Cookies & Consent in the Viewer

When your publication runs on your own custom domain (e.g. brochure.example.com), its pages are served by the Joomag platform. Two things follow from that for cookie compliance:

1. Joomag’s essential cookies appear as first-party cookies on your domain. Cookie scanners will report them under your site, so they belong in your cookie manager’s list.
2. A consent banner on your main website does not cover the publication. The publication is its own page — your banner (CMP) must be loaded inside it. See Loading your consent banner.

Note

This page describes the Viewer’s observable behavior so your privacy team can categorize cookies and configure enforcement. The suggested categories are informational, not legal advice — confirm them with your own privacy or legal team.

Domains the Viewer contacts

Domain	Purpose	Cookies
*.joomag.com	Publication content, scripts, images, and reader-analytics collection	Essential cookies only (see below). Analytics collection is cookie-less.
www.googletagmanager.com	Operational tag container for the Viewer	Sets no cookies on your publication
use.typekit.net, p.typekit.net	Viewer interface fonts (Adobe Fonts)	None
js.sentry-cdn.com, browser.sentry-cdn.com, sentry.io	Technical error monitoring (crash reporting)	None
www.youtube.com	YouTube video embeds — only if your publication contains YouTube videos	YouTube’s own cookies (typically categorized Functional)
player.vimeo.com	Vimeo video embeds — only if your publication contains Vimeo videos	Vimeo’s own cookies (e.g. vuid)

Always allow the service domains

*.joomag.com, the Adobe Fonts domains, and the Sentry domains must not be blocked by your cookie manager: they set no non-essential cookies, and blocking them breaks the publication itself (content, fonts, error reporting). Treat them as strictly necessary services.

Third-party video cookies belong to their vendors — for names, durations, and purposes, refer to Google’s cookie documentation and Vimeo’s cookie policy.

Joomag cookie reference

Cookies present for every reader. Suggested category for all of them: Strictly Necessary / Essential.

Cookie	Duration	Purpose
PHP_JOOMAG_SESSION	Session	Server session that keeps the reading session working (content delivery, security state). Appears both on .joomag.com and as a first-party cookie on your custom domain.
__csrf_token	Session	Security token protecting requests against cross-site request forgery.
__trust	Session	Technical check that the browser accepts cookies when the Viewer runs on a custom domain (Safari compatibility).

Only when a reader signs in

These appear only if a reader actively signs in to Joomag services from the Viewer (for example, a publication whose privacy settings require login). They are not part of a public publication’s flow. Category: Strictly Necessary (they exist solely to provide the sign-in the reader requested).

Cookie	Duration	Purpose
sub_auth, refresh_token	12 months	Reader authentication session and its renewal.
jwt	Session	Signed-in user session.
platform_data	24 hours	Session context for signed-in users.
r2	12 months	“Remember this device” for two-factor authentication.

Loading your consent banner inside the publication

Because the publication’s pages are served by Joomag, you can’t add your CMP’s script tag to them directly. The Viewer offers two injection points, configured per publication in Viewer settings (see Reader Events → Setup for where these settings live):

• Google Tag Manager — enter your container ID, and deliver your CMP tag through your own container.
• Ensighten (CHEQ) — paste your Ensighten Bootstrap URL; the Viewer loads it in the page head. This integration is enabled per account — contact your Customer Success Manager or Joomag support to activate it.

CMPs delivered via Google Tag Manager fire late

A consent banner loaded through a tag manager starts after the container does, which weakens auto-blocking of requests that begin at page load. If your CMP vendor offers a dedicated integration (like the Ensighten Bootstrap above), prefer it over delivery through GTM.

How consent blocking works

The Viewer itself does not gate its embeds or requests on consent — blocking is performed by your CMP’s client-side enforcement (auto-blocking), keyed on the domains listed above. In practice:

• Confirm with your CMP vendor that your deployment includes client-side enforcement, not only the banner UI. Without enforcement, requests (and their cookies) proceed regardless of what the banner shows.
• Pre-consent, a blocked video embed renders as a blank area — the Viewer does not display a “consent required” placeholder in its place.
• After the reader accepts, videos embedded on an already-built page may need a page refresh to appear. Enabling your CMP’s “reload page on consent” option gives the cleanest experience.
• If YouTube is categorized as Functional, videos will not play until the reader accepts Functional cookies — make sure that’s the experience you intend.

Pre-launch checklist

1. Whitelist the Joomag cookies above as Strictly Necessary, and allow *.joomag.com, the Adobe Fonts domains, and the Sentry domains as essential services.
2. Categorize youtube.com (and vimeo.com, if used) in your cookie manager.
3. Configure your banner’s injection point on the publication (GTM container or Ensighten Bootstrap URL).
4. Test on the live publication URL on your domain — not only on your main website — and verify both the pre-consent and post-consent states, including video playback.
5. Ask your Joomag contact for a joint test if anything looks off — we’re happy to verify from our side.