analytics-privacy

"Analytics package exists" is not "analytics behavior is understood and appropriately disclosed or gated". This skill establishes what each measurement tool does.

Activate when

An analytics, ad, replay, heatmap, A/B, or tag-manager tool appears in source or network traffic.
Someone asks whether tracking is disclosed or gated, or is about to add a new tool.
Not to choose or install an analytics product. Not to rule on legal necessity.

Inspect

Inventory (SOURCE-INDICATED). Snippets, SDK imports, framework integrations (Vercel Analytics, next/script with GTM), env vars naming property IDs, server-side event senders. For each: vendor, purpose (as documented), configuration (autocapture? session replay? IP handling? identify calls with user data? cross-site sharing? Google Signals/advertising features?). 1b. Telemetry and hidden measurement. Framework and platform telemetry that reaches vendors from the visitor's browser (web-vitals reporters, Vercel/Cloudflare analytics, Sentry performance/replay, feature-flag SDKs that phone home, error trackers capturing user context), plus fingerprinting-like signals (canvas/font/hardware probing, device-ID libraries). Treat each as a measurement tool: what does it send, when, and is it disclosed? IP address and user agent reach the vendor on every request.
Runtime (OBSERVED). node scripts/observe-runtime.mjs --url <site> --settle 2000 (paths relative to this skill's folder). Read: vendors contacted at initial (before interaction), cookies with tracking-style names, and later snapshots after actions. Repeat on the key pages, not only the home page. Use --block-third-party to observe attempts safely; use a staging origin without it when the tag manager's downstream tags matter.
What they receive. Look for personal data leaking to analytics: emails or names in URLs or query strings, user IDs sent via identify, form field contents captured by autocapture/replay, sensitive page content captured by replay (password fields, payment fields, health/finance data). With a local/staging form: run a submit step with --canary (planted fake identity) and check CANARY_SENT_TO_THIRD_PARTY and CANARY_IN_URL.
Timing and gating. What fires before any choice? After reject? After accept? (consent-management owns the control; you own the measurement facts.)
Disclosure. Compare with the privacy/cookie notice: is each observed vendor named, with purpose? Is anything claimed that does not occur ("we don't use analytics" while a pixel loads)?