[raferdev]

Why

Almost nobody clicked Accept or Decline, and with opt-in consent that meant GA saw next to no visits.

What changed

• Default on. GA runs on page load, and the banner becomes a notice with OK / No thanks (OK / Não, obrigado). Its copy no longer says "nothing loads unless you say yes".
• Privacy signals respected. A browser sending Global Privacy Control or Do Not Track starts with analytics off. It turns on only if the visitor clicks OK.
• Opting out works in place. No thanks sets GA's ga-disable-<ID> flag, updates consent to denied and deletes the _ga cookies, with no page reload. Opting back in resumes the same tag.
• Privacy policy (EN/PT). The legal basis moves from consent (LGPD art. 7, I) to legitimate interest (art. 7, IX). The policy describes the opt-out and the privacy signals, and its date is bumped. README updated.
• Tests never reach GA. Pages now start analytics without a click, so the Playwright config blocks the Google Analytics hosts for every test. I checked that a fetch to both hosts fails inside the test browser.

Reviewer notes

• Legal trade-off. Opt-out on legitimate interest is defensible under the LGPD for a site that is minimal, has no ads and makes opting out easy. Visitors from the EU, under GDPR/ePrivacy, would strictly need opt-in for analytics cookies.
• Verification. The full suite (216 tests) passes against the nginx test container. The banner was checked visually in EN light (desktop) and PT dark (mobile).

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: b10738b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
landing-page	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR