where:a person lands on the site from an email link, which attaches the mkt_tok to the query string to identify the Marketo record Munchkin generates a random session token value saving the token to a cookie is blocked by the consent JS the token
