diff --git a/go.mod b/go.mod
index a6e1b95f..01c11204 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	golang.org/x/crypto v0.55.0
+	golang.org/x/crypto v0.56.0
 	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/go.sum b/go.sum
index 66a6ee20..82173aec 100644
--- a/go.sum
+++ b/go.sum
@@ -77,8 +77,8 @@ github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
diff --git a/site/src/components/Analytics.astro b/site/src/components/Analytics.astro
index a6393151..9e40de78 100644
--- a/site/src/components/Analytics.astro
+++ b/site/src/components/Analytics.astro
@@ -2,7 +2,7 @@
 // Google Analytics 4, on the terms this product argues for everywhere else.
 //
 // A documentation site for a tool whose pitch is "we do not silently claim
-// anything" cannot ship tracking that behaves like everyone else's. Four rules
+// anything" cannot ship tracking that behaves like everyone else's. Five rules
 // follow from that, and each is enforced here rather than left to a setting in
 // a console nobody in this repository can read:
 //
@@ -10,21 +10,49 @@
 //      That is the state for `npm run dev`, for `just check`, for CI, and for
 //      anyone who builds this site from a fork. Analytics belongs to whoever
 //      runs onebox.run, not to the source.
-//   2. Cookieless. `client_storage: "none"` keeps GA4 from writing `_ga`, which
-//      is what makes a consent banner necessary in the first place. Page views
-//      still count; returning readers are simply not re-identified. A banner
-//      asking permission to do something the site does not need to do would be
-//      the same failure this product refuses elsewhere.
+//   2. Nothing reaches Google until measurement is allowed: no tag, no
+//      request, no identifier. One request is made before the answer is
+//      known, and it goes to this site's own /cdn-cgi/trace to find out
+//      whether the question has to be asked at all -- see below.
 //   3. No advertising signals. Google Signals and ad personalisation are off,
 //      so the traffic here is not joined to an advertising profile.
 //   4. Do Not Track and Global Privacy Control are honoured before the script
 //      loads, not after. A reader who has asked not to be measured generates no
-//      request to Google at all.
+//      request to Google at all, and is never asked the question either.
+//   5. Withdrawal works. The control on /privacy revokes what acceptance set.
 //
-// The query string is dropped from the recorded location. Documentation URLs
-// carry nothing sensitive today, but this repository's whole position on
-// secrets is that "nothing sensitive is in there today" is not a property you
-// get to assume — verifyURL redacts queries for exactly this reason.
+// Rule 2 replaces what this file used to do. It loaded gtag on every page and
+// then held it in Consent Mode's denied state, which was described here as
+// being cookieless — true, and the reason given was that a banner asking to do
+// something the site does not need to do would be the failure this product
+// refuses elsewhere. That argument was right about banners and wrong about what
+// it bought. Denied mode still sent a hit for every page view; it simply sent
+// one with no stable client id, so every view arrived as a new user in a new
+// session. The site shipped Google's tag to every reader and got numbers in
+// which users, sessions and returning readers were all noise. Refusing to ask
+// is only principled when the answer is that nothing is collected, and
+// something was.
+//
+// So the question is asked, but only of the readers who are owed it. The EEA,
+// the UK and the Crown Dependencies require permission before an analytics
+// identifier is stored; elsewhere measurement may run with a way to turn it
+// off. Cloudflare already knows which applies and says so at /cdn-cgi/trace, so
+// most readers are measured properly and never see a banner. A failed or
+// unavailable lookup asks — the safe direction, and what a build outside
+// Cloudflare gets.
+//
+// The query string is dropped from the recorded location, and the referrer is
+// reduced to its origin. Documentation URLs carry nothing sensitive today, but
+// this repository's whole position on secrets is that "nothing sensitive is in
+// there today" is not a property you get to assume — verifyURL redacts queries
+// for exactly this reason.
+//
+// The preference lives in localStorage rather than a cookie, so declining
+// stores nothing that travels with a request, and every other open tab is told
+// about the change and acts on it. A browser that refuses storage entirely
+// keeps the answer in memory instead, where it governs the page it was given on
+// and no other -- the direction that does not weaken the gate, but not one to
+// describe as mirrored.
 //
 // The script body below is written as the element's plain text content, with no
 // `{...}` expression and no backticks around it. Astro treats script children as
@@ -59,49 +87,278 @@ const enabled = Boolean(measurementId) && import.meta.env.PROD;
   enabled && (
     <script is:inline define:vars={{ measurementId }}>
       (function () {
+        var STORAGE_KEY = "onebox.analytics-consent.v1";
+        var PREFERENCE_EVENT = "onebox:analytics-preference";
+
+        // The EEA, the UK and the Crown Dependencies: the places that require
+        // permission before a browser stores an analytics identifier. A country
+        // this list does not name gets measurement with an opt-out instead.
+        var PRIOR_CONSENT = [
+          "AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE",
+          "GR", "HU", "IE", "IT", "LV", "LT", "LU", "MT", "NL", "PL", "PT",
+          "RO", "SK", "SI", "ES", "SE", "IS", "LI", "NO",
+          "GB", "GG", "IM", "JE",
+        ];
+
+        var memoryPreference = null;
+        var started = false;
+        var requirementPromise = null;
+
         // Asked not to be tracked, in any of the spellings a browser uses.
         // Firefox before 32 and Safari answered "yes" where everything modern
         // answers "1", and a reader who opted out on an older browser is
         // exactly the reader least willing to be measured. Checked before the
         // tag is inserted, so honouring the request means no request rather
         // than a discarded one.
-        var signals = [navigator.doNotTrack, window.doNotTrack, navigator.msDoNotTrack];
-        for (var i = 0; i < signals.length; i++) {
-          if (signals[i] === "1" || signals[i] === "yes") return;
+        function signalsRefusal() {
+          var flags = [navigator.doNotTrack, window.doNotTrack, navigator.msDoNotTrack];
+          for (var i = 0; i < flags.length; i++) {
+            if (flags[i] === "1" || flags[i] === "yes") return true;
+          }
+          return navigator.globalPrivacyControl === true;
         }
-        if (navigator.globalPrivacyControl === true) return;
-
-        window.dataLayer = window.dataLayer || [];
-        function gtag() { window.dataLayer.push(arguments); }
-        window.gtag = gtag;
-
-        // Consent Mode, declared before anything else, is what actually stops
-        // GA4 writing cookies. Passing `client_storage: "none"` to config does
-        // not: gtag does not recognise it there and forwards it as a custom
-        // event parameter, so every hit carried `ep.client_storage=none` while
-        // `_ga` and `_ga_<id>` were set anyway. Measured in a real browser, not
-        // assumed — the first version of this file claimed to be cookieless and
-        // was not.
-        gtag("consent", "default", {
-          analytics_storage: "denied",
-          ad_storage: "denied",
-          ad_user_data: "denied",
-          ad_personalization: "denied",
-        });
 
-        gtag("js", new Date());
-        gtag("config", measurementId, {
-          allow_google_signals: false,
-          allow_ad_personalization_signals: false,
-          // The path without its query string. See the note in the component
-          // source for why the query goes even though nothing secret is in it.
-          page_location: window.location.origin + window.location.pathname,
+        function readPreference() {
+          try {
+            var stored = window.localStorage.getItem(STORAGE_KEY);
+            return stored === "granted" || stored === "denied" ? stored : null;
+          } catch (_) {
+            // A locked-down browser throws on access rather than returning
+            // null. The in-memory answer still governs this page.
+            return memoryPreference;
+          }
+        }
+
+        function writePreference(preference) {
+          memoryPreference = preference;
+          try {
+            window.localStorage.setItem(STORAGE_KEY, preference);
+          } catch (_) {
+            // Storage is unavailable; the choice holds for this page only,
+            // which is the direction that does not weaken the gate.
+          }
+          apply();
+          window.dispatchEvent(new Event(PREFERENCE_EVENT));
+        }
+
+        function consentRequirementFor(country) {
+          if (!country || country === "XX" || country === "T1") return "required";
+          return PRIOR_CONSENT.indexOf(country) === -1 ? "not_required" : "required";
+        }
+
+        function consentRequirement() {
+          if (requirementPromise) return requirementPromise;
+          requirementPromise = window
+            .fetch("/cdn-cgi/trace", {
+              cache: "no-store",
+              credentials: "omit",
+              headers: { Accept: "text/plain" },
+            })
+            .then(function (response) {
+              if (!response.ok) throw new Error("trace " + response.status);
+              return response.text();
+            })
+            .then(function (trace) {
+              var match = trace.match(/^loc=([A-Z0-9]{2})$/m);
+              return consentRequirementFor(match ? match[1] : null);
+            })
+            .catch(function () {
+              return "required";
+            });
+          return requirementPromise;
+        }
+
+        function gtag() {
+          window.dataLayer.push(arguments);
+        }
+
+        function referrerOrigin() {
+          if (!document.referrer) return "";
+          try {
+            return new URL(document.referrer).origin;
+          } catch (_) {
+            return "";
+          }
+        }
+
+        function start() {
+          // Above the stored preference on purpose: a browser-level refusal is
+          // not overridden by a click on this site's own control.
+          if (signalsRefusal()) return;
+
+          window["ga-disable-" + measurementId] = false;
+
+          // Allowing after declining, without leaving the page. The tag is
+          // already loaded and must not be configured twice, but the state
+          // stop() left behind is exactly what has to be undone: clearing the
+          // disable flag above and re-granting here.
+          if (started) {
+            gtag("consent", "update", { analytics_storage: "granted" });
+            return;
+          }
+          started = true;
+
+          window.dataLayer = window.dataLayer || [];
+          window.gtag = gtag;
+
+          gtag("consent", "default", {
+            analytics_storage: "denied",
+            ad_storage: "denied",
+            ad_user_data: "denied",
+            ad_personalization: "denied",
+          });
+          // The tag exists only on the path where measurement is allowed, so
+          // this is the state it is created in rather than a later upgrade.
+          gtag("consent", "update", { analytics_storage: "granted" });
+          gtag("set", "ads_data_redaction", true);
+          gtag("js", new Date());
+          gtag("config", measurementId, {
+            allow_google_signals: false,
+            allow_ad_personalization_signals: false,
+            cookie_flags: "SameSite=Lax;Secure",
+            // The path without its query string, and the referring site
+            // without the rest of its URL. See the note in the component
+            // source for why the query goes even though nothing secret is in
+            // it.
+            page_location: window.location.origin + window.location.pathname,
+            page_referrer: referrerOrigin(),
+          });
+
+          var tag = document.createElement("script");
+          tag.async = true;
+          // Every current browser defaults to strict-origin-when-cross-origin,
+          // which already keeps the path and query out of the `Referer` on this
+          // request. Stating it means the guarantee this file makes about query
+          // strings is the file's own rather than one inherited from whatever
+          // default the reader's browser happens to ship.
+          tag.referrerPolicy = "strict-origin";
+          tag.src =
+            "https://www.googletagmanager.com/gtag/js?id=" + encodeURIComponent(measurementId);
+          document.head.appendChild(tag);
+        }
+
+        // Withdrawal has to actually remove what acceptance stored, or the
+        // control is a checkbox that lies. The disable flag stops a tag that is
+        // already on the page from sending anything further.
+        function stop() {
+          window["ga-disable-" + measurementId] = true;
+          if (window.gtag) {
+            window.gtag("consent", "update", {
+              analytics_storage: "denied",
+              ad_storage: "denied",
+              ad_user_data: "denied",
+              ad_personalization: "denied",
+            });
+          }
+          var names = ["_ga", "_ga_" + measurementId.replace(/^G-/, "")];
+          for (var i = 0; i < names.length; i++) {
+            document.cookie = names[i] + "=; Max-Age=0; Path=/; SameSite=Lax; Secure";
+            document.cookie =
+              names[i] +
+              "=; Max-Age=0; Path=/; Domain=." +
+              window.location.hostname +
+              "; SameSite=Lax; Secure";
+          }
+        }
+
+        function mayRun(requirement, preference) {
+          if (preference === "granted") return true;
+          return requirement === "not_required" && preference !== "denied";
+        }
+
+        function banner() {
+          return document.getElementById("ob-analytics-consent");
+        }
+
+        function apply() {
+          var preference = readPreference();
+          if (preference === "denied") {
+            stop();
+            var element = banner();
+            if (element) element.hidden = true;
+            return;
+          }
+          if (preference === "granted") {
+            start();
+            var accepted = banner();
+            if (accepted) accepted.hidden = true;
+            return;
+          }
+          consentRequirement().then(function (requirement) {
+            if (readPreference() !== null) return;
+            if (mayRun(requirement, null)) {
+              start();
+              return;
+            }
+            var prompt = banner();
+            if (prompt) prompt.hidden = false;
+          });
+        }
+
+        // The privacy page's control and the banner both drive the same state.
+        window.oneboxAnalytics = {
+          preference: readPreference,
+          setPreference: writePreference,
+          requirement: consentRequirement,
+          refused: signalsRefusal,
+          subscribe: function (onChange) {
+            window.addEventListener(PREFERENCE_EVENT, onChange);
+            window.addEventListener("storage", function (event) {
+              if (event.key === STORAGE_KEY || event.key === null) onChange();
+            });
+          },
+        };
+
+        function ready(run) {
+          if (document.readyState === "loading") {
+            document.addEventListener("DOMContentLoaded", run, { once: true });
+          } else {
+            run();
+          }
+        }
+
+        if (signalsRefusal()) {
+          // Neither measured nor asked. The banner stays in the document,
+          // hidden, so nothing depends on it having rendered.
+          //
+          // Revoked as well, because the signal can be switched on by a reader
+          // who allowed measurement before it was. Not loading the tag stops
+          // the next hit, but the identifier that acceptance stored is still in
+          // the browser and would still be there to resume from if the signal
+          // were ever switched off -- which joins the sessions either side of a
+          // refusal into one returning reader. The stored preference is left
+          // alone: consent is still granted, so lifting the signal measures
+          // again, under a new identifier rather than the old one.
+          stop();
+          ready(function () {
+            var element = banner();
+            if (element) element.hidden = true;
+          });
+          return;
+        }
+
+        // A choice made in one tab has to reach the tab that is being measured.
+        // `storage` fires in every tab but the one that wrote, so this is the
+        // only place the two are joined, and leaving it out is worse than a
+        // stale display: the withdrawing tab deletes the cookies, and the tab
+        // still running the tag writes them again on its next event and carries
+        // on measuring until something navigates it. A null key is the clear()
+        // case, where the preference is gone rather than changed.
+        window.addEventListener("storage", function (event) {
+          if (event.key === STORAGE_KEY || event.key === null) apply();
         });
 
-        var tag = document.createElement("script");
-        tag.async = true;
-        tag.src = "https://www.googletagmanager.com/gtag/js?id=" + encodeURIComponent(measurementId);
-        document.head.appendChild(tag);
+        ready(function () {
+          var element = banner();
+          if (element) {
+            element.addEventListener("click", function (event) {
+              var button = event.target instanceof Element && event.target.closest("button");
+              if (!button || !button.dataset.consent) return;
+              writePreference(button.dataset.consent);
+            });
+          }
+          apply();
+        });
       })();
     </script>
   )
diff --git a/site/src/components/AnalyticsConsent.astro b/site/src/components/AnalyticsConsent.astro
new file mode 100644
index 00000000..d875da08
--- /dev/null
+++ b/site/src/components/AnalyticsConsent.astro
@@ -0,0 +1,149 @@
+---
+/* The consent prompt, for readers whose location requires one.
+ *
+ * Markup only. Analytics.astro decides whether this is ever shown and handles
+ * the clicks: this renders hidden and is revealed by that script alone, once it
+ * has either a stored preference or an answer from the location lookup. Putting
+ * the logic in two places is how the banner ends up shown to someone who
+ * already declined.
+ *
+ * It renders on every page rather than only where the site footer does, because
+ * a reader who arrives from a search result lands on a documentation page, and
+ * a consent prompt that only appears on the landing page asks the question of
+ * the wrong half of the audience.
+ *
+ * `hidden` in the source, not `display: none` in a stylesheet: the prompt is
+ * absent for the reader whose location does not require it and for the reader
+ * who has already answered, and neither should see it flash while a stylesheet
+ * loads. A build without a measurement id never renders it at all.
+ */
+const enabled =
+  Boolean(import.meta.env.PUBLIC_GA_MEASUREMENT_ID?.trim()) && import.meta.env.PROD;
+---
+
+{
+  enabled && (
+    <section
+      id="ob-analytics-consent"
+      class="ob-consent"
+      role="region"
+      aria-labelledby="ob-consent-title"
+      hidden
+    >
+      <div class="ob-consent-body">
+        <p id="ob-consent-title" class="ob-consent-title">Analytics on this site</p>
+        <p class="ob-consent-copy">
+          Onebox would like to count visits and which pages get read, using Google Analytics.
+          Nothing about the servers you deploy to is involved. <a href="/privacy">
+            What is collected
+          </a>.
+        </p>
+      </div>
+      <div class="ob-consent-actions">
+        <button type="button" class="ob-consent-button" data-consent="denied">
+          Do not allow
+        </button>
+        <button
+          type="button"
+          class="ob-consent-button ob-consent-button-primary"
+          data-consent="granted"
+        >
+          Allow
+        </button>
+      </div>
+    </section>
+  )
+}
+
+<style>
+  .ob-consent {
+    position: fixed;
+    z-index: calc(var(--sl-z-index-navbar) + 1);
+    inset-block-end: max(1rem, env(safe-area-inset-bottom));
+    inset-inline: 1rem;
+    margin-inline: auto;
+    max-width: 34rem;
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem 1.5rem;
+    padding: 1rem 1.15rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.6rem;
+    background: var(--sl-color-black);
+    box-shadow: 0 1rem 2.5rem -0.75rem rgb(0 0 0 / 0.5);
+  }
+
+  .ob-consent-title {
+    margin: 0 0 0.2rem;
+    font-size: var(--sl-text-sm);
+    font-weight: 600;
+    color: var(--sl-color-white);
+  }
+
+  .ob-consent-copy {
+    margin: 0;
+    font-size: var(--sl-text-xs);
+    line-height: 1.6;
+    color: var(--sl-color-gray-3);
+  }
+
+  .ob-consent-body {
+    flex: 1 1 16rem;
+  }
+
+  .ob-consent-actions {
+    display: flex;
+    gap: 0.5rem;
+  }
+
+  .ob-consent-button {
+    padding: 0.4rem 0.85rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.35rem;
+    background: transparent;
+    color: var(--sl-color-gray-2);
+    font: inherit;
+    font-size: var(--sl-text-xs);
+    cursor: pointer;
+  }
+
+  .ob-consent-button:hover {
+    border-color: var(--sl-color-gray-4);
+    color: var(--sl-color-white);
+  }
+
+  /* The landing page's primary action, in miniature: a solid fill of the
+     token that contrasts with the page, labelled in the token that contrasts
+     with the fill. `--sl-color-white` is a role rather than a colour — it is
+     near-black under the light theme — so a label set in it on an accent fill
+     is dark-on-blue in daylight. The pair below inverts correctly in both. */
+  .ob-consent-button-primary {
+    border-color: var(--sl-color-white);
+    background: var(--sl-color-white);
+    color: var(--sl-color-black);
+  }
+
+  .ob-consent-button-primary:hover {
+    border-color: var(--sl-color-gray-1);
+    background: var(--sl-color-gray-1);
+    color: var(--sl-color-black);
+  }
+
+  .ob-consent-button:focus-visible {
+    outline: 2px solid var(--sl-color-accent-high);
+    outline-offset: 2px;
+  }
+
+  /* Stacked, the buttons want the full width rather than the right edge. */
+  @media (max-width: 30rem) {
+    .ob-consent-actions {
+      flex: 1 1 100%;
+    }
+
+    .ob-consent-button {
+      flex: 1;
+    }
+  }
+</style>
diff --git a/site/src/components/AnalyticsPreference.astro b/site/src/components/AnalyticsPreference.astro
new file mode 100644
index 00000000..ea1b5e9a
--- /dev/null
+++ b/site/src/components/AnalyticsPreference.astro
@@ -0,0 +1,170 @@
+---
+/* The standing analytics control, for the privacy page.
+ *
+ * The banner asks once. This is where the answer is changed afterwards, which
+ * is the half of consent that is easy to leave out: permission that cannot be
+ * withdrawn as readily as it was given was never permission.
+ *
+ * It states the current situation before offering the buttons, because "allowed
+ * or not" is the question a reader arrives with, and in the regions that do not
+ * require a prompt the honest answer is that measurement is already running.
+ *
+ * The status line is scripted rather than rendered, since the answer lives in
+ * the reader's browser and this site is static: every reader would otherwise be
+ * served the same cached sentence about a choice that is theirs alone.
+ */
+const enabled =
+  Boolean(import.meta.env.PUBLIC_GA_MEASUREMENT_ID?.trim()) && import.meta.env.PROD;
+---
+
+{
+  enabled ? (
+    <>
+      <p>
+        The site uses Google Analytics 4 to count visits and see which pages get read. It runs
+        only when it is allowed to, and it is configured to learn as little as will still
+        answer that question.
+      </p>
+      <div id="ob-analytics-preference" class="ob-preference">
+        <p class="ob-preference-status" aria-live="polite">
+          Checking whether analytics are running in this browser.
+        </p>
+        <div class="ob-preference-actions">
+          <button type="button" class="ob-preference-button" data-consent="denied">
+            Do not allow
+          </button>
+          <button type="button" class="ob-preference-button" data-consent="granted">
+            Allow
+          </button>
+        </div>
+      </div>
+    </>
+  ) : (
+    <p>
+      This build of the site has no analytics configured, so nothing is measured, nothing is
+      stored, and there is nothing to turn off. The rest of this section describes what a build
+      that has them does.
+    </p>
+  )
+}
+
+<script is:inline>
+  (function () {
+    var root = document.getElementById("ob-analytics-preference");
+    var api = window.oneboxAnalytics;
+    if (!root || !api) return;
+
+    var status = root.querySelector(".ob-preference-status");
+    var buttons = root.querySelectorAll("[data-consent]");
+
+    function render() {
+      var preference = api.preference();
+
+      if (api.refused()) {
+        status.textContent =
+          "Your browser sends a Do Not Track or Global Privacy Control signal, so " +
+          "analytics do not run here whatever this control says.";
+        for (var i = 0; i < buttons.length; i++) buttons[i].disabled = true;
+        return;
+      }
+
+      for (var j = 0; j < buttons.length; j++) {
+        buttons[j].disabled = false;
+        // No trailing comma after the last argument: `is:inline` ships this
+        // script verbatim, and a trailing comma in a call is ES2017. Every
+        // browser too old for it fails to parse the whole script rather than
+        // one line of it, which would leave this control inert -- a standing
+        // opt-out that renders and does nothing is the worst of the states
+        // this file can be in.
+        buttons[j].setAttribute(
+          "aria-pressed",
+          String(buttons[j].dataset.consent === preference)
+        );
+      }
+
+      if (preference === "granted") {
+        status.textContent = "Analytics are allowed in this browser.";
+        return;
+      }
+      if (preference === "denied") {
+        status.textContent = "Analytics are not allowed in this browser.";
+        return;
+      }
+
+      api.requirement().then(function (requirement) {
+        if (api.preference() !== null) return;
+        status.textContent =
+          requirement === "not_required"
+            ? "Analytics are running in this browser. You can turn them off here."
+            : "You have not yet answered the analytics question in this browser.";
+      });
+    }
+
+    root.addEventListener("click", function (event) {
+      var button = event.target instanceof Element && event.target.closest("[data-consent]");
+      if (!button) return;
+      api.setPreference(button.dataset.consent);
+    });
+
+    api.subscribe(render);
+    render();
+  })();
+</script>
+
+<style>
+  .ob-preference {
+    margin-block: 1rem;
+    padding: 1rem 1.15rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.6rem;
+    background: var(--sl-color-black);
+  }
+
+  .ob-preference-status {
+    margin: 0;
+    font-size: var(--sl-text-sm);
+    line-height: 1.6;
+    color: var(--sl-color-gray-2);
+  }
+
+  .ob-preference-actions {
+    display: flex;
+    gap: 0.5rem;
+    margin-block-start: 0.85rem;
+  }
+
+  .ob-preference-button {
+    padding: 0.4rem 0.85rem;
+    border: 1px solid var(--sl-color-gray-5);
+    border-radius: 0.35rem;
+    background: transparent;
+    color: var(--sl-color-gray-2);
+    font: inherit;
+    font-size: var(--sl-text-xs);
+    cursor: pointer;
+  }
+
+  .ob-preference-button:hover:not(:disabled) {
+    border-color: var(--sl-color-gray-4);
+    color: var(--sl-color-white);
+  }
+
+  /* Same inversion as the banner's primary action: `--sl-color-white` is the
+     token that contrasts with the page, so it is the fill here and never the
+     label on top of it. */
+  .ob-preference-button[aria-pressed="true"] {
+    border-color: var(--sl-color-white);
+    background: var(--sl-color-white);
+    color: var(--sl-color-black);
+  }
+
+  .ob-preference-button:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+  }
+
+  .ob-preference-button:focus-visible {
+    outline: 2px solid var(--sl-color-accent-high);
+    outline-offset: 2px;
+  }
+</style>
diff --git a/site/src/components/Footer.astro b/site/src/components/Footer.astro
index bcf629d8..a3d41383 100644
--- a/site/src/components/Footer.astro
+++ b/site/src/components/Footer.astro
@@ -50,6 +50,7 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
       <div class="meta sl-flex">
         <EditLink />
         <LastUpdated />
+        <a href="/privacy">Privacy</a>
       </div>
     )
   }
@@ -75,4 +76,20 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
     margin-inline-start: auto;
   }
 
+  /* Outside the regions that require a consent prompt no banner is ever
+     shown, so the control on /privacy is the only way to turn analytics
+     off -- and SiteFooter, which carries the other link to it, renders on
+     splash pages alone. A reader arriving from a search result lands here
+     and would otherwise have no route to it. One text link, not the whole
+     band. */
+  .meta a {
+    color: var(--sl-color-gray-3);
+    text-decoration: none;
+  }
+
+  .meta a:hover {
+    color: var(--sl-color-white);
+    text-decoration: underline;
+  }
+
 </style>
diff --git a/site/src/components/PageFrame.astro b/site/src/components/PageFrame.astro
index 255b3110..86a2c566 100644
--- a/site/src/components/PageFrame.astro
+++ b/site/src/components/PageFrame.astro
@@ -24,6 +24,7 @@
  */
 import MobileMenuToggle from "@astrojs/starlight/components/MobileMenuToggle.astro";
 import SiteFooter from "./SiteFooter.astro";
+import AnalyticsConsent from "./AnalyticsConsent.astro";
 
 const { hasSidebar } = Astro.locals.starlightRoute;
 const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
@@ -45,6 +46,7 @@ const isSplash = Astro.locals.starlightRoute.entry.data.template === "splash";
   }
   <div class="main-frame"><slot /></div>
   {isSplash && <SiteFooter />}
+  <AnalyticsConsent />
 </div>
 
 <style>
diff --git a/site/src/components/SiteFooter.astro b/site/src/components/SiteFooter.astro
index fdd962a2..979289a8 100644
--- a/site/src/components/SiteFooter.astro
+++ b/site/src/components/SiteFooter.astro
@@ -34,6 +34,8 @@ const year = new Date().getFullYear();
       <span>&copy; {year} <a href="/">Onebox</a> by <a href="https://labstack.com">LabStack LLC</a></span>
       <span class="sep" aria-hidden="true">·</span>
       <span><a href="https://github.com/labstack/onebox/blob/main/LICENSE">Apache-2.0</a></span>
+      <span class="sep" aria-hidden="true">·</span>
+      <span><a href="/privacy">Privacy</a></span>
     </p>
     <nav class="ob-sitefooter-links" aria-label="LabStack">
       <a class="ob-icon" href="https://x.com/labstack" aria-label="LabStack on X">
diff --git a/site/src/content/docs/privacy.mdx b/site/src/content/docs/privacy.mdx
new file mode 100644
index 00000000..f05da6d7
--- /dev/null
+++ b/site/src/content/docs/privacy.mdx
@@ -0,0 +1,90 @@
+---
+title: Privacy
+description: What onebox.run measures, what it never collects, and how to turn analytics off.
+summary: The website's own privacy terms and the control that turns its analytics on or off. Not about the `ob` binary, which reports nothing anywhere.
+read_when:
+  - You want to know what this website records about your visit.
+  - You allowed or declined analytics and want to change that answer.
+status: shipped
+---
+
+import AnalyticsPreference from "../../components/AnalyticsPreference.astro";
+
+This page is about **this website**, `onebox.run`. It is not about the `ob`
+binary. Onebox runs on your machine and talks to your server over SSH; it has no
+phone-home, no licence check and no usage beacon, and it reports nothing to us
+about the hosts you deploy to, the workloads you run, or the plans you apply.
+Nothing on this page changes that, because nothing on this page is in it.
+
+## Website analytics
+
+<AnalyticsPreference />
+
+### When it runs
+
+- **In the EEA, the UK, Guernsey, the Isle of Man and Jersey**, nothing is
+  loaded and no identifier is stored until you say yes. The prompt is the only
+  thing that appears before you answer.
+- **Everywhere else**, analytics run and the control above turns them off.
+- **If your browser sends Do Not Track or Global Privacy Control**, analytics
+  never run and you are never asked. That signal wins over everything else on
+  this page, including the buttons above.
+
+Which of these applies is decided from the country Cloudflare reports for your
+connection. If that lookup fails, the site asks rather than assumes.
+
+### What is sent
+
+When analytics are running, each page view sends the page path, the page title,
+the site you arrived from, and the coarse device, browser and country
+information any web request carries.
+
+Two things are cut down before they leave the browser:
+
+- **Query strings are removed** from the recorded address. Only the path is
+  sent, so anything a link put after the `?` is not. This is the same rule
+  `verifyURL` applies to the URLs Onebox itself handles: that nothing sensitive
+  is in there today is not a property worth assuming.
+- **The referrer is reduced to its site.** We record that you came from a search
+  engine, not what you searched for.
+
+Google's advertising features are switched off — no Google Signals, no ad
+personalisation, and ad data redaction is on — so the data is not used to build
+an advertising profile of you.
+
+### What is never sent
+
+Nothing you enter anywhere is collected, because this site has no forms, no
+accounts, no search box that reports what you typed, and no session recording or
+heatmaps. It does not attempt to identify you. And, to say it once more: no
+hostname, address, credential, plan or release from your own Onebox deployments
+passes through this site.
+
+### Storage
+
+Declining stores nothing that travels with a request. Your answer is kept in
+your browser's local storage under `onebox.analytics-consent.v1`, which is read
+by this site and sent to nobody.
+
+Allowing lets Google Analytics set its `_ga` cookies, which hold a random
+identifier so repeat visits can be recognised as the same browser. Declining
+afterwards deletes them.
+
+Clearing your browser storage for this site clears the answer too, and the
+question comes back if your location requires it.
+
+## Hosting
+
+The site is static files served by Cloudflare Pages. Like any web server,
+Cloudflare receives the IP address and request headers needed to deliver a page,
+and is the reason this site knows which country to apply the rules above to.
+That processing is Cloudflare's, under their terms, and happens whether or not
+you allow analytics.
+
+## Contact
+
+Questions about this page belong in
+[an issue](https://github.com/labstack/onebox/issues). The site's source,
+including the analytics code described here, is in
+[the repository](https://github.com/labstack/onebox/tree/main/site) — this page
+describes what that code does, and the code is the thing you can check.
diff --git a/site/src/pages/llms-full.txt.ts b/site/src/pages/llms-full.txt.ts
index 9a7643f5..b2fc5ad2 100644
--- a/site/src/pages/llms-full.txt.ts
+++ b/site/src/pages/llms-full.txt.ts
@@ -11,7 +11,7 @@ import { toPlainMarkdown } from "../lib/markdown";
 // listed explicitly — it was previously dropped from a document headed
 // "complete documentation".
 const ROOT = "index";
-const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status"];
+const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status", "privacy"];
 
 export const GET: APIRoute = async () => {
   const docs = await getCollection("docs");
diff --git a/site/src/pages/llms.txt.ts b/site/src/pages/llms.txt.ts
index f8dd1bd7..844b1718 100644
--- a/site/src/pages/llms.txt.ts
+++ b/site/src/pages/llms.txt.ts
@@ -13,7 +13,7 @@ import { getCollection } from "astro:content";
 // it "index", which an ORDER list of directory names does not contain, so it was
 // dropped from an index whose own heading promises every page.
 const ROOT = "index";
-const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status"];
+const ORDER = [ROOT, "start", "guides", "reference", "explanation", "status", "privacy"];
 
 const GROUP_TITLES: Record<string, string> = {
   [ROOT]: "Overview",
@@ -22,6 +22,7 @@ const GROUP_TITLES: Record<string, string> = {
   reference: "Reference",
   explanation: "Explanation",
   status: "Status",
+  privacy: "Site terms",
 };
 
 // Keyed by the status union rather than by string, so adding a fourth status is