You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
src/components/Metadata.tsx renders <link rel="preconnect" href="https://www.google-analytics.com" /> unconditionally on every page load. This initiates a DNS lookup and TCP/TLS handshake with Google's analytics infrastructure before any user interaction — leaking the visitor's IP address and browser fingerprint to Google regardless of whether the visitor consents to tracking. This bypasses any consent gate that would be added to defer the GA script itself.
Ideal state
The preconnect tag is absent from the default render, or is injected only by the same consent gate that controls the GA script load.
No connection to google-analytics.com is initiated on a page load before the user has had the opportunity to consent.
Open the site in a browser with the Network tab open — confirm no DNS request or TCP connection to google-analytics.com fires on initial page load before any interaction.
Current state
src/components/Metadata.tsxrenders<link rel="preconnect" href="https://www.google-analytics.com" />unconditionally on every page load. This initiates a DNS lookup and TCP/TLS handshake with Google's analytics infrastructure before any user interaction — leaking the visitor's IP address and browser fingerprint to Google regardless of whether the visitor consents to tracking. This bypasses any consent gate that would be added to defer the GA script itself.Ideal state
google-analytics.comis initiated on a page load before the user has had the opportunity to consent.Out of scope
<head>with no consent gate —respectDNTis no longer effective in most browsers #226).<script>load timing — that is covered in GA script loaded in<head>with no consent gate —respectDNTis no longer effective in most browsers #226.Starting points
src/components/Metadata.tsx— line 24:<link rel="preconnect" href="https://www.google-analytics.com" /><head>with no consent gate —respectDNTis no longer effective in most browsers #226 — the preconnect should be gated identically to the scriptQA plan
google-analytics.comfires on initial page load before any interaction.<head>with no consent gate —respectDNTis no longer effective in most browsers #226 is in place, confirm the preconnect fires only after the consent event.<head>— expect nopreconnecttag targetinggoogle-analytics.comin the initial HTML.Done when
No connection to
google-analytics.comis initiated on page load before the user has had the opportunity to consent to analytics.