utm_source
Read only after attribution consent and held only for the active browser session.
Analytics choice
Optional measurement needs an explicit yes.
Essential website operation does not depend on analytics. Optional events contain no user, session or device identifier, no free text and no academic, contact, payment or wellbeing record.
Minimal envelope
What an optional event can contain.
The server rejects unknown fields, query-bearing paths, identifiers, stale timestamps and unsupported experiment data before any sink call.
{
"schema_version": "1.0",
"event_name": "page_view",
"occurred_at": "ISO-8601 timestamp",
"path": "/public-route",
"surface": "public_website",
"action": "route_view",
"consent_version": "2026-07-24"
}Attribution boundary
Three session-only labels.
No click identifier, referral code, raw referrer, full URL, cross-domain token or private-route attribution is permitted.
utm_medium
Read only after attribution consent and held only for the active browser session.
utm_campaign
Read only after attribution consent and held only for the active browser session.
Standing boundary
What this website will not do
These 15 hold whatever you choose above. They are held in the registry the site reads, so removing one is a decision rather than an edit.
- Turn analytics on before you have said yes.
- Follow you across other websites.
- Build an advertising profile of you.
- Fingerprint your device.
- Record and replay your session.
- Keep a permanent anonymous identifier for you.
- Run an experiment on you without saying so.
- Let an experiment declare its own winner.
- Personalise anything from sensitive data on its own.
- Apply a moderation penalty automatically.
- Publish a claim or a price without a person approving it.
- Show a live growth metric in public.
- Promise that alerting covers everything.
- Promise a response time.
- Let an operating job approve its own work.