GDPR compliance and cookie controls

A quick note on privacy: from now on, this site follows the EU’s GDPR (General Data Protection Regulation). In short, websites must explain what data is processed, provide a lawful basis (e.g., consent), and offer an easy way to withdraw that consent. Non-essential cookies (analytics, comments, embeds) should only load only after you agree.

On my site, third-party features are gated behind consent: analytics, Giscus comments, and external embeds only activate once you accept cookies. You can change your choice anytime via the “Cookie settings” link in the footer. You’ll also find the full Terms & Privacy page linked there.

How it’s implemented (briefly): a small custom script in _includes/cookie-consent.html shows the banner, stores your choice, and then triggers loading of third-party features. The file is included in _layouts/default.html just before _includes/scripts.html. In _includes/scripts.html, I adapted the loading flow so third-party features (Google Analytics, Giscus, and external embeds) are injected only after consent; embeds use data-consent-src and are hydrated later.

This post is informational and not legal advice. If you have questions or requests, feel free to reach out to me, for example via comments or mail.