> What we can do to address concerns with tracking in the meantime is to honor > the DoNotTrack header in the site template, and only load GA/GTM in case > navigator.doNotTrack isn't set. Something like the (completely untested) > attached migth be all we need? The diff also removes the ability to load GA > over http, which we clearly shouldn't allow (and since moving the site to all > https we don't anyways IIUC). > > I think we'd also need to check windows.doNotTrack to cover Microsoft browsers, but yes, I think that will work with GA.
Ah yes, my bad, window.doNotTrack (as you corrected in a subsequent email) is required for IE and Safari.
> In GTM you can do it in the config (i.e. through the container settings in the management UI). Browsers would still pull the code of course, but then any tracking would be disabled.
Right, I still prefer to do it on our side and put us in charge of whether tracking is invoked or not.
+1.
(Both on the turn it took with some more details in general, and specifically on preventing even loading the GA/GTM scripts if the browser is set to do not track)
Thanks. Can you or Daniel or someone else please give the attached patch a quick look over before I commit it?