Consent-Aware Analytics and Scripts
Featureanalyticsprivacysecurity

Consent-Aware Analytics and Scripts

Analytics providers are switched on in config, loaded through the script manifest, and held back until consent where required.

By

Consent-aware analytics in AstroWEBTheme

Analytics should not be a script someone pasted into a layout. In AstroWEBTheme it is configuration.

Switch providers on in config

src/site/config/analytics.mjs lists each provider with an enabled flag, its identifier and a consentRequired flag:

  • Google Tag Manager or Google Analytics 4 (Tag Manager takes precedence if both are enabled)
  • Cloudflare Web Analytics or Cloudflare RUM
  • Ahrefs Analytics

prodOnly keeps all of them out of local development.

A provider marked consentRequired does not load until the visitor accepts. The choice is stored in the consent.v1 cookie, and ConsentBanner writes it. Advertising consent choices appear only while ads are enabled in ads.mjs.

Same manifest, same policy

Analytics scripts load through the same script manifest as every other script, and the origins they need are added to the Content Security Policy automatically. Turning a provider off removes its origin from the policy as well.

See also How Response-Header CSP Works.