[Bug]: Marketing consent does not change to false in API callback (causes GDPR violation)

[nbolton]

What happened?

When a returning customer has previously opted in to marketing, but then opts out, the correct value is not reflected in the API webhook data (it's true instead of false).

I'm not sure if this is a bug in the JS front-end library or the Node back end library. The bug seems to present in the API, so that's why I'm raising it here. Let me know if I need to raise it in the JS library instead (would that be the PaddleHQ/paddle-js-wrapper repo?)

    "@paddle/paddle-js": "~1.6.2",
    "@paddle/paddle-node-sdk": "~3.6.1",

Steps to reproduce

Where notification: CustomerNotification

1. Pass customer: { email: customerEmail }, to paddle.Checkout.open
2. Open checkout modal
3. Opt in to marketing and click "Continue"
4. Wait for EventName.CustomerCreated webhook
5. See that notification.marketingConsent is true
6. Refresh the page
7. Open checkout modal
8. Uncheck the marketing consent in the modal
9. Click "Continue"
10. Wait for EventName.CustomerUpdated

What did you expect to happen?

Expected: notification.marketingConsent is false (it was unchecked in the modal)

Actual: notification.marketingConsent is true

Workaround:

1. On the modal click "Your details" to go back to the first screen
2. Notice how the opt-in is re-checked (suggesting maybe this actually is a bug in the JS modal)
3. Un-check the marketing consent checkbox a 2nd time
4. Click "Continue"
5. Wait for EventName.CustomerUpdated
6. The notification.marketingConsent is true