The HoopAI website has an integration-ready analytics layer with explicit consent as its default, while PostHog and session replay remain disabled pending approval. The implementation prepares GA4 and PostHog event handling across both live page shells, strips captured Webflow trackers to prevent duplicates, filters sensitive values, and isolates preview hosts. This is privacy and website instrumentation work. It does not mean that a new provider, replay system, or visitor-facing consent interface is active.
One analytics seam across the site
A shared SiteAnalytics integration point runs across MarketingShell and CloneShell. That gives passthrough and CMS pages one place for provider startup and semantic events. Imported Webflow analytics scripts remain stripped so the same page view or conversion is not sent through two independent paths.
The runtime defines stable events for calls to action, form starts, submission attempts, experiment exposure, and approved custom conversions. It also normalizes common destination links and supports explicit data attributes where a page needs a more precise label. URL query strings and sensitive event properties are filtered, and forms are excluded from PostHog autocapture.
Explicit consent as the default
Provider loading begins from a denied state until a visitor grants permission through an approved path. Grant, deny, withdrawal, and reset functions are available through the site's analytics API. Global Privacy Control and Do Not Track also begin denied. Production host allowlisting keeps local and preview traffic from entering the live dataset unless QA is intentionally enabled.
This default is stronger than relying on a provider key alone. The integration requires both configuration and consent before startup. Withdrawal updates consent state and removes relevant analytics cookies. Automated QA verifies that no provider request occurs before consent and that initialization happens once after a grant.
What remains disabled
PostHog remains off without an enabled flag and a public project key. Session replay has a separate disabled flag and stays off even if other PostHog functions are later activated. The decision record also states that there is no consent banner yet because privacy copy, a cookie policy, and the visitor-facing design have not received approval.
Integration-ready therefore describes tested code paths, not active collection. No account key should be interpreted as permission to start replay. The source record requires a separate review of every form and embed, plus confirmation of query-string and network redaction, before replay can be considered.
Approval gates before activation
Activation requires an approved privacy and cookie policy, an approved consent interface or consent-management platform, correct public configuration, and named production goals. The consent control must connect to the existing grant, deny, and reset functions. Business events should be defined deliberately rather than treating broad autocapture as the permanent measurement contract.
Session replay has its own gate after base analytics is proven. Reviewers must inspect forms, embedded tools, input masking, URLs, and network data before changing its flag. The existing QA covers consent, provider startup, events, withdrawal, shell coverage, experiment overrides, host isolation, and console errors. Passing those checks establishes technical readiness while the privacy approvals continue to control activation.
