@friedbotstudio/create-baseline 0.5.0 → 0.7.0

package/obj/template/.claude/skills/google-analytics/references/privacy.md

@@ -1,441 +0,0 @@
-# GA4 Privacy and Compliance
-
-Expert guidance for GA4 privacy including GDPR, CCPA, Consent Mode v2, and data deletion.
-
-## Overview
-
-GA4 provides privacy-focused features for GDPR, CCPA, and global privacy regulations including Consent Mode, data controls, and compliance workflows.
-
-## Consent Mode v2
-
-### What is Consent Mode
-
-Google's API for communicating user consent status to GA4, Google Ads, and other Google tags.
-
-### Consent Parameters
-
-| Parameter | Purpose | Values |
-|-----------|---------|--------|
-| ad_storage | Advertising cookies | granted / denied |
-| analytics_storage | Analytics cookies | granted / denied |
-| ad_user_data | User data for advertising (NEW) | granted / denied |
-| ad_personalization | Personalized ads (NEW) | granted / denied |
-| personalization_storage | Website personalisation | granted / denied |
-| functionality_storage | Essential functionality | granted / denied |
-| security_storage | Security features | granted / denied |
-
-### Consent Mode v2 Requirements
-
-As of March 2024, v2 parameters required for EU/EEA:
-- ad_user_data
-- ad_personalization
-
-Without these, remarketing lists won't populate for EU users.
-
-## Implementing Consent Mode
-
-### Basic gtag.js Implementation
-
-**Step 1: Set Default Consent (BEFORE gtag.js loads)**
-
-```html
-<script>
-  // Set default consent to denied
-  window.dataLayer = window.dataLayer || [];
-  function gtag(){dataLayer.push(arguments);}
-
-  gtag('consent', 'default', {
-    'ad_storage': 'denied',
-    'ad_user_data': 'denied',
-    'ad_personalization': 'denied',
-    'analytics_storage': 'denied'
-  });
-</script>
-
-<!-- Then load gtag.js -->
-<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
-<script>
-  gtag('js', new Date());
-  gtag('config', 'G-XXXXXXXXXX');
-</script>
-```
-
-**Step 2: Update Consent After User Choice**
-
-```javascript
-// User accepts all cookies
-gtag('consent', 'update', {
-  'ad_storage': 'granted',
-  'ad_user_data': 'granted',
-  'ad_personalization': 'granted',
-  'analytics_storage': 'granted'
-});
-
-// User accepts only analytics
-gtag('consent', 'update', {
-  'ad_storage': 'denied',
-  'ad_user_data': 'denied',
-  'ad_personalization': 'denied',
-  'analytics_storage': 'granted'
-});
-
-// User denies all
-gtag('consent', 'update', {
-  'ad_storage': 'denied',
-  'ad_user_data': 'denied',
-  'ad_personalization': 'denied',
-  'analytics_storage': 'denied'
-});
-```
-
-### GTM Implementation
-
-**Method 1: Using CMP Template**
-
-Most CMPs (OneTrust, Cookiebot, etc.) provide GTM templates:
-
-1. Install CMP template from Community Gallery
-2. Configure default consent in template
-3. Template auto-updates consent on user choice
-
-**Method 2: Manual GTM Setup**
-
-**Create Consent Initialisation Tag:**
-
-1. Tag Type: Custom HTML
-2. Code:
-```html
-<script>
-  window.dataLayer = window.dataLayer || [];
-  function gtag(){dataLayer.push(arguments);}
-  gtag('consent', 'default', {
-    'ad_storage': 'denied',
-    'analytics_storage': 'denied',
-    'ad_user_data': 'denied',
-    'ad_personalization': 'denied'
-  });
-</script>
-```
-3. Trigger: Consent Initialisation - All Pages
-4. Tag firing priority: 999 (fires first)
-
-**Create Consent Update Tag:**
-
-1. Tag Type: Custom HTML
-2. Trigger: Custom event from CMP
-
-## Regional Settings
-
-### EU-Specific Consent
-
-```javascript
-// Denied for EU countries, granted elsewhere
-gtag('consent', 'default', {
-  'ad_storage': 'denied',
-  'analytics_storage': 'denied'
-}, {
-  'region': ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI',
-             'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU',
-             'MT', 'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'GB']
-});
-
-// Granted for non-EU
-gtag('consent', 'default', {
-  'ad_storage': 'granted',
-  'analytics_storage': 'granted'
-});
-```
-
-### California (CCPA)
-
-```javascript
-gtag('consent', 'default', {
-  'ad_storage': 'granted',
-  'analytics_storage': 'granted'
-}, {
-  'region': ['US-CA']
-});
-```
-
-## Consent Mode Behaviour
-
-### When analytics_storage = "denied"
-
-| Feature | Behaviour |
-|---------|-----------|
-| Cookies | Not stored |
-| client_id | Not persisted |
-| Tracking | Cookieless pings |
-| Modelling | Used to fill gaps |
-| User journey | Limited |
-
-### When analytics_storage = "granted"
-
-| Feature | Behaviour |
-|---------|-----------|
-| Cookies | Stored (_ga, _ga_*) |
-| client_id | Persists across sessions |
-| Tracking | Full functionality |
-| Modelling | Not needed |
-| User journey | Complete |
-
-### Conversion Modelling
-
-When consent denied, GA4 uses:
-- Machine learning to estimate conversions
-- Aggregated, anonymised data
-- Behavioural patterns
-- "Modelled" label in reports
-
-## Data Retention
-
-### Configuration
-
-**Path:** Admin -> Data Settings -> Data Retention
-
-| Option | Use Case |
-|--------|----------|
-| 2 months | Privacy-focused, GDPR minimum |
-| 14 months | Year-over-year analysis |
-
-### What's Affected
-
-**Affected (user/event data in Explorations):**
-- User-level data
-- Event-level data
-- User Explorer report
-
-**Not Affected (aggregated data):**
-- Standard reports
-- Conversion data
-- Audience data
-
-### Reset on New Activity
-
-- **ON:** Timer resets when user returns
-- **OFF:** Data deleted at fixed date
-
-## Data Deletion Requests
-
-### GDPR Article 17 (Right to Erasure)
-
-**Path:** Admin -> Data Settings -> Data Deletion Requests
-
-### Process
-
-1. Click "Create deletion request"
-2. Select parameter:
-   - User ID
-   - Client ID (user_pseudo_id)
-   - App Instance ID
-3. Enter identifier value
-4. Choose date range or "All time"
-5. Submit request
-
-### Processing
-
-- Takes up to 72 hours
-- Deletes ALL events for identifier
-- Cannot be undone
-- Confirmation email sent
-
-### Best Practice
-
-- Maintain deletion request log
-- Respond within 30 days (GDPR)
-- Document process in privacy policy
-
-## IP Anonymisation
-
-### GA4 Default Behaviour
-
-- GA4 does NOT log or store IP addresses
-- IP used only for geolocation derivation
-- No additional anonymisation needed
-- Privacy-first by design
-
-### Unlike Universal Analytics
-
-- No `anonymize_ip` parameter needed
-- IP never in reports or exports
-- Location derived, IP discarded
-
-## Google Signals
-
-### What It Enables
-
-- Demographics (age, gender)
-- Interests reporting
-- Cross-device tracking (without User ID)
-- Remarketing audiences
-
-### Privacy Implications
-
-- Requires consent for personalised ads
-- Subject to data thresholds
-- User opt-out via Ads Settings
-
-### Configuration
-
-**Path:** Admin -> Data Settings -> Data Collection
-
-- Enable only with proper consent
-- Respect user opt-outs
-- Document in privacy policy
-
-## GDPR Compliance Checklist
-
-### Legal Requirements
-
-- [ ] Privacy policy updated with GA4 usage
-- [ ] Cookie consent banner implemented
-- [ ] Legal basis documented (consent/legitimate interest)
-- [ ] DPA with Google signed
-- [ ] Cross-border data transfer disclosures
-
-### Technical Implementation
-
-- [ ] Consent Mode v2 configured
-- [ ] All 4 v2 parameters set (ad_storage, analytics_storage, ad_user_data, ad_personalization)
-- [ ] Default consent = denied for EU
-- [ ] Consent updates on user acceptance
-- [ ] Data retention configured
-
-### Operational Processes
-
-- [ ] Data deletion process documented
-- [ ] User opt-out mechanism available
-- [ ] Regular privacy audit schedule
-- [ ] Staff training on procedures
-
-## CCPA Compliance
-
-### Requirements
-
-- Allow opt-out of "sale" of personal information
-- "Do Not Sell My Personal Information" link
-- Honor Global Privacy Control (GPC)
-
-### GPC Implementation
-
-```javascript
-// Detect GPC signal
-if (navigator.globalPrivacyControl) {
-  gtag('consent', 'update', {
-    'ad_storage': 'denied',
-    'ad_user_data': 'denied',
-    'ad_personalization': 'denied',
-    'analytics_storage': 'granted'  // Analytics OK, ads denied
-  });
-}
-```
-
-### GTM Variable for GPC
-
-1. Variable Type: JavaScript Variable
-2. Global Variable Name: `navigator.globalPrivacyControl`
-3. Use in consent logic
-
-## Consent Management Platforms
-
-### Popular CMPs
-
-- OneTrust
-- Cookiebot
-- Termly
-- Osano
-- TrustArc
-
-### GTM CMP Templates
-
-1. Community Template Gallery -> Search CMP
-2. Install template
-3. Configure settings
-4. Auto-updates consent to GA4
-
-## Testing Consent Mode
-
-### Verification Steps
-
-**1. DebugView Test:**
-- Before consent: Check analytics_storage = denied
-- After consent: Check analytics_storage = granted
-
-**2. Check Event Parameters:**
-- Look for `gcs` parameter (Google Consent State)
-- Events include consent status
-
-**3. Cookie Inspection:**
-- Before consent: No `_ga` cookie
-- After consent: `_ga` cookie set
-
-**4. GTM Preview:**
-- Consent Initialisation fires first
-- GA4 tag respects consent
-- Consent update fires on user action
-
-### Chrome DevTools Check
-
-```javascript
-// Check current consent state
-dataLayer.filter(item => item[0] === 'consent')
-```
-
-## Server-Side Consent
-
-### Measurement Protocol
-
-```json
-{
-  "client_id": "client_123",
-  "consent": {
-    "ad_storage": "denied",
-    "analytics_storage": "granted",
-    "ad_user_data": "denied",
-    "ad_personalization": "denied"
-  },
-  "events": [...]
-}
-```
-
-### Best Practice
-
-- Pass consent from frontend to backend
-- Include in all Measurement Protocol requests
-- Store user preferences in database
-
-## Quick Reference
-
-### Consent Parameters (v2)
-
-```javascript
-gtag('consent', 'default', {
-  'ad_storage': 'denied',
-  'analytics_storage': 'denied',
-  'ad_user_data': 'denied',
-  'ad_personalization': 'denied'
-});
-```
-
-### Update After Consent
-
-```javascript
-gtag('consent', 'update', {
-  'ad_storage': 'granted',
-  'analytics_storage': 'granted',
-  'ad_user_data': 'granted',
-  'ad_personalization': 'granted'
-});
-```
-
-### Data Deletion
-
-Admin -> Data Settings -> Data Deletion Requests -> Create
-
-### Key Compliance Points
-
-- v2 parameters required for EU (March 2024)
-- Default to denied, update on consent
-- Data retention: 2 or 14 months
-- No IP storage in GA4
-- Respond to deletion within 30 days