@piercebarney/whs-eleventy 2026.10.8 → 2026.10.9

package/lib/compliance.js

@@ -525,6 +525,15 @@ const CHECKS = {
       /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
     if (!builtPath && !source) return { status: FAIL, note: "no privacy page" };
 
+    // GPC (core.md#privacy): once ads are on, the built privacy page must say
+    // GPC is honoured — checked ahead of the disclosure branches below so it
+    // applies no matter which of them resolves the rest of the check.
+    if (adsMode !== "none" && builtPath) {
+      const html = read(builtPath) || "";
+      if (!/Global Privacy Control/i.test(html))
+        return { status: FAIL, note: "privacy page does not state GPC is honoured" };
+    }
+
     // Prefer checking the built page's own rendered HTML for every declared
     // third party's name — what a user actually sees, independent of which
     // source file or templating approach produced it. Falls back to the
@@ -580,10 +589,24 @@ const CHECKS = {
     const leak = siteHtml().filter((f) => AD_CODE.test(fs.readFileSync(f, "utf8")));
     if (!prod && leak.length)
       return { status: FAIL, note: `ad code in ${leak.length} non-production page(s)` };
-    return {
-      status: MANUAL,
-      note: "wired; verify on production: decline consent => no ad requests, accept => ads + CLS ok",
-    };
+
+    // GPC (core.md#ads): once a production build actually carries a live ad
+    // unit, the built site.js must set data-restrict-data-processing for a
+    // GPC visitor — checked against the built copy, not the source, so a
+    // stale copy-in shows up here rather than only in a manual browser check.
+    const INS_UNIT = /<ins[^>]+adsbygoogle/;
+    const adsActive = prod && siteHtml().some((f) => INS_UNIT.test(fs.readFileSync(f, "utf8")));
+    let note =
+      "wired; verify on production: decline consent => no ad requests, accept => ads + CLS ok";
+    if (adsActive) {
+      const builtJs = read("_site/site.js") || "";
+      const gpcHandled =
+        /navigator\.globalPrivacyControl/.test(builtJs) &&
+        /data-restrict-data-processing/.test(builtJs);
+      if (!gpcHandled) return { status: FAIL, note: "ads active but no GPC handling in built JS" };
+      note += "; GPC handled";
+    }
+    return { status: MANUAL, note };
   },
 
   "internal-links": () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.10.8",
+  "version": "2026.10.9",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,102 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-10-09 [breaking]
+
+### core: privacy
+
+`#privacy`'s Specs now require **Global Privacy Control**: a site running
+display ads or analytics that sells/shares personal data honours the GPC
+signal — `navigator.globalPrivacyControl` in the browser, or the `Sec-GPC:
+1` request header where a server renders — as an automatic opt-out of sale,
+sharing, and targeted advertising. No click required, and sharing analytics
+does not load for a GPC visitor. The privacy page must state that GPC is
+honoured wherever it applies. Verify gains: review confirms the privacy
+page states this. Required by US state privacy laws (e.g. Montana's amended
+MCDPA, California's CCPA regs), which apply by where the visitor lives, not
+the site's own location. Decided by the owner in
+`feedback/2026-09-26-external-standards-survey.md` ("Sequencing" step 3,
+Decisions item 2).
+
+**Breaking:** a fully compliant ad-running or sharing-analytics site before
+this change had no GPC handling and no privacy-page statement about it —
+neither was required. Both are required now, and `whs compliance`'s
+`privacy` check (see `packages/whs-eleventy` below) `FAIL`s without the
+statement once ads are active.
+
+### core: ads
+
+`#ads`'s consent-gate spec now extends to the US-state opt-out: a visitor
+sending GPC gets restricted/non-personalized ad requests automatically, and
+the certified CMP also presents the US-state "Do Not Sell or Share My
+Personal Information" opt-out. Verify gains a manual check alongside the
+existing decline/accept checks: browser with GPC on → ad requests
+restricted.
+
+**Breaking:** a fully compliant ad-running site before this change served
+personalized ads to a GPC visitor and had no US-state opt-out in its CMP —
+neither was required. Both are required now, and `whs compliance`'s `ads`
+check (see `packages/whs-eleventy` below) `FAIL`s without the built-JS GPC
+handling once a live ad unit exists.
+
+### packages/whs-eleventy
+
+`lib/compliance.js`'s `ads` check: once a production build carries a live
+`<ins … adsbygoogle>` unit, it now `FAIL`s "ads active but no GPC handling
+in built JS" unless the built `_site/site.js` matches both
+`navigator.globalPrivacyControl` and `data-restrict-data-processing`;
+otherwise it appends "GPC handled" to the existing `MANUAL` note. The
+`privacy` check now `FAIL`s "privacy page does not state GPC is honoured"
+when ads are on and the built privacy page doesn't match
+`/Global Privacy Control/i`. New tests in `test/compliance-checks.test.js`
+cover both branches (ads active + GPC present → no `FAIL`; ads active + GPC
+missing → `FAIL`; privacy statement missing while ads are on → `FAIL`).
+
+### templates/eleventy-netlify
+
+`static/site.js`'s unit-push loop now sets
+`data-restrict-data-processing="1"` on each `<ins>` immediately before its
+push when `navigator.globalPrivacyControl === true`.
+`src/_includes/thirdparty-disclosure.njk`'s `if ads.pub` block gains a
+paragraph stating GPC is honoured as an automatic opt-out, with a mention of
+the "Do Not Sell or Share My Personal Information" link for visitors whose
+browser doesn't send it. `src/_data/adsAudit.js` adds a `gpcHandled` check
+(same `readFileSync` pattern as the existing CSP check) and `src/audit.njk`
+surfaces it as a new Ads-panel row plus a manual-checklist line.
+`add-ons/ads/README.md` step 5 adds the **US state regulations** Privacy &
+messaging message alongside the GDPR one; the baseline-machinery list notes
+the GPC handling now in `site.js`; step 7's manual verify list gains the GPC
+check.
+
+### stacks/eleventy-netlify.md
+
+Documents the mechanism above under `#privacy` and `#ads`, and adds a
+correction while touching the push-loop bullet: the prior text claimed the
+push was "guarded on the loader having defined `window.adsbygoogle`" — the
+code has never done that (it sets `window.adsbygoogle = window.adsbygoogle
+|| []` itself and pushes in a `try`/`catch`); the bullet now describes the
+actual mechanism instead of the stale claim.
+
+### stacks/sveltekit-netlify.md, stacks/phoenix.md
+
+Document the same `#privacy`/`#ads` mechanism for each stack's own template
+shape — no template change in either (neither builds ads today).
+`stacks/sveltekit-netlify.md` notes the unit-push code sets the attribute
+client-side, or `hooks.server.ts` can read `Sec-GPC` for a server-rendered
+route. `stacks/phoenix.md` documents both a client-side hook/`app.js` check
+and a server-side option: a plug reading `Sec-GPC: 1` into a
+`conn.assigns.gpc?` so server-rendered ad units and sharing analytics can
+respect it without reaching the client-side hook at all.
+
+**Adopter action (eleventy, ad-running or sharing-analytics projects):**
+`npm update @piercebarney/whs-eleventy`; re-copy the `static/site.js` push
+loop (adds the GPC attribute) and the `thirdparty-disclosure.njk` GPC
+paragraph from this repo; in the AdSense dashboard, enable the "US state
+regulations" Privacy & messaging message alongside the existing GDPR one;
+re-pin `standard-version` to `2026-10-09` once done. Projects with `ads:
+none` and no sale/sharing analytics: pin update only, no code change
+required.
+
 ## 2026-10-08 [breaking]
 
 ### core: rendering

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-10-08 · **Status:** active
+**Version:** 2026-10-09 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -660,6 +660,13 @@ generated from the origin manifest, never hand-written.
 - **Display advertising (`#ads`)** always requires a provider-certified CMP and
   always sets cookies — it is never the privacy-first path. A site that runs ads
   has a consent banner by necessity.
+- **Global Privacy Control.** A site running display ads or analytics that
+  sells/shares personal data honours the GPC signal — `navigator.globalPrivacyControl`
+  in the browser, or the `Sec-GPC: 1` request header where a server renders —
+  as an automatic opt-out of sale, sharing, and targeted advertising: no click
+  required, and sharing analytics does not load for a GPC visitor. The privacy
+  page states that GPC is honoured. Required by US state privacy laws, which
+  apply by where the visitor lives, not the site's own location.
 - The privacy page renders from the origin manifest (`#third-parties`) — the
   list of who sees visitor data and why. No hand-written prose enumerating
   services that goes stale when a dependency changes.
@@ -675,7 +682,8 @@ generated from the origin manifest, never hand-written.
   use.
 
 **Verify.** The privacy page's third-party list is generated. Review confirms
-any analytics is privacy-first or gated behind a CMP.
+any analytics is privacy-first or gated behind a CMP, and that the privacy
+page states GPC is honoured wherever it applies.
 
 **Implementation.** See your stack's impl doc, same slug.
 
@@ -699,7 +707,11 @@ ad directives, and documented.
   non-personalized only where the provider supports it). Whether the prompt
   shows to every visitor or only to visitors in regulated regions is a project
   decision recorded in `CLAUDE.md`. What is **non-compliant** regardless: the ad
-  loader firing and setting cookies before the CMP has resolved.
+  loader firing and setting cookies before the CMP has resolved. The same gate
+  extends to the US-state opt-out (`#privacy`): a visitor sending GPC gets
+  restricted / non-personalized ad requests automatically, and the certified
+  CMP also presents the US-state "Do Not Sell or Share My Personal
+  Information" opt-out.
 - **Declared (`#third-parties`).** Every ad-provider origin (loader, ad-serving,
   ad iframes, the CMP, quality/verification endpoints) is in the origin manifest
   with `purpose: advertising` and its `dataSeen`. The privacy page renders it
@@ -750,8 +762,9 @@ the declared ad origins; any `'unsafe-*'` exception noted; the loader gated on
 link/reference check (`#internal-links`) fails on any
 `adsbygoogle` / ad-provider reference in a non-production build and on a missing
 `ads.txt` in the production output. Manually, in a fresh browser on production:
-decline consent → no ad requests in the network panel; accept → ads load; check
-CLS in the browser's own tools.
+decline consent → no ad requests in the network panel; accept → ads load; with
+GPC on (`navigator.globalPrivacyControl`) → ad requests are restricted /
+non-personalized; check CLS in the browser's own tools.
 
 **Implementation.** See your stack's impl doc, same slug.
 
@@ -1480,7 +1493,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-10-08  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-10-09  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above