From ded027fef9dd26a04044156ad6ff379558057dac Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 17:31:26 -0700
Subject: [PATCH 1/6] feat(site): ask for analytics consent instead of
 measuring nothing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This file argued that a banner asking permission to do something the site
does not need to do would be the failure this product refuses elsewhere,
and loaded gtag on every page in Consent Mode's denied state instead. The
argument was right about banners and wrong about what it bought. Denied
mode still sent a hit for every page view; it sent one with no stable
client id, so every view arrived as a new user in a new session. The site
shipped Google's tag to every reader and got numbers in which users,
sessions, bounce rate and returning readers were all noise — and nothing
in the reports said so. Refusing to ask is only principled when the answer
is that nothing is collected, and something was.

Nothing is loaded now until measurement is allowed, and when it loads the
consent it was denied is granted, so the identifier exists and the
sessions are real.

The question is asked only of the readers who are owed it. The EEA, the UK
and the Crown Dependencies require permission; elsewhere measurement may
run with a way to turn it off. Cloudflare already knows which applies and
says so at `/cdn-cgi/trace`, so most readers are measured properly and
never see a banner. A failed lookup asks — the safe direction, and what a
build outside Cloudflare gets.

Do Not Track and Global Privacy Control keep the position they had, and
now sit above the site's own controls too: a reader who has answered this
in their browser is not asked again and is not measured either way.

Withdrawal is the half that is easy to leave out, so a new `/privacy` page
carries a standing control that states what is currently happening before
offering the buttons, and declining actually revokes: it sets the
`ga-disable-` flag, pushes consent back to denied, and deletes the cookies
acceptance set. That page is linked from the row that ends every
documentation page as well as from the site footer, because outside the
prompt regions no banner appears and the footer renders on splash pages
alone — an opt-out only reachable from the landing page is not reachable.

The query string was already dropped from the recorded location; the
referrer is now reduced to its origin for the same reason, and the
injected tag states its own referrer policy rather than inheriting the
browser's default.

`privacy` joins ORDER in both llms.txt generators, which otherwise fail
the build rather than let a section go silently unindexed.

Ported from labstack/fanout#219, including the four fixes that landed
there after review.

Claude-Session: https://claude.ai/code/session_0188fRgp2DyMXzUcJgdMZSyu
---
 site/src/components/Analytics.astro           | 319 +++++++++++++++---
 site/src/components/AnalyticsConsent.astro    | 148 ++++++++
 site/src/components/AnalyticsPreference.astro | 164 +++++++++
 site/src/components/Footer.astro              |  17 +
 site/src/components/PageFrame.astro           |   2 +
 site/src/components/SiteFooter.astro          |   2 +
 site/src/content/docs/privacy.mdx             |  90 +++++
 site/src/pages/llms-full.txt.ts               |   2 +-
 site/src/pages/llms.txt.ts                    |   3 +-
 9 files changed, 700 insertions(+), 47 deletions(-)
 create mode 100644 site/src/components/AnalyticsConsent.astro
 create mode 100644 site/src/components/AnalyticsPreference.astro
 create mode 100644 site/src/content/docs/privacy.mdx

diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index a6393151..d9b6acb4 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -2,7 +2,7 @@
 // Google Analytics 4, on the terms this product argues for everywhere else.
 //
 // A documentation site for a tool whose pitch is "we do not silently claim
-// anything" cannot ship tracking that behaves like everyone else's. Four rules
+// anything" cannot ship tracking that behaves like everyone else's. Five rules
 // follow from that, and each is enforced here rather than left to a setting in
 // a console nobody in this repository can read:
 //
@@ -10,21 +10,42 @@
 //      That is the state for `npm run dev`, for `just check`, for CI, and for
 //      anyone who builds this site from a fork. Analytics belongs to whoever
 //      runs onebox.run, not to the source.
-//   2. Cookieless. `client_storage: "none"` keeps GA4 from writing `_ga`, which
-//      is what makes a consent banner necessary in the first place. Page views
-//      still count; returning readers are simply not re-identified. A banner
-//      asking permission to do something the site does not need to do would be
-//      the same failure this product refuses elsewhere.
+//   2. Nothing loads until measurement is allowed. Not the tag, not a request.
 //   3. No advertising signals. Google Signals and ad personalisation are off,
 //      so the traffic here is not joined to an advertising profile.
 //   4. Do Not Track and Global Privacy Control are honoured before the script
 //      loads, not after. A reader who has asked not to be measured generates no
-//      request to Google at all.
+//      request to Google at all, and is never asked the question either.
+//   5. Withdrawal works. The control on /privacy revokes what acceptance set.
 //
-// The query string is dropped from the recorded location. Documentation URLs
-// carry nothing sensitive today, but this repository's whole position on
-// secrets is that "nothing sensitive is in there today" is not a property you
-// get to assume — verifyURL redacts queries for exactly this reason.
+// Rule 2 replaces what this file used to do. It loaded gtag on every page and
+// then held it in Consent Mode's denied state, which was described here as
+// being cookieless — true, and the reason given was that a banner asking to do
+// something the site does not need to do would be the failure this product
+// refuses elsewhere. That argument was right about banners and wrong about what
+// it bought. Denied mode still sent a hit for every page view; it simply sent
+// one with no stable client id, so every view arrived as a new user in a new
+// session. The site shipped Google's tag to every reader and got numbers in
+// which users, sessions and returning readers were all noise. Refusing to ask
+// is only principled when the answer is that nothing is collected, and
+// something was.
+//
+// So the question is asked, but only of the readers who are owed it. The EEA,
+// the UK and the Crown Dependencies require permission before an analytics
+// identifier is stored; elsewhere measurement may run with a way to turn it
+// off. Cloudflare already knows which applies and says so at /cdn-cgi/trace, so
+// most readers are measured properly and never see a banner. A failed or
+// unavailable lookup asks — the safe direction, and what a build outside
+// Cloudflare gets.
+//
+// The query string is dropped from the recorded location, and the referrer is
+// reduced to its origin. Documentation URLs carry nothing sensitive today, but
+// this repository's whole position on secrets is that "nothing sensitive is in
+// there today" is not a property you get to assume — verifyURL redacts queries
+// for exactly this reason.
+//
+// The preference lives in localStorage rather than a cookie, so declining
+// stores nothing that travels with a request, and is mirrored across tabs.
 //
 // The script body below is written as the element's plain text content, with no
 // `{...}` expression and no backticks around it. Astro treats script children as
@@ -59,49 +80,257 @@ const enabled = Boolean(measurementId) && import.meta.env.PROD;
   enabled && (
     <script is:inline define:vars={{ measurementId }}>
       (function () {
+        var STORAGE_KEY = "onebox.analytics-consent.v1";
+        var PREFERENCE_EVENT = "onebox:analytics-preference";
+
+        // The EEA, the UK and the Crown Dependencies: the places that require
+        // permission before a browser stores an analytics identifier. A country
+        // this list does not name gets measurement with an opt-out instead.
+        var PRIOR_CONSENT = [
+          "AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE",
+          "GR", "HU", "IE", "IT", "LV", "LT", "LU", "MT", "NL", "PL", "PT",
+          "RO", "SK", "SI", "ES", "SE", "IS", "LI", "NO",
+          "GB", "GG", "IM", "JE",
+        ];
+
+        var memoryPreference = null;
+        var started = false;
+        var requirementPromise = null;
+
         // Asked not to be tracked, in any of the spellings a browser uses.
         // Firefox before 32 and Safari answered "yes" where everything modern
         // answers "1", and a reader who opted out on an older browser is
         // exactly the reader least willing to be measured. Checked before the
         // tag is inserted, so honouring the request means no request rather
         // than a discarded one.
-        var signals = [navigator.doNotTrack, window.doNotTrack, navigator.msDoNotTrack];
-        for (var i = 0; i < signals.length; i++) {
-          if (signals[i] === "1" || signals[i] === "yes") return;
+        function signalsRefusal() {
+          var flags = [navigator.doNotTrack, window.doNotTrack, navigator.msDoNotTrack];
+          for (var i = 0; i < flags.length; i++) {
+            if (flags[i] === "1" || flags[i] === "yes") return true;
+          }
+          return navigator.globalPrivacyControl === true;
         }
-        if (navigator.globalPrivacyControl === true) return;
-
-        window.dataLayer = window.dataLayer || [];
-        function gtag() { window.dataLayer.push(arguments); }
-        window.gtag = gtag;
-
-        // Consent Mode, declared before anything else, is what actually stops
-        // GA4 writing cookies. Passing `client_storage: "none"` to config does
-        // not: gtag does not recognise it there and forwards it as a custom
-        // event parameter, so every hit carried `ep.client_storage=none` while
-        // `_ga` and `_ga_<id>` were set anyway. Measured in a real browser, not
-        // assumed — the first version of this file claimed to be cookieless and
-        // was not.
-        gtag("consent", "default", {
-          analytics_storage: "denied",
-          ad_storage: "denied",
-          ad_user_data: "denied",
-          ad_personalization: "denied",
-        });
 
-        gtag("js", new Date());
-        gtag("config", measurementId, {
-          allow_google_signals: false,
-          allow_ad_personalization_signals: false,
-          // The path without its query string. See the note in the component
-          // source for why the query goes even though nothing secret is in it.
-          page_location: window.location.origin + window.location.pathname,
-        });
+        function readPreference() {
+          try {
+            var stored = window.localStorage.getItem(STORAGE_KEY);
+            return stored === "granted" || stored === "denied" ? stored : null;
+          } catch (_) {
+            // A locked-down browser throws on access rather than returning
+            // null. The in-memory answer still governs this page.
+            return memoryPreference;
+          }
+        }
+
+        function writePreference(preference) {
+          memoryPreference = preference;
+          try {
+            window.localStorage.setItem(STORAGE_KEY, preference);
+          } catch (_) {
+            // Storage is unavailable; the choice holds for this page only,
+            // which is the direction that does not weaken the gate.
+          }
+          apply();
+          window.dispatchEvent(new Event(PREFERENCE_EVENT));
+        }
+
+        function consentRequirementFor(country) {
+          if (!country || country === "XX" || country === "T1") return "required";
+          return PRIOR_CONSENT.indexOf(country) === -1 ? "not_required" : "required";
+        }
+
+        function consentRequirement() {
+          if (requirementPromise) return requirementPromise;
+          requirementPromise = window
+            .fetch("/cdn-cgi/trace", {
+              cache: "no-store",
+              credentials: "omit",
+              headers: { Accept: "text/plain" },
+            })
+            .then(function (response) {
+              if (!response.ok) throw new Error("trace " + response.status);
+              return response.text();
+            })
+            .then(function (trace) {
+              var match = trace.match(/^loc=([A-Z0-9]{2})$/m);
+              return consentRequirementFor(match ? match[1] : null);
+            })
+            .catch(function () {
+              return "required";
+            });
+          return requirementPromise;
+        }
+
+        function gtag() {
+          window.dataLayer.push(arguments);
+        }
+
+        function referrerOrigin() {
+          if (!document.referrer) return "";
+          try {
+            return new URL(document.referrer).origin;
+          } catch (_) {
+            return "";
+          }
+        }
+
+        function start() {
+          // Above the stored preference on purpose: a browser-level refusal is
+          // not overridden by a click on this site's own control.
+          if (signalsRefusal()) return;
 
-        var tag = document.createElement("script");
-        tag.async = true;
-        tag.src = "https://www.googletagmanager.com/gtag/js?id=" + encodeURIComponent(measurementId);
-        document.head.appendChild(tag);
+          window["ga-disable-" + measurementId] = false;
+
+          // Allowing after declining, without leaving the page. The tag is
+          // already loaded and must not be configured twice, but the state
+          // stop() left behind is exactly what has to be undone: clearing the
+          // disable flag above and re-granting here.
+          if (started) {
+            gtag("consent", "update", { analytics_storage: "granted" });
+            return;
+          }
+          started = true;
+
+          window.dataLayer = window.dataLayer || [];
+          window.gtag = gtag;
+
+          gtag("consent", "default", {
+            analytics_storage: "denied",
+            ad_storage: "denied",
+            ad_user_data: "denied",
+            ad_personalization: "denied",
+          });
+          // The tag exists only on the path where measurement is allowed, so
+          // this is the state it is created in rather than a later upgrade.
+          gtag("consent", "update", { analytics_storage: "granted" });
+          gtag("set", "ads_data_redaction", true);
+          gtag("js", new Date());
+          gtag("config", measurementId, {
+            allow_google_signals: false,
+            allow_ad_personalization_signals: false,
+            cookie_flags: "SameSite=Lax;Secure",
+            // The path without its query string, and the referring site
+            // without the rest of its URL. See the note in the component
+            // source for why the query goes even though nothing secret is in
+            // it.
+            page_location: window.location.origin + window.location.pathname,
+            page_referrer: referrerOrigin(),
+          });
+
+          var tag = document.createElement("script");
+          tag.async = true;
+          // Every current browser defaults to strict-origin-when-cross-origin,
+          // which already keeps the path and query out of the `Referer` on this
+          // request. Stating it means the guarantee this file makes about query
+          // strings is the file's own rather than one inherited from whatever
+          // default the reader's browser happens to ship.
+          tag.referrerPolicy = "strict-origin";
+          tag.src =
+            "https://www.googletagmanager.com/gtag/js?id=" + encodeURIComponent(measurementId);
+          document.head.appendChild(tag);
+        }
+
+        // Withdrawal has to actually remove what acceptance stored, or the
+        // control is a checkbox that lies. The disable flag stops a tag that is
+        // already on the page from sending anything further.
+        function stop() {
+          window["ga-disable-" + measurementId] = true;
+          if (window.gtag) {
+            window.gtag("consent", "update", {
+              analytics_storage: "denied",
+              ad_storage: "denied",
+              ad_user_data: "denied",
+              ad_personalization: "denied",
+            });
+          }
+          var names = ["_ga", "_ga_" + measurementId.replace(/^G-/, "")];
+          for (var i = 0; i < names.length; i++) {
+            document.cookie = names[i] + "=; Max-Age=0; Path=/; SameSite=Lax; Secure";
+            document.cookie =
+              names[i] +
+              "=; Max-Age=0; Path=/; Domain=." +
+              window.location.hostname +
+              "; SameSite=Lax; Secure";
+          }
+        }
+
+        function mayRun(requirement, preference) {
+          if (preference === "granted") return true;
+          return requirement === "not_required" && preference !== "denied";
+        }
+
+        function banner() {
+          return document.getElementById("ob-analytics-consent");
+        }
+
+        function apply() {
+          var preference = readPreference();
+          if (preference === "denied") {
+            stop();
+            var element = banner();
+            if (element) element.hidden = true;
+            return;
+          }
+          if (preference === "granted") {
+            start();
+            var accepted = banner();
+            if (accepted) accepted.hidden = true;
+            return;
+          }
+          consentRequirement().then(function (requirement) {
+            if (readPreference() !== null) return;
+            if (mayRun(requirement, null)) {
+              start();
+              return;
+            }
+            var prompt = banner();
+            if (prompt) prompt.hidden = false;
+          });
+        }
+
+        // The privacy page's control and the banner both drive the same state.
+        window.oneboxAnalytics = {
+          preference: readPreference,
+          setPreference: writePreference,
+          requirement: consentRequirement,
+          refused: signalsRefusal,
+          subscribe: function (onChange) {
+            window.addEventListener(PREFERENCE_EVENT, onChange);
+            window.addEventListener("storage", function (event) {
+              if (event.key === STORAGE_KEY) onChange();
+            });
+          },
+        };
+
+        function ready(run) {
+          if (document.readyState === "loading") {
+            document.addEventListener("DOMContentLoaded", run, { once: true });
+          } else {
+            run();
+          }
+        }
+
+        if (signalsRefusal()) {
+          // Neither measured nor asked. The banner stays in the document,
+          // hidden, so nothing depends on it having rendered.
+          ready(function () {
+            var element = banner();
+            if (element) element.hidden = true;
+          });
+          return;
+        }
+
+        ready(function () {
+          var element = banner();
+          if (element) {
+            element.addEventListener("click", function (event) {
+              var button = event.target instanceof Element && event.target.closest("button");
+              if (!button || !button.dataset.consent) return;
+              writePreference(button.dataset.consent);
+            });
+          }
+          apply();
+        });
       })();
     </script>
   )
diff --git a/site/src/components/AnalyticsConsent.astro b/site/src/components/AnalyticsConsent.astro
new file mode 100644
index 00000000..1d2d1b58
--- /dev/null
+++ b/site/src/components/AnalyticsConsent.astro
@@ -0,0 +1,148 @@
+---
+/* The consent prompt, for readers whose location requires one.
+ *
+ * Markup only. Analytics.astro decides whether this is ever shown and handles
+ * the clicks: the question of whether to ask is answered in the head, before
+ * anything renders, and putting the logic in two places is how the banner ends
+ * up shown to someone who already declined.
+ *
+ * It renders on every page rather than only where the site footer does, because
+ * a reader who arrives from a search result lands on a documentation page, and
+ * a consent prompt that only appears on the landing page asks the question of
+ * the wrong half of the audience.
+ *
+ * `hidden` in the source, not `display: none` in a stylesheet: the prompt is
+ * absent for the reader whose location does not require it and for the reader
+ * who has already answered, and neither should see it flash while a stylesheet
+ * loads. A build without a measurement id never renders it at all.
+ */
+const enabled =
+  Boolean(import.meta.env.PUBLIC_GA_MEASUREMENT_ID?.trim()) && import.meta.env.PROD;
+---
+
+{
+  enabled && (
+    <section
+      id="ob-analytics-consent"
+      class="ob-consent"
+      role="region"
+      aria-labelledby="ob-consent-title"
+      hidden
+    >
+      <div class="ob-consent-body">
+        <p id="ob-consent-title" class="ob-consent-title">Analytics on this site</p>
+        <p class="ob-consent-copy">
+          Onebox would like to count visits and which pages get read, using Google Analytics.
+          Nothing about the servers you deploy to is involved. <a href="/privacy">
+            What is collected
+          </a>.
+        </p>
+      </div>
+      <div class="ob-consent-actions">
+        <button type="button" class="ob-consent-button" data-consent="denied">
+          Do not allow
+        </button>
+        <button
+          type="button"
+          class="ob-consent-button ob-consent-button-primary"
+          data-consent="granted"
+        >
+          Allow
+        </button>
+      </div>
+    </section>
+  )
+}
+
+<style>
+  .ob-consent {
+    position: fixed;
+    z-index: calc(var(--sl-z-index-navbar) + 1);
+    inset-block-end: max(1rem, env(safe-area-inset-bottom));
+    inset-inline: 1rem;
+    margin-inline: auto;
+    max-width: 34rem;
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem 1.5rem;
+    padding: 1rem 1.15rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.6rem;
+    background: var(--sl-color-black);
+    box-shadow: 0 1rem 2.5rem -0.75rem rgb(0 0 0 / 0.5);
+  }
+
+  .ob-consent-title {
+    margin: 0 0 0.2rem;
+    font-size: var(--sl-text-sm);
+    font-weight: 600;
+    color: var(--sl-color-white);
+  }
+
+  .ob-consent-copy {
+    margin: 0;
+    font-size: var(--sl-text-xs);
+    line-height: 1.6;
+    color: var(--sl-color-gray-3);
+  }
+
+  .ob-consent-body {
+    flex: 1 1 16rem;
+  }
+
+  .ob-consent-actions {
+    display: flex;
+    gap: 0.5rem;
+  }
+
+  .ob-consent-button {
+    padding: 0.4rem 0.85rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.35rem;
+    background: transparent;
+    color: var(--sl-color-gray-2);
+    font: inherit;
+    font-size: var(--sl-text-xs);
+    cursor: pointer;
+  }
+
+  .ob-consent-button:hover {
+    border-color: var(--sl-color-gray-4);
+    color: var(--sl-color-white);
+  }
+
+  /* The landing page's primary action, in miniature: a solid fill of the
+     token that contrasts with the page, labelled in the token that contrasts
+     with the fill. `--sl-color-white` is a role rather than a colour — it is
+     near-black under the light theme — so a label set in it on an accent fill
+     is dark-on-blue in daylight. The pair below inverts correctly in both. */
+  .ob-consent-button-primary {
+    border-color: var(--sl-color-white);
+    background: var(--sl-color-white);
+    color: var(--sl-color-black);
+  }
+
+  .ob-consent-button-primary:hover {
+    border-color: var(--sl-color-gray-1);
+    background: var(--sl-color-gray-1);
+    color: var(--sl-color-black);
+  }
+
+  .ob-consent-button:focus-visible {
+    outline: 2px solid var(--sl-color-accent-high);
+    outline-offset: 2px;
+  }
+
+  /* Stacked, the buttons want the full width rather than the right edge. */
+  @media (max-width: 30rem) {
+    .ob-consent-actions {
+      flex: 1 1 100%;
+    }
+
+    .ob-consent-button {
+      flex: 1;
+    }
+  }
+</style>
diff --git a/site/src/components/AnalyticsPreference.astro b/site/src/components/AnalyticsPreference.astro
new file mode 100644
index 00000000..d2f13dae
--- /dev/null
+++ b/site/src/components/AnalyticsPreference.astro
@@ -0,0 +1,164 @@
+---
+/* The standing analytics control, for the privacy page.
+ *
+ * The banner asks once. This is where the answer is changed afterwards, which
+ * is the half of consent that is easy to leave out: permission that cannot be
+ * withdrawn as readily as it was given was never permission.
+ *
+ * It states the current situation before offering the buttons, because "allowed
+ * or not" is the question a reader arrives with, and in the regions that do not
+ * require a prompt the honest answer is that measurement is already running.
+ *
+ * The status line is scripted rather than rendered, since the answer lives in
+ * the reader's browser and this site is static: every reader would otherwise be
+ * served the same cached sentence about a choice that is theirs alone.
+ */
+const enabled =
+  Boolean(import.meta.env.PUBLIC_GA_MEASUREMENT_ID?.trim()) && import.meta.env.PROD;
+---
+
+{
+  enabled ? (
+    <>
+      <p>
+        The site uses Google Analytics 4 to count visits and see which pages get read. It runs
+        only when it is allowed to, and it is configured to learn as little as will still
+        answer that question.
+      </p>
+      <div id="ob-analytics-preference" class="ob-preference">
+        <p class="ob-preference-status" aria-live="polite">
+          Checking whether analytics are running in this browser.
+        </p>
+        <div class="ob-preference-actions">
+          <button type="button" class="ob-preference-button" data-consent="denied">
+            Do not allow
+          </button>
+          <button type="button" class="ob-preference-button" data-consent="granted">
+            Allow
+          </button>
+        </div>
+      </div>
+    </>
+  ) : (
+    <p>
+      This build of the site has no analytics configured, so nothing is measured, nothing is
+      stored, and there is nothing to turn off. The rest of this section describes what a build
+      that has them does.
+    </p>
+  )
+}
+
+<script is:inline>
+  (function () {
+    var root = document.getElementById("ob-analytics-preference");
+    var api = window.oneboxAnalytics;
+    if (!root || !api) return;
+
+    var status = root.querySelector(".ob-preference-status");
+    var buttons = root.querySelectorAll("[data-consent]");
+
+    function render() {
+      var preference = api.preference();
+
+      if (api.refused()) {
+        status.textContent =
+          "Your browser sends a Do Not Track or Global Privacy Control signal, so " +
+          "analytics do not run here whatever this control says.";
+        for (var i = 0; i < buttons.length; i++) buttons[i].disabled = true;
+        return;
+      }
+
+      for (var j = 0; j < buttons.length; j++) {
+        buttons[j].disabled = false;
+        buttons[j].setAttribute(
+          "aria-pressed",
+          String(buttons[j].dataset.consent === preference),
+        );
+      }
+
+      if (preference === "granted") {
+        status.textContent = "Analytics are allowed in this browser.";
+        return;
+      }
+      if (preference === "denied") {
+        status.textContent = "Analytics are not allowed in this browser.";
+        return;
+      }
+
+      api.requirement().then(function (requirement) {
+        if (api.preference() !== null) return;
+        status.textContent =
+          requirement === "not_required"
+            ? "Analytics are running in this browser. You can turn them off here."
+            : "You have not yet answered the analytics question in this browser.";
+      });
+    }
+
+    root.addEventListener("click", function (event) {
+      var button = event.target instanceof Element && event.target.closest("[data-consent]");
+      if (!button) return;
+      api.setPreference(button.dataset.consent);
+    });
+
+    api.subscribe(render);
+    render();
+  })();
+</script>
+
+<style>
+  .ob-preference {
+    margin-block: 1rem;
+    padding: 1rem 1.15rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.6rem;
+    background: var(--sl-color-black);
+  }
+
+  .ob-preference-status {
+    margin: 0;
+    font-size: var(--sl-text-sm);
+    line-height: 1.6;
+    color: var(--sl-color-gray-2);
+  }
+
+  .ob-preference-actions {
+    display: flex;
+    gap: 0.5rem;
+    margin-block-start: 0.85rem;
+  }
+
+  .ob-preference-button {
+    padding: 0.4rem 0.85rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.35rem;
+    background: transparent;
+    color: var(--sl-color-gray-2);
+    font: inherit;
+    font-size: var(--sl-text-xs);
+    cursor: pointer;
+  }
+
+  .ob-preference-button:hover:not(:disabled) {
+    border-color: var(--sl-color-gray-4);
+    color: var(--sl-color-white);
+  }
+
+  /* Same inversion as the banner's primary action: `--sl-color-white` is the
+     token that contrasts with the page, so it is the fill here and never the
+     label on top of it. */
+  .ob-preference-button[aria-pressed="true"] {
+    border-color: var(--sl-color-white);
+    background: var(--sl-color-white);
+    color: var(--sl-color-black);
+  }
+
+  .ob-preference-button:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+  }
+
+  .ob-preference-button:focus-visible {
+    outline: 2px solid var(--sl-color-accent-high);
+    outline-offset: 2px;
+  }
+</style>
diff --git a/site/src/components/Footer.astro b/site/src/components/Footer.astro
index bcf629d8..a3d41383 100644
--- a/site/src/components/Footer.astro
+++ b/site/src/components/Footer.astro
@@ -50,6 +50,7 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
       <div class="meta sl-flex">
         <EditLink />
         <LastUpdated />
+        <a href="/privacy">Privacy</a>
       </div>
     )
   }
@@ -75,4 +76,20 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
     margin-inline-start: auto;
   }
 
+  /* Outside the regions that require a consent prompt no banner is ever
+     shown, so the control on /privacy is the only way to turn analytics
+     off -- and SiteFooter, which carries the other link to it, renders on
+     splash pages alone. A reader arriving from a search result lands here
+     and would otherwise have no route to it. One text link, not the whole
+     band. */
+  .meta a {
+    color: var(--sl-color-gray-3);
+    text-decoration: none;
+  }
+
+  .meta a:hover {
+    color: var(--sl-color-white);
+    text-decoration: underline;
+  }
+
 </style>
diff --git a/site/src/components/PageFrame.astro b/site/src/components/PageFrame.astro
index 255b3110..86a2c566 100644
--- a/site/src/components/PageFrame.astro
+++ b/site/src/components/PageFrame.astro
@@ -24,6 +24,7 @@
  */
 import MobileMenuToggle from "@astrojs/starlight/components/MobileMenuToggle.astro";
 import SiteFooter from "./SiteFooter.astro";
+import AnalyticsConsent from "./AnalyticsConsent.astro";
 
 const { hasSidebar } = Astro.locals.starlightRoute;
 const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
@@ -45,6 +46,7 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
   }
   <div class="main-frame"><slot /></div>
   {isSplash && <SiteFooter />}
+  <AnalyticsConsent />
 </div>
 
 <style>
diff --git a/site/src/components/SiteFooter.astro b/site/src/components/SiteFooter.astro
index fdd962a2..979289a8 100644
--- a/site/src/components/SiteFooter.astro
+++ b/site/src/components/SiteFooter.astro
@@ -34,6 +34,8 @@ const year = new Date().getFullYear();
       <span>&copy; {year} <a href="/">Onebox</a> by <a href="https://labstack.com">LabStack LLC</a></span>
       <span class="sep" aria-hidden="true">·</span>
       <span><a href="https://github.com/labstack/onebox/blob/main/LICENSE">Apache-2.0</a></span>
+      <span class="sep" aria-hidden="true">·</span>
+      <span><a href="/privacy">Privacy</a></span>
     </p>
     <nav class="ob-sitefooter-links" aria-label="LabStack">
       <a class="ob-icon" href="https://x.com/labstack" aria-label="LabStack on X">
diff --git a/site/src/content/docs/privacy.mdx b/site/src/content/docs/privacy.mdx
new file mode 100644
index 00000000..f05da6d7
--- /dev/null
+++ b/site/src/content/docs/privacy.mdx
@@ -0,0 +1,90 @@
+---
+title: Privacy
+description: What onebox.run measures, what it never collects, and how to turn analytics off.
+summary: The website's own privacy terms and the control that turns its analytics on or off. Not about the `ob` binary, which reports nothing anywhere.
+read_when:
+  - You want to know what this website records about your visit.
+  - You allowed or declined analytics and want to change that answer.
+status: shipped
+---
+
+import AnalyticsPreference from "../../components/AnalyticsPreference.astro";
+
+This page is about **this website**, `onebox.run`. It is not about the `ob`
+binary. Onebox runs on your machine and talks to your server over SSH; it has no
+phone-home, no licence check and no usage beacon, and it reports nothing to us
+about the hosts you deploy to, the workloads you run, or the plans you apply.
+Nothing on this page changes that, because nothing on this page is in it.
+
+## Website analytics
+
+<AnalyticsPreference />
+
+### When it runs
+
+- **In the EEA, the UK, Guernsey, the Isle of Man and Jersey**, nothing is
+  loaded and no identifier is stored until you say yes. The prompt is the only
+  thing that appears before you answer.
+- **Everywhere else**, analytics run and the control above turns them off.
+- **If your browser sends Do Not Track or Global Privacy Control**, analytics
+  never run and you are never asked. That signal wins over everything else on
+  this page, including the buttons above.
+
+Which of these applies is decided from the country Cloudflare reports for your
+connection. If that lookup fails, the site asks rather than assumes.
+
+### What is sent
+
+When analytics are running, each page view sends the page path, the page title,
+the site you arrived from, and the coarse device, browser and country
+information any web request carries.
+
+Two things are cut down before they leave the browser:
+
+- **Query strings are removed** from the recorded address. Only the path is
+  sent, so anything a link put after the `?` is not. This is the same rule
+  `verifyURL` applies to the URLs Onebox itself handles: that nothing sensitive
+  is in there today is not a property worth assuming.
+- **The referrer is reduced to its site.** We record that you came from a search
+  engine, not what you searched for.
+
+Google's advertising features are switched off — no Google Signals, no ad
+personalisation, and ad data redaction is on — so the data is not used to build
+an advertising profile of you.
+
+### What is never sent
+
+Nothing you enter anywhere is collected, because this site has no forms, no
+accounts, no search box that reports what you typed, and no session recording or
+heatmaps. It does not attempt to identify you. And, to say it once more: no
+hostname, address, credential, plan or release from your own Onebox deployments
+passes through this site.
+
+### Storage
+
+Declining stores nothing that travels with a request. Your answer is kept in
+your browser's local storage under `onebox.analytics-consent.v1`, which is read
+by this site and sent to nobody.
+
+Allowing lets Google Analytics set its `_ga` cookies, which hold a random
+identifier so repeat visits can be recognised as the same browser. Declining
+afterwards deletes them.
+
+Clearing your browser storage for this site clears the answer too, and the
+question comes back if your location requires it.
+
+## Hosting
+
+The site is static files served by Cloudflare Pages. Like any web server,
+Cloudflare receives the IP address and request headers needed to deliver a page,
+and is the reason this site knows which country to apply the rules above to.
+That processing is Cloudflare's, under their terms, and happens whether or not
+you allow analytics.
+
+## Contact
+
+Questions about this page belong in
+[an issue](https://github.com/labstack/onebox/issues). The site's source,
+including the analytics code described here, is in
+[the repository](https://github.com/labstack/onebox/tree/main/site) — this page
+describes what that code does, and the code is the thing you can check.
diff --git a/site/src/pages/llms-full.txt.ts b/site/src/pages/llms-full.txt.ts
index 9a7643f5..b2fc5ad2 100644
--- a/site/src/pages/llms-full.txt.ts
+++ b/site/src/pages/llms-full.txt.ts
@@ -11,7 +11,7 @@ import { toPlainMarkdown } from "../lib/markdown";
 // listed explicitly — it was previously dropped from a document headed
 // "complete documentation".
 const ROOT = "index";
-const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status"];
+const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status", "privacy"];
 
 export const GET: APIRoute = async () => {
   const docs = await getCollection("docs");
diff --git a/site/src/pages/llms.txt.ts b/site/src/pages/llms.txt.ts
index f8dd1bd7..844b1718 100644
--- a/site/src/pages/llms.txt.ts
+++ b/site/src/pages/llms.txt.ts
@@ -13,7 +13,7 @@ import { getCollection } from "astro:content";
 // it "index", which an ORDER list of directory names does not contain, so it was
 // dropped from an index whose own heading promises every page.
 const ROOT = "index";
-const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status"];
+const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status", "privacy"];
 
 const GROUP_TITLES: Record<string, string> = {
   [ROOT]: "Overview",
@@ -22,6 +22,7 @@ const GROUP_TITLES: Record<string, string> = {
   reference: "Reference",
   explanation: "Explanation",
   status: "Status",
+  privacy: "Site terms",
 };
 
 // Keyed by the status union rather than by string, so adding a fourth status is

From 05e7153cc8856930617c445f03351c1e41029bf4 Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 17:43:33 -0700
Subject: [PATCH 2/6] fix(deps): take the x/crypto SSH deadlock fixes

govulncheck fails the repository gate on GO-2026-6355 and GO-2026-6354,
both reachable from `transport.sshHandshake` through `ssh.NewClientConn`:
a peer can deadlock an established or an undecided channel and hold the
connection open. Every `ob` command that touches a remote host goes
through that call, so the gate is right to be red.

Fixed in golang.org/x/crypto v0.56.0, which is what this takes. No API
change and no call site moves; `just check` passes and govulncheck
reports nothing.

Claude-Session: https://claude.ai/code/session_012KwFfm2mZt7RhFip1PLpbU
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index a6e1b95f..01c11204 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	golang.org/x/crypto v0.55.0
+	golang.org/x/crypto v0.56.0
 	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/go.sum b/go.sum
index 66a6ee20..82173aec 100644
--- a/go.sum
+++ b/go.sum
@@ -77,8 +77,8 @@ github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

From c8266c747bc655e31d0297b157df30cb79911535 Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 17:45:52 -0700
Subject: [PATCH 3/6] docs(site): say what rule 2 actually promises

The rule read "Nothing loads until measurement is allowed. Not the tag,
not a request." A request is made before the answer is known: the
/cdn-cgi/trace lookup that decides whether the question has to be asked
at all. It is same-origin and it is the mechanism the rest of this file
describes, so the promise is about Google rather than about the network,
and a file that argues for precise claims should not need the reader to
scroll to find that out. Wording only; no behaviour changes.

Claude-Session: https://claude.ai/code/session_012KwFfm2mZt7RhFip1PLpbU
---
 site/src/components/Analytics.astro | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index d9b6acb4..0e6ac586 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -10,7 +10,10 @@
 //      That is the state for `npm run dev`, for `just check`, for CI, and for
 //      anyone who builds this site from a fork. Analytics belongs to whoever
 //      runs onebox.run, not to the source.
-//   2. Nothing loads until measurement is allowed. Not the tag, not a request.
+//   2. Nothing reaches Google until measurement is allowed: no tag, no
+//      request, no identifier. One request is made before the answer is
+//      known, and it goes to this site's own /cdn-cgi/trace to find out
+//      whether the question has to be asked at all -- see below.
 //   3. No advertising signals. Google Signals and ad personalisation are off,
 //      so the traffic here is not joined to an advertising profile.
 //   4. Do Not Track and Global Privacy Control are honoured before the script

From 3fa596f8c3380df481d5c3440ac68ae2a385d84d Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 17:54:42 -0700
Subject: [PATCH 4/6] fix(site): revoke the identifier when the browser starts
 refusing

A reader who allowed measurement and later switched on Do Not Track or
Global Privacy Control was no longer measured -- the tag is never
inserted on that path -- but the identifier acceptance had already stored
stayed in the browser. Switching the signal off again resumed it, which
joins the sessions either side of the refusal into one returning reader,
and in the meantime the site was holding an analytics id for someone
whose browser was asking it not to.

The refusal path now calls the same stop() the /privacy control uses, so
the cookies go. The stored preference is deliberately left alone: consent
is still granted, so lifting the signal measures again -- under a new
identifier rather than the old one.

AnalyticsConsent.astro claimed the decision to ask was made "before
anything renders". It is made in the head, but the prompt is revealed
after DOMContentLoaded and after the location lookup answers. Says that
instead.

Driven in Chromium against the built site with a test measurement id,
googletagmanager and /cdn-cgi/trace stubbed:

  granted, no signal    _ga present, tag loaded, ga-disable false
  signal switched on    cookies gone, ga-disable true, 0 requests to
                        Google, banner hidden, preference still granted
  signal switched off   tag loads again, consent default denied then
                        update granted, config sent, no page errors

Claude-Session: https://claude.ai/code/session_012KwFfm2mZt7RhFip1PLpbU
---
 site/src/components/Analytics.astro        | 10 ++++++++++
 site/src/components/AnalyticsConsent.astro |  7 ++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index 0e6ac586..1bb6fd31 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -316,6 +316,16 @@ const enabled = Boolean(measurementId) && import.meta.env.PROD;
         if (signalsRefusal()) {
           // Neither measured nor asked. The banner stays in the document,
           // hidden, so nothing depends on it having rendered.
+          //
+          // Revoked as well, because the signal can be switched on by a reader
+          // who allowed measurement before it was. Not loading the tag stops
+          // the next hit, but the identifier that acceptance stored is still in
+          // the browser and would still be there to resume from if the signal
+          // were ever switched off -- which joins the sessions either side of a
+          // refusal into one returning reader. The stored preference is left
+          // alone: consent is still granted, so lifting the signal measures
+          // again, under a new identifier rather than the old one.
+          stop();
           ready(function () {
             var element = banner();
             if (element) element.hidden = true;
diff --git a/site/src/components/AnalyticsConsent.astro b/site/src/components/AnalyticsConsent.astro
index 1d2d1b58..d875da08 100644
--- a/site/src/components/AnalyticsConsent.astro
+++ b/site/src/components/AnalyticsConsent.astro
@@ -2,9 +2,10 @@
 /* The consent prompt, for readers whose location requires one.
  *
  * Markup only. Analytics.astro decides whether this is ever shown and handles
- * the clicks: the question of whether to ask is answered in the head, before
- * anything renders, and putting the logic in two places is how the banner ends
- * up shown to someone who already declined.
+ * the clicks: this renders hidden and is revealed by that script alone, once it
+ * has either a stored preference or an answer from the location lookup. Putting
+ * the logic in two places is how the banner ends up shown to someone who
+ * already declined.
  *
  * It renders on every page rather than only where the site footer does, because
  * a reader who arrives from a search result lands on a documentation page, and

From 81464520a45254225ef54713ffb4468b2a01b3dd Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 18:00:35 -0700
Subject: [PATCH 5/6] fix(site): carry a withdrawal to the tab that is being
 measured

The file said the preference is mirrored across tabs. It was stored where
every tab can read it, which is not the same thing: only the tab that
wrote it ran apply(). A reader with a documentation page open and
/privacy in a second tab could decline, watch the privacy page agree that
analytics were not allowed, and leave the first tab still measuring --
`ga-disable` false and consent granted -- until something navigated it.
The withdrawing tab deletes the identifier cookies, and the tab still
running the tag writes them back on its next event, so the deletion did
not survive either.

A `storage` listener now re-runs apply() in the tabs that did not write.
A null key is the clear() case, where the preference is gone rather than
changed; subscribe() takes the same condition so the privacy page's own
display agrees.

Driven in Chromium, two tabs, no navigation between the click and the
reading, googletagmanager and /cdn-cgi/trace stubbed:

  before                docs tab measuring, ga-disable false
  decline on /privacy   docs tab ga-disable true, consent update denied,
                        cookies gone
  allow on /privacy     docs tab ga-disable false, consent update granted

Against the same build without this change, the third column of the
second row read `ga-disable` false and consent granted -- the defect,
reproduced before it was fixed.

Claude-Session: https://claude.ai/code/session_012KwFfm2mZt7RhFip1PLpbU
---
 site/src/components/Analytics.astro | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index 1bb6fd31..f71e40ad 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -300,7 +300,7 @@ const enabled = Boolean(measurementId) && import.meta.env.PROD;
           subscribe: function (onChange) {
             window.addEventListener(PREFERENCE_EVENT, onChange);
             window.addEventListener("storage", function (event) {
-              if (event.key === STORAGE_KEY) onChange();
+              if (event.key === STORAGE_KEY || event.key === null) onChange();
             });
           },
         };
@@ -333,6 +333,17 @@ const enabled = Boolean(measurementId) && import.meta.env.PROD;
           return;
         }
 
+        // A choice made in one tab has to reach the tab that is being measured.
+        // `storage` fires in every tab but the one that wrote, so this is the
+        // only place the two are joined, and leaving it out is worse than a
+        // stale display: the withdrawing tab deletes the cookies, and the tab
+        // still running the tag writes them again on its next event and carries
+        // on measuring until something navigates it. A null key is the clear()
+        // case, where the preference is gone rather than changed.
+        window.addEventListener("storage", function (event) {
+          if (event.key === STORAGE_KEY || event.key === null) apply();
+        });
+
         ready(function () {
           var element = banner();
           if (element) {

From df7e187bebf97d0b432364a41a555ee674b16ff1 Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Fri, 4 Sep 2026 18:05:51 -0700
Subject: [PATCH 6/6] fix(site): keep the privacy control parseable, and stop
 overclaiming the mirror

`is:inline` ships these scripts verbatim -- that is the point of the
attribute, and why the code is written in the ES5 dialect it is. The
trailing comma after the last argument of a `setAttribute` call is
ES2017, so a browser old enough to lack it fails to parse the whole
script rather than that one line, and the standing opt-out on /privacy
renders with its buttons wired to nothing while the status line still
says it is checking. A control that appears and does nothing is the worst
state this file has. The comma in the country array stays: a trailing
comma in an array literal has been legal since ES5.

The header also said the preference "is mirrored across tabs". That is
now true where storage works, and the file has a deliberate path where it
does not: a browser that refuses storage keeps the answer in memory, for
the page it was given on and no other. Says both.

Claude-Session: https://claude.ai/code/session_012KwFfm2mZt7RhFip1PLpbU
---
 site/src/components/Analytics.astro           | 6 +++++-
 site/src/components/AnalyticsPreference.astro | 8 +++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index f71e40ad..9e40de78 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -48,7 +48,11 @@
 // for exactly this reason.
 //
 // The preference lives in localStorage rather than a cookie, so declining
-// stores nothing that travels with a request, and is mirrored across tabs.
+// stores nothing that travels with a request, and every other open tab is told
+// about the change and acts on it. A browser that refuses storage entirely
+// keeps the answer in memory instead, where it governs the page it was given on
+// and no other -- the direction that does not weaken the gate, but not one to
+// describe as mirrored.
 //
 // The script body below is written as the element's plain text content, with no
 // `{...}` expression and no backticks around it. Astro treats script children as
diff --git a/site/src/components/AnalyticsPreference.astro b/site/src/components/AnalyticsPreference.astro
index d2f13dae..ea1b5e9a 100644
--- a/site/src/components/AnalyticsPreference.astro
+++ b/site/src/components/AnalyticsPreference.astro
@@ -70,9 +70,15 @@ const enabled =
 
       for (var j = 0; j < buttons.length; j++) {
         buttons[j].disabled = false;
+        // No trailing comma after the last argument: `is:inline` ships this
+        // script verbatim, and a trailing comma in a call is ES2017. Every
+        // browser too old for it fails to parse the whole script rather than
+        // one line of it, which would leave this control inert -- a standing
+        // opt-out that renders and does nothing is the worst of the states
+        // this file can be in.
         buttons[j].setAttribute(
           "aria-pressed",
-          String(buttons[j].dataset.consent === preference),
+          String(buttons[j].dataset.consent === preference)
         );
       }