jeremy aa3dd9f1fb Add privacy policy page and cookie consent banner ...

The site was loading Google Analytics 4 unconditionally with no consent
gate — non-essential cookies set before consent (PECR reg. 6), and no
privacy policy was published at all.

- Add /privacy — full Privacy and Cookie Policy from tinqs/legal,
  styled with the site's existing design tokens, no tracking on the page
- Gate GA4 behind opt-in consent (consent.js / consent.css); nothing
  loads until the visitor accepts, and declining clears any _ga cookies
- Add Privacy Policy + Cookie Settings links to the footer, patched in
  the footer component so they survive React hydration
- Cookie Settings reopens the banner so consent can be withdrawn as
  easily as it was given (UK GDPR Art. 7(3))
- Add /privacy to sitemap.xml

Verified with Playwright: zero googletagmanager requests before consent,
GA loads only after Accept, choice persists across reloads, withdrawal
works, no horizontal scroll on mobile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-09-11 14:24:17 -07:00

33 KiB

Preview Source Fullscreen

Raw Blame History