Week 3 GA 4 Audit Series- Privacy-First Analytics - GDPR, Consent Mode, and Staying Compliant Without Killing Conversions

<!-- Consent Mode: Default State (Deny All) --><script>  // Define dataLayer and gtag function  window.dataLayer = window.dataLayer || [];  function gtag(){dataLayer.push(arguments);}
  // Set default consent to 'denied' (most privacy-friendly)  gtag('consent', 'default', {
    'ad_storage': 'denied',    'ad_user_data': 'denied',    'ad_personalization': 'denied',    'analytics_storage': 'denied',    'functionality_storage': 'denied',    'personalization_storage': 'denied',    'security_storage': 'granted',  // Usually always granted    'wait_for_update': 500  // Wait 500ms for consent choice  });  // Optional: Region-specific defaults (all EU countries)  gtag('consent', 'default', {
    'ad_storage': 'denied',    'ad_user_data': 'denied',    'ad_personalization': 'denied',    'analytics_storage': 'denied',    'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE','IT','LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE']
  });  // For US (California - CCPA), you might use different defaults  gtag('consent', 'default', {
    'ad_storage': 'granted',  // Unless user opts out    'analytics_storage': 'granted',    'region': ['US-CA']
  });</script><!-- THEN load GA4 --><script async src="<https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX>"></script><script>  gtag('js', new Date());  gtag('config', 'G-XXXXXXXXXX');</script>

<div id="cookieConsent" class="cookie-banner">  <div class="cookie-content">    <h3>🍪 Cookie Preferences</h3>    <p>We use cookies to improve your experience. Choose your preferences:</p>    <div class="cookie-options">      <label>        <input type="checkbox" id="analytics-cookies" checked>        <strong>Analytics Cookies</strong>        <span>Help us understand how you use our site</span>      </label>      <label>        <input type="checkbox" id="marketing-cookies">        <strong>Marketing Cookies</strong>        <span>Enable personalized ads and content</span>      </label>    </div>    <div class="cookie-buttons">      <button onclick="acceptAllCookies()">Accept All</button>      <button onclick="acceptSelectedCookies()">Save Preferences</button>      <button onclick="rejectAllCookies()">Reject All</button>    </div>    <a href="/privacy-policy" class="cookie-policy-link">Privacy Policy</a>  </div></div><style>  .cookie-banner {
    position: fixed;    bottom: 0;    left: 0;    right: 0;    background: #fff;    padding: 20px;    box-shadow: 0 -2px 10px rgba(0,0,0,0.1);    z-index: 9999;    display: none;  }
  .cookie-banner.show {
    display: block;  }
  .cookie-content {
    max-width: 1200px;    margin: 0 auto;  }
  .cookie-options {
    margin: 15px 0;  }
  .cookie-options label {
    display: block;    margin: 10px 0;    cursor: pointer;  }
  .cookie-buttons {
    margin-top: 15px;  }
  .cookie-buttons button {
    padding: 10px 20px;    margin-right: 10px;    border: none;    border-radius: 4px;    cursor: pointer;  }
  .cookie-buttons button:first-child {
    background: #4285f4;    color: white;  }
</style>

// Show banner if user hasn't made a choicewindow.addEventListener('load', function() {
  var consentChoice = localStorage.getItem('cookie_consent');  if (!consentChoice) {
    document.getElementById('cookieConsent').classList.add('show');  } else {
    // Apply saved consent    applySavedConsent(consentChoice);  }
});// Accept all cookiesfunction acceptAllCookies() {
  gtag('consent', 'update', {
    'ad_storage': 'granted',    'ad_user_data': 'granted',    'ad_personalization': 'granted',    'analytics_storage': 'granted'  });  localStorage.setItem('cookie_consent', 'all');  localStorage.setItem('cookie_consent_date', new Date().toISOString());  hideBanner();  // Optional: Track consent given  gtag('event', 'consent_given', {
    'consent_type': 'all'  });}
// Accept only selected cookiesfunction acceptSelectedCookies() {
  var analyticsAccepted = document.getElementById('analytics-cookies').checked;  var marketingAccepted = document.getElementById('marketing-cookies').checked;  gtag('consent', 'update', {
    'analytics_storage': analyticsAccepted ? 'granted' : 'denied',    'ad_storage': marketingAccepted ? 'granted' : 'denied',    'ad_user_data': marketingAccepted ? 'granted' : 'denied',    'ad_personalization': marketingAccepted ? 'granted' : 'denied'  });  var consentType = analyticsAccepted && marketingAccepted ? 'all' :                    analyticsAccepted ? 'analytics_only' :                    marketingAccepted ? 'marketing_only' : 'none';  localStorage.setItem('cookie_consent', consentType);  localStorage.setItem('cookie_consent_date', new Date().toISOString());  hideBanner();  gtag('event', 'consent_given', {
    'consent_type': consentType
  });}
// Reject all cookiesfunction rejectAllCookies() {
  gtag('consent', 'update', {
    'ad_storage': 'denied',    'ad_user_data': 'denied',    'ad_personalization': 'denied',    'analytics_storage': 'denied'  });  localStorage.setItem('cookie_consent', 'none');  localStorage.setItem('cookie_consent_date', new Date().toISOString());  hideBanner();  gtag('event', 'consent_given', {
    'consent_type': 'none'  });}
// Apply saved consent on page loadfunction applySavedConsent(choice) {
  switch(choice) {
    case 'all':      gtag('consent', 'update', {
        'ad_storage': 'granted',        'ad_user_data': 'granted',        'ad_personalization': 'granted',        'analytics_storage': 'granted'      });      break;    case 'analytics_only':      gtag('consent', 'update', {
        'analytics_storage': 'granted',        'ad_storage': 'denied',        'ad_user_data': 'denied',        'ad_personalization': 'denied'      });      break;    case 'none':      gtag('consent', 'update', {
        'ad_storage': 'denied',        'ad_user_data': 'denied',        'ad_personalization': 'denied',        'analytics_storage': 'denied'      });      break;  }
}
function hideBanner() {
  document.getElementById('cookieConsent').classList.remove('show');}
// Allow users to change preferences laterfunction showCookiePreferences() {
  document.getElementById('cookieConsent').classList.add('show');  // Pre-select current preferences  var currentConsent = localStorage.getItem('cookie_consent');  if (currentConsent === 'all' || currentConsent === 'analytics_only') {
    document.getElementById('analytics-cookies').checked = true;  }
  if (currentConsent === 'all' || currentConsent === 'marketing_only') {
    document.getElementById('marketing-cookies').checked = true;  }
}

<!-- In your website footer --><footer>  <a href="#" onclick="showCookiePreferences(); return false;">    Cookie Preferences
  </a>  <a href="/privacy-policy">Privacy Policy</a></footer>

// ❌ BAD: Raw emailgtag('set', 'user_properties', {
  'email': '[email protected]'  // NEVER DO THIS});// ✅ GOOD: Hashed user IDgtag('set', 'user_properties', {
  'user_id': 'user_abc123',  // Hashed or database ID  'customer_segment': 'premium'});

// ✅ These are OKgtag('set', 'user_properties', {
  'user_type': 'customer',           // Category  'subscription_tier': 'pro',        // Category  'age_range': '25-34',              // Range, not exact age  'location_city': 'New York',       // City OK, not street address  'industry': 'technology',          // Professional category  'company_size': '50-200'           // Range});

Step 1: Check User Properties
- Admin → Custom Definitions → Custom Dimensions
- Review each dimension name
- Flag any that might contain PII

Step 2: Check Event Parameters
- Admin → Events → Modify event
- Review parameter names
- Common violations:
  - "user_email"
  - "phone_number"
  - "customer_name"
  - "billing_address"

Step 3: Check URL Parameters
- Reports → Engagement → Pages and screens
- Look at page_location values
- Check for:
  - Emails in URLs ([email protected])
  - Names in URLs (/profile/john-smith)
  - Phone numbers in URLs

Step 4: Use DebugView
- Enable debug mode
- Trigger events
- Inspect all parameters
- Look for accidental PII inclusion

## Analytics and CookiesWe use Google Analytics 4 to understand how visitors use our website.
**What We Collect:**
- Pages you visit
- How long you stay
- What you click on
- Device type and browser
- General location (city/country level)
**What We DON'T Collect:**
- Your name or email address
- Your exact location
- Sensitive personal information
**Your Choices:**
You can:
- Opt out of analytics cookies (click Cookie Preferences)
- Request deletion of your data (email [email protected])
- Export your data (email [email protected])
**Data Retention:**
We retain your data for 14 months, then it's automatically deleted.
**Third Parties:**
Your data is processed by:
- Google LLC (analytics)
- [List other services]**Your Rights:**
Under GDPR, you have the right to:
- Access your data
- Delete your data
- Export your data
- Object to processing

<!-- Footer link required by CCPA --><footer>  <a href="/do-not-sell">Do Not Sell My Personal Information</a>  <a href="/privacy-policy">Privacy Policy</a></footer>

<h1>Do Not Sell My Personal Information</h1><p>Under the California Consumer Privacy Act (CCPA), you have the right to opt out of the sale of your personal information.</p><button onclick="optOutOfDataSales()">Opt Out</button><script>function optOutOfDataSales() {
  // Deny all ad-related consent  gtag('consent', 'update', {
    'ad_storage': 'denied',    'ad_user_data': 'denied',    'ad_personalization': 'denied'  });  localStorage.setItem('ccpa_opt_out', 'true');  alert('You have opted out of data sales.');}
</script>

1. Admin → Data Display → Reporting Identity
2. Select: Blended (uses modeling)
3. ✅ Include all available data

1. Clear cookies and localStorage
2. Visit your site
3. Check: Cookie banner appears?
4. Click "Reject All"
5. Open DevTools → Network tab
6. Filter for "collect"
7. Check: No GA4 requests should fire (or only ping requests)
8. Now click "Accept All"
9. Check: GA4 requests now fire normally

1. Enable debug mode
2. Test with consent denied
3. Check events in DebugView
4. Should see: Limited data or no events
5. Accept consent
6. Check: Full events now appear

1. Google Ads → Tools → Conversions
2. Check imported GA4 conversions
3. Should see: Conversions still tracking (via modeling)
4. Check audience building still works

// Already included in the code abovegtag('event', 'consent_given', {
  'consent_type': 'all' // or 'analytics_only', 'none'});// View in GA4:// Reports → Events → consent_given// Add: event_parameter (consent_type)// Typical benchmarks:// - Accept All: 40-60%// - Analytics Only: 10-20%// - Reject All: 30-40%