Skip to content

Add Google Analytics 4, and make the privacy page true again - #88

Merged
fosterwei merged 1 commit into
mainfrom
feat/ga4
Oct 8, 2026
Merged

fosterwei merged 1 commit into
mainfrom
feat/ga4

Conversation

@fosterwei

Copy link
Copy Markdown
Owner

Deploys G-WNMRQE3MLF, and rewrites the privacy page, which this change made false.

The tag

Rendered exactly as Google ships it: an async loader plus a 142-byte inline snippet, on all 64 built pages including the 404. is:inline on both keeps Astro from bundling them, which would inline the loader into a module and change how it fetches.

The measurement id lives in lib/site.ts with the other site-wide constants. Setting it empty disables the tag, so a fork or a local build does not report into someone else's property.

The part that mattered more

The privacy page said three things that became false the moment this shipped, and a fourth that was about to:

Claim Status after the tag
"no analytics or advertising script" false
"set no cookies" false
"run no tracking code" false
"the site does not use browser storage" false

On a site whose entire claim is that every statement can be checked against the source, shipping the tag without rewriting that page would have been the worst thing in this commit.

The page now names the property, says what Analytics records, names both cookies (_ga and _ga_WNMRQE3MLF) and what they do, states that Google derives a coarse location from the IP and does not store the address, and gives three ways to refuse: blocking the host, Google's opt-out add-on, clearing cookies. It says plainly that refusing costs the reader nothing and costs us accuracy. The calculators are called out separately, because the numbers typed into them still go nowhere.

New CI rule

If any page carries a known analytics host, the privacy page must use the word, mention cookies, and contain none of the stale denials.

Injected fault Caught
Privacy page reverted to old wording yes, both reasons named
Privacy page deleted yes

Performance

One async request to googletagmanager.com, not render-blocking, plus 142 bytes inline. That is the site's only third-party script host.

Worth a decision, not blocking this

GA4 sets cookies before any consent is collected. There is no consent banner on the site. If meaningful traffic comes from the EU or UK, that is a compliance gap rather than a technical one, and the honest options are a consent banner, a cookieless analytics tool, or accepting the exposure. Say which and I will implement it.

Gates

Content validation (59 records), registry check, 36 drafter tests, 17 calculator tests, loop gate 47/47, all eight link rules.

🤖 Generated with Claude Code

The tag is G-WNMRQE3MLF, rendered exactly as Google ships it: an async
loader and a 142-byte inline snippet, on all 64 built pages including
the 404. `is:inline` on both keeps Astro from bundling them, which would
inline the loader into a module and change how it fetches.

The measurement id lives in lib/site.ts with the other site-wide
constants. Empty disables the tag, so a fork or a local build does not
report into someone else's property.

The privacy page said three things that this change made false:
"no analytics or advertising script", "set no cookies", and "run no
tracking code". A fourth, "the site does not use browser storage", was
about to be. On a site whose entire claim is that every statement can be
checked, shipping the tag without rewriting that page would have been
the worst thing in this commit.

It now names the property, says what Analytics records, names both
cookies it sets and what they are for, states that Google derives a
coarse location from the IP address and does not store the address, and
gives three ways to refuse it: blocking the host, Google's own opt-out
add-on, and clearing cookies. It says plainly that refusing costs the
reader nothing and costs us accuracy. The calculators are called out
separately because the numbers typed into them still go nowhere.

check_links.py gains an eighth rule. If any page carries a known
analytics host, the privacy page must use the word, mention cookies, and
not contain any of the stale denials. Verified by reverting the page's
wording, which is caught with both reasons named, and by deleting the
page, which is also caught.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@vercel

vercel Bot commented Oct 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
research-reference Ready Ready Preview Oct 8, 2026 5:42am UTC

@fosterwei
fosterwei merged commit a7d12f4 into main Oct 8, 2026
5 checks passed

This branch was successfully deployed

1 active deployment
Preview — ed1be303 Deployed Oct 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant