# Website analytics evidence

Implementation date: 19 October 2026. Production verification is recorded separately in `ANALYTICS_IMPLEMENTATION_REPORT.md`; this document is not a deployment claim.

The implementation deliberately uses affirmative, separate consent for first-party analytics and optional Google Analytics rather than assuming that cookie-free collection is exempt. The ICO's April 2026 guidance includes a statistical-purposes exception with conditions; the implementation does not rely on that exception, particularly for third-party Google processing. Consent preferences remain accessible on every instrumented public page. GPC, DNT and owner exclusion suppress transmission before events are queued. Unknown/missing choices mean no collection. Preferences expire after 180 days. No consent event is itself transmitted before consent.

First-party events use strict route, event, campaign and property allowlists, not arbitrary URLs, text or errors. Session storage contains a random tab activity token after consent only; server storage contains its hash. It expires logically after 30 minutes of inactivity and is removed on withdrawal. There is no cross-tab/person identifier. Returning activity means only a session after previous activity in the same tab. IP addresses and user-agent strings are not retained by the collector; a short-lived rotating network HMAC enforces request limits. Host access/security logs remain a separate operational responsibility.

The private PHP dashboard and aggregate API enforce server-side password and session authentication over HTTPS (with optional HTTP Basic where supported), with password hashes held outside the document root. There is no client-side password gate. Databases and configuration must be outside the public root. The service fails closed when prerequisites are missing. Records are deleted after 180 days, with a daily cron required to enforce timely deletion even without requests; otherwise expiry is applied on the next maintenance/service access. Operator-managed backups require restricted access and a maximum 30-day expiry. The owner must verify hosting location, processor agreements, deletion and backup policies; these have not been inferred from the presence of PHP.

Google is disabled by default and requires a real GA4 Measurement ID, account privacy settings and separate visitor consent. Only after consent does the official Google tag load. Its use is the explicit Google integration requested by the owner; no other external analytics SDK is included. Automatic enhanced measurement must be disabled in the Google property. Manual page locations are sanitised; referrers are empty and ads consent remains denied. No advanced-consent-mode cookieless pings are intentionally sent. Withdrawal sets the GA disable switch, removes accessible GA cookies and reloads to remove loaded code. `GOOGLE_ANALYTICS_SETUP.txt` gives the account task.

Download clicks measure consented intent at the actual confirmation action. Cancellation is a separate event. Checksums and portable ZIPs are excluded from installer metrics. Version labels come from the manifests and validated archived installer links; Debian's published filename and manifest version differ and both are retained accurately. Direct static URLs, HTTP range handling and old release redirects remain in place. No raw log pipeline is connected, so server transfers, completed downloads, installations and exact unique visitors are explicitly unavailable. The dashboard does not convert intent into any of those claims.

Sources supporting the consent and Google design:

- [ICO storage and access technologies guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/), updated 29 April 2026.
- [Google consent mode](https://developers.google.com/tag-platform/security/guides/consent).
- [Google manual page views](https://developers.google.com/analytics/devguides/collection/ga4/views).

This evidence describes controls and remaining operational work. It is not legal advice, regulator approval or certification.