Why
The Google Analytics script fires on every page load for every visitor with no consent gate, meaning visitor behaviour data is sent to Google's servers before visitors have a chance to opt out — an issue separate from where the tracking ID is stored.
Current state
gatsby-config.js line 88–93:
{
resolve: 'gatsby-plugin-google-analytics',
options: {
trackingId: 'UA-9710963-7',
head: true,
respectDNT: true,
},
}head: true loads the GA script in <head>, firing before the page is interactive. respectDNT: true only skips tracking if the browser sends DNT: 1, which most modern browsers no longer do by default. There is no cookie banner, consent modal, or opt-in mechanism anywhere in the codebase.
Ideal state
- Visitor data is not sent to Google Analytics until the visitor has been informed and has had the opportunity to opt out (or, for stricter compliance, affirmatively opted in).
- Alternatively, Google Analytics is replaced with a privacy-preserving analytics provider (e.g. Plausible, Fathom) that does not require consent under most privacy laws.
- A privacy policy page explains what data is collected and sent to Google.
Out of scope
Starting points
gatsby-config.js — the gatsby-plugin-google-analytics configuration block.- Any existing privacy policy or terms page in the site content.
QA plan
- Open the deployed site in a browser — confirm no GA network request fires before any user interaction.
- If a consent banner is added, accept it — confirm GA fires after consent.
- If GA is replaced with a privacy-preserving alternative, confirm the replacement loads correctly and no request to
google-analytics.com or googletagmanager.com fires.
Done when
No visitor data is sent to Google Analytics on page load without prior opportunity for the visitor to opt out.
Why
The Google Analytics script fires on every page load for every visitor with no consent gate, meaning visitor behaviour data is sent to Google's servers before visitors have a chance to opt out — an issue separate from where the tracking ID is stored.
Current state
gatsby-config.jsline 88–93:head: trueloads the GA script in<head>, firing before the page is interactive.respectDNT: trueonly skips tracking if the browser sendsDNT: 1, which most modern browsers no longer do by default. There is no cookie banner, consent modal, or opt-in mechanism anywhere in the codebase.Ideal state
Out of scope
Starting points
gatsby-config.js— thegatsby-plugin-google-analyticsconfiguration block.QA plan
google-analytics.comorgoogletagmanager.comfires.Done when
No visitor data is sent to Google Analytics on page load without prior opportunity for the visitor to opt out.