| Platform analytics |
Vercel Analytics, Netlify Analytics, Cloudflare Web Analytics |
Varies - cookieless modes exist, but script injection still needs review |
| Product analytics |
Google Analytics 4, PostHog, Plausible snippets scaffolded on request |
GA4 and PostHog set identifiers - consent required in the EU/UK |
| Error monitoring |
Sentry and similar SDKs added when you ask for "monitoring" |
Session data collection - disclose it and gate non-essential parts |
| Backend & auth SDKs |
Firebase, Supabase - auth tokens plus optional bundled analytics |
Auth cookies are necessary; bundled analytics are not |
| Fonts & embeds |
Google Fonts, YouTube embeds, map widgets |
Third-party requests that can transfer visitor IPs - EU courts have flagged remote fonts |