In July we published a note called We shipped a site with no cookie banner. Its argument was that the honest choice is usually the one that costs you a metric, and the metric we gave up was all of them. It ended with a promise: when we add measurement it will be the cookieless kind, and we’ll say exactly what we collect.
We have added measurement, and it is not the cookieless kind. This site now runs Google Analytics 4, which sets one cookie to tell a returning visitor from a new one. That is the part of the promise we did not keep, and pretending otherwise would cost more than the metric ever did.
Why we reversed it. A lab that publishes a launch and then cannot tell whether anyone reached the shelf is not being principled, it is being incurious. We wanted to know which of the six House Rules people actually read, whether the Daily Split is played or only scrolled past, and whether the arcade link is ever taken. Every cookieless option we costed either could not answer those questions or answered them by sending your IP address to a company you never chose.
What we kept. The part of Rule 2 that survives is the part that was always load-bearing:
- The consent is real, or there is none. In the EEA, the UK and Switzerland, Consent Mode v2 defaults to denied and nothing is stored until you choose. Decline is a real button — same size, same weight as Allow — and there is no blocking overlay. A banner that sets the cookie either way and only moves the blame is the theatre we disowned, and we still refuse to build it.
- Outside those places there is no banner, because none is required and a banner that changes nothing is that same theatre wearing a compliance badge. The cookie is set, and the privacy policy says so in plain words rather than burying it.
- No advertising cookies at all. Ad storage, ad user data and ad personalisation are denied for every visitor, everywhere, unconditionally and with no setting that turns them on. We measure a website; we do not build audiences.
- The region is guessed from your own timezone, never from an IP lookup, because asking a third party “where is this person” to avoid tracking them is not a privacy win. The guess is deliberately biased toward asking more people than the law covers. Being wrong costs a banner; being wrong the other way costs a regulator.
What we fixed alongside it. The July note is still up, unedited, with a dated correction pinned above it — House Rule 4 says a thing that failed stays on the list. The public audit has a new Consent row and lost its “zero cookies” line. The Help page no longer says the site sets none. The Crime Index entry on cookie mazes no longer claims we are exempt. If you find a surface that still says zero, that is a bug and we would like the mail.
The lesson is not “measurement is fine after all.” It is that a promise with a number in it is a promise you will one day have to publish a correction for, and the correction is the whole point of writing the number down.