Wire GA4 acquisition-only analytics behind the existing consent preference center

[alexeygrigorev]

Parent decision: #27
Normative decision: Open decision 16

Scope

The analytics-consent preference center already exists (`core/static/core/analytics_preferences.js`, the `dtc_analytics_consent` cookie handled in `core/middleware.py`, and the footer "Analytics preferences" control from #125), but no actual GA4 tag is wired up yet.

• Add GA4 (`gtag.js`) loaded only after analytics consent is granted through the existing preference center — never before consent, never on denial.
• Configure GA4 for acquisition-only signal: pageviews, sessions, and referrer/UTM acquisition source. Explicitly disable "enhanced measurement" (scroll depth, outbound clicks, site search, video engagement, file downloads) — that crosses into behavioral analytics, which is out of scope per the owner decision in Decision: Approve analytics and tracking preservation policy #27.
• Development and preview environments must never send analytics hits to the production GA4 property (matches the existing "development/previews do not send production analytics" requirement).
• Measurement ID should be environment-configured, not hardcoded, so dev/preview can point at nothing or a separate non-production property.

Non-goals

Does not add event tracking, conversion goals, enhanced measurement, or any new tracking pixel beyond the single GA4 acquisition tag. Does not reopen the "no new behavioral analytics in MVP" decision.

Acceptance criteria

• GA4 tag loads only post-consent, confirmed via network inspection with consent granted/denied/unset.
• Enhanced measurement is off; only pageview/session/acquisition data is collected.
• Dev/preview traffic never reaches the production GA4 property.
• Measurement ID is environment-configured.

Dependencies

Depends on #27 (decision, resolved) and the existing consent infrastructure from #125.

[alexeygrigorev]

Independent Tester Report — issue #225

Status: return to engineer / not ready for product-manager acceptance.

The synchronized #225 candidate passes its issue-specific verification and the
fresh regression targets below. The full tester/release envelope is still not
green because current main has the pre-existing protected #179 homepage
regression and formatter baseline. No #225-specific failure was found. No
commit, push, merge, deployment, or production configuration change was made.

Candidate under test

• Issue: Wire GA4 acquisition-only analytics behind the existing consent preference center #225, “Wire GA4 acquisition-only analytics behind the existing consent preference center”
• Worktree: .tmp/issue-225-independent-tester-repair2-20260827
• Base and source revision: d24808c374b7deb220cb57e365760382ad66d06b
• Candidate: staged, uncommitted diff; engineer and tester snapshots match
• Scoped files: 13
• Scoped diff: 464 insertions, 13 deletions
• Staged patch SHA-256 (git diff --cached --binary --full-index HEAD | sha256sum):
  dcb2f022d34cecc401bb60faf86fee6ba989255c178c9b5252f531b739f1288e
• git diff --cached --check: passed

The tester snapshot was refreshed after the earlier tester snapshot was found
to omit the engineer’s privacy-boundary hardening and added authenticated and
credential-bearing request coverage. The final tester patch is mechanically
identical to the engineer patch.

Verification plan

• Plan: .tmp/verification/issue-225-tester-repair2b-20260827/verification-plan.json
• Plan SHA-256: 309b451bb3de248afa1a85225293c67d37bb57bda4ee6956a6942bf213716692
• Profile: full; reason: render_impact
• Base/head: d24808c374b7deb220cb57e365760382ad66d06b / d24808c374b7deb220cb57e365760382ad66d06b
• Ownership graph SHA-256: 05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6
• Render digest: aced5aa5092660aeac17e437d777b9ecf146a1d5c390d3b965d5a0df249d69bb
• Required plan captures: 8 (home, not-found, courses, and studio sign-in at desktop and mobile sizes)
• Plan validation: passed

Issue-specific verification

• Focused Django/settings/security boundary suite: 52 passed.
• Dedicated GA4 consent/network Playwright suite: 2 passed.
• Feature screenshots: 2 passed, producing desktop and mobile consent/allowed captures.
• The browser coverage verified no loader before consent or after denial; allowing consent loads GA4 and sends one sanitized page view.
• Acquisition boundaries retain only approved UTM fields and an origin-only HTTP(S) referrer; hashes and unrelated query parameters are excluded.
• Behavioral boundaries disable automatic page views, Google signals, ad personalization, and behavioral listeners.
• Runtime boundaries omit the loader for authenticated, credential-bearing, private, account, staff, API, registration, and token-bearing requests; non-production environments expose no measurement ID.

Regression and quality results

Passed on the synchronized candidate:

• Core Django target: 941 passed.
• CI/evidence target: 607 passed.
• Migrations check, OpenAPI check, management parity, Django system check, and deployment check.
• Ruff on the changed test and format check on the changed test.
• Mypy: 449 source files, no issues.

Known baseline gates outside the #225 diff:

• Full Django discovery remains blocked by the existing templates/core/home.html:1297 adjacent nested opening-tags error and its follow-on multiprocessing traceback-pickling error; Wire GA4 acquisition-only analytics behind the existing consent preference center #225 does not touch that template.
• make format-check remains red only at the existing content/tests/test_review_skeleton.py:173 and :195 locations; Wire GA4 acquisition-only analytics behind the existing consent preference center #225 does not alter them.
• The verification plan’s full screenshot/Playwright envelope remains unresolved by the current-main Rebuild the public homepage on the design 5a mockup #179 homepage markup/responsive-overflow regression. The feature-specific captures below are not substitutes for those required plan captures.

Screenshot evidence

Fresh feature captures were written under:

.tmp/screenshots/issue-225-repair2-feature/

• terms-consent-desktop.png
• terms-allowed-desktop.png
• terms-consent-mobile.png
• terms-allowed-mobile.png

I inspected all four captures. They show the expected Terms page, the initial
optional-analytics dialog, its disappearance after allowing analytics, readable
desktop/mobile layouts, and no horizontal overflow. The protected homepage
regression remains the reason the plan-required full screenshot gate cannot be
closed.

Required next step

Keep the candidate staged and uncommitted. The authorized #179 homepage owner
must clear the current-main full-envelope regression and the formatter
baseline must be handled or explicitly waived. Then rerun the plan-required
full captures, obtain product-manager acceptance, and only afterward perform
the lifecycle-owned commit and local merge.

[alexeygrigorev]

Current tester addendum — repair 2 (2026-08-27)

The earlier #225 comment describes a superseded candidate. The synchronized
current-main engineer/tester snapshots have now been rechecked after
reconciling the legal data-flow inventory with the production-only GA4
boundary.

• Base: d24808c374b7deb220cb57e365760382ad66d06b
• Engineer/tester candidate: staged and uncommitted; 14 paths, 493 insertions, 29 deletions
• Exact staged patch SHA-256: 845b2caa8f38627e0dc6e76276b75854a147965615fa59e7fac8d0f120518a9d
• Recheck: 37 focused settings/privacy tests (including 7 GA4 tests), 2 consent/network Playwright tests, 942 core tests, 607 CI tests, and typecheck passed
• The inventory now identifies the production-only GA4 boundary and guards against the stale no-provider text.
• No candidate-specific failure was found; the full release envelope remains blocked by the unrelated protected Rebuild the public homepage on the design 5a mockup #179 homepage regression and the formatter baseline.

This is a candidate-specific tester pass, not PM acceptance or merge approval.
The candidate remains staged/uncommitted pending the required lifecycle gates
and human confirmation of production/legal configuration.

[alexeygrigorev]

PM acceptance — issue #225 (bounded candidate slice, 2026-08-27)

Disposition: ACCEPTED for the candidate-specific consent-gated acquisition analytics behavior; #225 remains OPEN.

I reviewed the groomed issue, the current-main staged candidate, the independent tester report,
the course consent captures, Open decision 16, and the privacy boundary in specification 07. The
candidate implements the approved narrow behavior:

• GA4 is absent before a choice and after denial, and loads only after explicit consent;
• the allowed page view carries only the approved acquisition signal (safe HTTP(S) referrer and
  allowlisted UTM fields), with hashes and unrelated query data excluded;
• enhanced measurement, automatic page views, advertising/personalization signals, and behavioral
  listeners are disabled;
• authenticated/private/credential-bearing routes and non-production environments do not expose
  the production measurement ID; and
• the consent dialog and revised acquisition-only explanation are readable and contained on the
  inspected desktop and mobile /courses captures.

The independent verification supports this bounded acceptance: 33 focused Django/settings tests,
2 dedicated consent/network browser tests, 938 core tests, 607 CI tests, quality/security/
migration/container checks, and the preserved desktop/mobile consent evidence passed. No
candidate-specific failure was found.

This is product acceptance of the implementation slice, not release or production analytics
approval. #225 remains open because the full tester envelope is still blocked by the protected
#179 homepage regression, the unrelated formatter baseline remains, and the production measurement
ID/legal configuration still needs explicit human confirmation. The candidate remains staged and
uncommitted; no commit, merge, push, deployment, or production analytics configuration change was
authorized by this comment.