Why
The Google Analytics script is loaded in <head> before any user interaction, and the only opt-out mechanism (respectDNT: true) relies on a browser signal that Chrome has removed and Firefox has deprecated, leaving visitors with no practical way to avoid being tracked.
Current state
gatsby-config.js line 89: head: true causes the GA script to load as early as possible — before the page becomes interactive and before any opt-out UI can be displayed. respectDNT: true was the intended privacy guard, but Chrome removed DNT support in 2024 and Firefox has removed it by default. In practice, respectDNT: true no longer prevents tracking for the majority of visitors.
Ideal state
- The GA script is either deferred until after explicit user consent (e.g. via a consent banner), or
head: true is changed to head: false and the script is gated behind an opt-in interaction before it fires.
- The chosen approach is documented in a comment in
gatsby-config.js.
Out of scope
- Removing GA entirely (addressed in a companion issue about consent mechanisms).
- Migrating to GA4.
Starting points
gatsby-config.js — line 89: the head: true option.- Any existing cookie/consent component in
src/ — to understand what infrastructure exists for deferred script loading.
QA plan
- Change
head: true to head: false (or remove the option) and add a consent mechanism.
- Open the deployed site in a browser with network tab open — confirm no request to
google-analytics.com fires on initial page load.
- Trigger the opt-in interaction — confirm the GA request fires only after consent.
Done when
The Google Analytics script does not fire on page load without a prior user interaction that acknowledges tracking.
Why
The Google Analytics script is loaded in
<head>before any user interaction, and the only opt-out mechanism (respectDNT: true) relies on a browser signal that Chrome has removed and Firefox has deprecated, leaving visitors with no practical way to avoid being tracked.Current state
gatsby-config.jsline 89:head: truecauses the GA script to load as early as possible — before the page becomes interactive and before any opt-out UI can be displayed.respectDNT: truewas the intended privacy guard, but Chrome removed DNT support in 2024 and Firefox has removed it by default. In practice,respectDNT: trueno longer prevents tracking for the majority of visitors.Ideal state
head: trueis changed tohead: falseand the script is gated behind an opt-in interaction before it fires.gatsby-config.js.Out of scope
Starting points
gatsby-config.js— line 89: thehead: trueoption.src/— to understand what infrastructure exists for deferred script loading.QA plan
head: truetohead: false(or remove the option) and add a consent mechanism.google-analytics.comfires on initial page load.Done when
The Google Analytics script does not fire on page load without a prior user interaction that acknowledges tracking.