The site already honoured Global Privacy Control (GPC) and Do Not Track (DNT) in two places.
site-analytics.js never loads the Meta pixel or Microsoft Clarity when the browser sends either
signal, and the Worker refuses to forward an event to Meta when a request carries the Sec-GPC
or DNT header. The only place a visitor could learn that was the privacy policy.
What visitors see
Under the name in every page’s footer, a shield and one sentence describe that visitor’s own browser:
- With GPC: “Your browser sends Global Privacy Control, so analytics are off for this visit.” The shield turns green and shows a check.
- With DNT and no GPC: the same sentence, naming Do Not Track.
- With neither: “Your browser sends no privacy signal. Turn on Global Privacy Control to switch analytics off.”
Each sentence links to the “Your choices” section of the privacy policy. Without JavaScript the footer says only that the site respects both signals, because the page cannot see the browser’s setting until a script runs.
How it is connected
site-v18.js reads navigator.globalPrivacyControl and navigator.doNotTrack, which are the
values site-analytics.js checks before it loads anything. So the sentence and the analytics
decision come from the same source. The three sentences are written once, in
src/lib/site-chrome.ts, and carried on the footer as data attributes, so every page shows the
same wording. That includes the home page, articles, project guides and the error page.
Verification
tools/test-site-chrome.mjschecks every built page for the three sentences, the general sentence and the link to/privacy/#choices.tools/test-privacy-signal.mjs, now part ofnpm run test:browser, loads one page of every kind with GPC on, with DNT on, with neither, and with JavaScript off, and checks the state and sentence each time: 19 checks across 6 routes. Chrome has no GPC setting, so the signal is put in place before the page’s scripts run.