Consent banner is present for cookie-based analytics

Deploying cookie-based analytics (GA4, Mixpanel, Amplitude, Segment) without a consent banner violates GDPR Art. 6 and Art. 7 for EU/EEA visitors and CCPA §1798.120 for California residents. Regulators treat the absence of a consent mechanism as a strict liability violation — no harm needs to be proved. DPA enforcement actions have resulted in fines up to 4% of global annual turnover. Beyond legal exposure, analytics data collected without lawful basis cannot be legally used and may need to be deleted entirely.

Integrate a consent management platform or build a minimal consent banner before loading any cookie-based analytics script. The simplest compliant path is a third-party CMP (CookieYes, Cookiebot) that handles jurisdiction detection and record-keeping automatically. If building in-house, gate analytics initialization inside the banner's accept handler:

// components/CookieBanner.tsx
'use client'
export function CookieBanner() {
  return (
    <div>
      <p>We use analytics cookies to understand how visitors use this site.</p>
      <button onClick={() => {
        localStorage.setItem('analytics_consent', 'true')
        initAnalytics()
      }}>Accept</button>
      <button onClick={() => localStorage.setItem('analytics_consent', 'false')}>Decline</button>
    </div>
  )
}

Alternatively, switch to a cookie-free tool (Plausible, Fathom) and eliminate the consent requirement entirely.