The Visibility State Transition: Measuring Page Views Without Beacons You Can Trust
pagehide, visibilitychange, and the Beacon API each behave differently across browsers. Here's how to record a session end reliably without cookies or persistent identifiers.
Read more →The Sec-GPC Header Is Now Everywhere: Server-Side Detection for Analytics
Global Privacy Control ships as the Sec-GPC request header on every request. Here is how to read it at the edge and honour it in a cookieless analytics pipeline.
Read more →Timing-Allow-Origin: What Analytics Sees in the Resource Timing API
The Timing-Allow-Origin header controls how much cross-origin timing detail a page can read. Here is what it means for privacy-first performance measurement.
Read more →Speculation Rules and Prerendering: What Analytics Gets Wrong About Prefetched Pages
Chrome's Speculation Rules API can render a page before a user ever clicks. Here's how it distorts naive analytics — and how cookieless, edge-based measurement stays honest.
Read more →Your Analytics Script Is Probably Disabling the Back/Forward Cache
The back/forward cache makes back-button navigations near-instant, but one unload listener disables it for the whole page. Tracking scripts are the usual culprit — and CrUX now measures the damage.
Read more →GDPR Data Transfers Are the One Compliance Risk You Can Architect Away
The EU-US Data Privacy Framework survived its first court challenge but is now on appeal to the CJEU. Analytics that never transfers EU data to the US has nothing to lose either way.
Read more →The EDPB's 2026 Enforcement Target Is Your Privacy Notice
The EDPB's 2026 coordinated action audits transparency under GDPR Articles 12–14. The shortest path through it is collecting so little that the notice writes itself.
Read more →Your Analytics Script Is the Hole in Your Content-Security-Policy
A strict CSP closes XSS. A third-party analytics tag reopens it. Here is why host allowlists and missing SRI undermine your policy — and what a first-party tracker fixes.
Read more →Privacy by Default at the HTTP Layer: Headers That Shrink Your Tracking Surface
Two response headers — Permissions-Policy and Referrer-Policy — decide how much your pages can leak to ad-tech and third parties. Set them once and the surveillance surface closes by default.
Read more →