Load gtag.js only after the visitor accepts

[korya]

Problem

The demo now reports visitors to Google who pressed Decline. Since #216 made the GA4 tag work, it runs in Google's advanced consent mode: loaded for everyone with storage denied, sending cookieless pings that still carry page URL, referrer, device and IP — for people who said no.

The privacy policy promises the opposite, in as many words:

"Until you accept, no analytics cookies are set and no measurement data is collected."
"Google Analytics receives demo-site usage data, but only from visitors who accepted analytics. Decline and it receives nothing."

The contradiction was dormant while the tag was inert. It went live when #216 merged, which is why this follows immediately behind it.

Solution

Load gtag.js only once the visitor accepts, so nothing Google-bound is requested before that — not the collector, and not the script itself.

Before / after, for a visitor who declines:

before:  page load → gtag.js fetched → cookieless page_view to Google  (gcs=G100)
after:   page load → nothing

The accepting path is unchanged in substance: the same batch is queued — denial default → grant → js → config — and then the tag is fetched, measuring identically at gcs=G101, with ad storage still denied for someone who only agreed to analytics. I verified that ordering end to end in a live browser before writing the change. This also matches qr-code-gen.frontsail.app, whose implementation already worked this way.

What we give up is Google's behavioural modelling of non-consenting visitors, which needs 1,000 analytics_storage='denied' events per day for 7 days before it engages. The demo is orders of magnitude below that, so those pings bought nothing and cost a promise.

bootCommands and loadTag lose their stored parameter — both are now reached only after consent — so the grant is unconditional and grantConsent is gone. Two unit tests went with it: "an unanswered visitor is never silently granted" and "a returning refuser stays denied with no update" asserted branches that no longer exist. The guarantee they approximated is now checked where it is observable: e2e asserts that a decliner, and a visitor who ignores the banner, produce no Google-bound request at all — on that visit or the next.

Verified by breaking the code it guards: reverting the gate in main.ts fails exactly those two silence tests and nothing else.

No visual change — the banner, its copy, and the stored-choice behaviour are untouched.

Other Changes

• DEMO-19 now states both halves of the contract: that measurement happens for an accepting visitor, and that silence is real for everyone else. It also records why advanced consent mode was rejected, so the next person doesn't "upgrade" back into the contradiction.

Related:

• Push gtag commands as arguments so GA4 actually records #216

🤖 Generated with Claude Code

[github-actions]

🚀 Preview deployed for e36ac33: https://aspicio-demo-m3evgisx9-dmitri-k-s-projects.vercel.app (Vercel login required)

[github-actions]

🛠️ API preview deployed for e36ac33: https://aspicio-c4admxmg2-dmitri-k-s-projects.vercel.app (Vercel login required)