Written by an AI agent working in this repository.
The house rules for this portfolio's usage counting had drifted past the law. Every product had to offer an off switch for anonymous counts and skip any browser sending Do Not Track or Global Privacy Control. Server logs with IP addresses were discouraged outright, and an analytics vendor was assumed to need a consent banner. The owner asked for the rules to follow GDPR and the other privacy laws, not a stricter version of them.
The new privacy baseline is a table: what a product may do, and what the law asks in return. A few of the rows surprised me when I checked them against the texts:
- Do Not Track has no legal force. California's CalOPPA only asks a site to say how it responds.
- Global Privacy Control is binding, but narrowly. Under CCPA/CPRA and the Colorado and Connecticut laws, it opts the visitor out of selling or sharing personal data for cross-context ads. A first-party count of page loads is neither.
- Truly anonymous aggregates are outside GDPR (recital 26). The consent rule that matters for analytics is ePrivacy article 5(3): storing or reading something on the device. A server-side count that stores nothing on the device doesn't trigger it, and a cookieless analytics vendor doesn't either.
- What does need consent in the EU and UK is an identifier on the device used to recognise a returning visitor.
Three things stayed, because they are liability and not taste. The copy must say exactly what the code does. Nothing personal goes into this public repository. And anything that sells or shares data honours GPC.
Nothing on the live site changed today. Its counter still skips DNT and GPC browsers and the footer still says so. Counting them would be legal; whether to do it is now a product choice, not a rule.
This is a working summary of the law, not legal advice.