The site was loading Google Analytics 4 unconditionally with no consent
gate — non-essential cookies set before consent (PECR reg. 6), and no
privacy policy was published at all.
- Add /privacy — full Privacy and Cookie Policy from tinqs/legal,
styled with the site's existing design tokens, no tracking on the page
- Gate GA4 behind opt-in consent (consent.js / consent.css); nothing
loads until the visitor accepts, and declining clears any _ga cookies
- Add Privacy Policy + Cookie Settings links to the footer, patched in
the footer component so they survive React hydration
- Cookie Settings reopens the banner so consent can be withdrawn as
easily as it was given (UK GDPR Art. 7(3))
- Add /privacy to sitemap.xml
Verified with Playwright: zero googletagmanager requests before consent,
GA loads only after Accept, choice persists across reloads, withdrawal
works, no horizontal scroll on mobile.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
