Analytics and experimentation code looks low-risk (it doesn't change what users see) but is exactly where silent, expensive failures accumulate: schema drift that zeroes a KPI dashboard for weeks, sample-ratio mismatch that invalidates a whole test, and unconsented tracking that creates real compliance exposure. This skill exists to apply a measurement-integrity and privacy review before ship, not after a stakeholder notices the dashboard looks wrong.
\nUse this skill when the user asks to:
\nfrontend-observability-rum-instrumentation.frontend-dom-xss-csp-review; this skill only reviews the analytics/experimentation-specific privacy surface (consent gating and PII-in-events), not the broader page security model.Analytics vendor SDKs (GA4/gtag.js, feature-flag/experimentation platforms) change event-parameter names, consent-mode signal shapes, and SDK method signatures across versions, and memorized snippets go stale fast. Before making any platform-specific claim:
\nToolSearch with query \"context7\" (or \"select:mcp__Context7__resolve-library-id,mcp__Context7__query-docs\") to load the Context7 tools if not already loaded this session.mcp__Context7__resolve-library-id for the specific analytics/experimentation library actually imported in the code under review (e.g. the GA4/gtag.js SDK, a specific feature-flag/experiment SDK) before describing its event or bucketing API. Do not assume GA4 by default — verify the platform from the actual import/script-tag evidence first.mcp__Context7__query-docs for the specific mechanism in scope — e.g. \"GA4 recommended event parameters for purchase event\", \"Google Consent Mode v2 signal defaults\", \"GA4 measurement protocol event schema limits\" — before ruling on it. Verified library ID for web.dev platform guidance as of this skill's updated date: /websites/web_dev_articles.updated date: web.dev documents sending web-vitals metrics to GA4 via gtag('event', 'web_vitals', {...}) with name/value/delta/id/label fields, and shows GA4 BigQuery-export event tables keyed by event_name/event_params/event_timestamp/user_pseudo_id — treat any schema claim about GA4's exported event shape as needing this structure, not an invented one. web.dev's Permissions API guidance (permissions-best-practices) documents navigator.permissions.query({name: ...}) returning a state of granted/denied/prompt, and states permission grants are scoped per-origin (a grant on one origin does not transfer to a subdomain/different origin) — apply the same non-transferability logic when reasoning about consent scope across subdomains.official_docs / references/*.md and mark the claim documentation-based (Context7 unavailable) rather than presenting it as freshly verified.references/srm-and-bucketing-integrity.md only when auditing assignment/bucketing logic or diagnosing a suspected sample-ratio mismatch.references/consent-and-pii-in-events.md only when reviewing privacy/consent compliance of tracking calls or event payload PII exposure.references/stopping-rules-and-peeking.md only when evaluating whether an experiment's statistical significance claim or stop/continue decision is valid.The generic consent/PII posture above (banner presence is not compliance, check the call site) covers the baseline. Some tracking changes need standard-specific depth: IAB TCF v2.2 purpose-granular consent, Google Consent Mode v2's default-denied timing requirement, and adjacent surfaces (Global Privacy Control/Do-Not-Track, cookie categorization, analytics-endpoint data residency) that a generic consent check can miss.
\ngtag('consent', 'default', {analytics_storage: 'denied', ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied'}) must be set at the top of the page, before the gtag.js/GTM snippet loads and before any gtag('event', ...) call — not inside a CMP callback or an async-loaded script. A later gtag('consent', 'update', ...) call once the user answers the CMP does not retroactively fix a missing or async default; tags may already have fired under an undefined/permissive state.(vendorId, purposeId) grant from the decoded TC string — \"a TC string cookie exists\" is presence, not scope. A vendor consented for one purpose (e.g. measurement) is not automatically consented for another (e.g. personalized ads).gtag, sendBeacon, fetch — that fires before a consent signal exists is unrecoverable exposure: unlike a suppressed JS event, an HTTP request (and any PII in its query string or body) cannot be un-sent once it leaves the client.Max-Age/Expires or a category mapping.navigator.globalPrivacyControl) and Do-Not-Track (navigator.doNotTrack) must be checked as an opt-out signal alongside explicit CMP consent, not replaced by it.references/privacy-consent-depth-for-analytics.md when a review needs this standard-specific depth (Consent Mode v2 timing, TCF purpose/vendor granularity, GPC/DNT, cookie categorization, data residency) rather than the general consent/PII check alone.Load these only when needed:
\nReturn, at minimum:
\n