TrustAnalytics

TrustAnalytics measures how people find and use your websites and web apps. The basics — pageviews, sessions, sources, devices and countries — work without cookies, without anything stored in the visitor’s browser and without consent. Everything beyond that waits for the consent your banner passes on — unless you decide otherwise: for each of six collection groups the website sets whether it is off, waits for consent or is always collected.

• See your traffic: visitors, sessions, pageviews, bounce rate and engagement time per page, source, campaign, country and device, plus a realtime view.
• Understand behaviour: paths through your site, sessions with their full timeline, forms (where people abandon), content and media reach, site search, and retention cohorts.
• Measure conversions: goals and funnels that work retroactively on the data you already have, revenue per source and campaign, A/B experiment results, and a shop funnel from product view to purchase.
• Find problems: JavaScript errors grouped by cause, Core Web Vitals, scripts that block the page, failed and slow requests — each linked to the sessions it happened in.
• Watch what happened: click and scroll heatmaps and session replays, masked in the browser before anything is sent.
• Ask your own questions in Explore, build dashboards, and export CSV or PDF.
• Send events from your backend — confirmed orders, refunds, signups — through the server API.

• Website — one site or web app you measure. It has a public site key for the snippet, a list of allowed hostnames, its own settings and rules. A project can hold several websites.
• Event — one thing that happened: a pageview, a click, a form submit, a purchase, an error. Every event belongs to exactly one category.
• Category — the kind of data an event carries. It decides which plan feature and which of the website’s six collection groups apply; each group is off, waits for consent or is always collected. See Collection and consent.
• Session — one visit: the events of one browser until 30 minutes pass without activity.
• Visitor — the person behind several sessions, as far as you let us recognise them: within a fixed time window, with a first-party cookie, or with your own user id. See Visitors.
• User — an id from your own system that you pass with identify.

TrustAnalytics is a module inside a project — add it when you create a project or later under Settings › Modules & Add-ons. Then:

1. Create a website under Analytics › Websites › Create Website and enter the hostnames of your site (for example www.example.com). Events from other hostnames are refused.
2. Copy the snippet from Settings › General › Website snippet of the website — it already contains your site key.
3. Add the SDK to every page, either as a script tag or from npm:

<script async src="https://cdn.trustcomponent.com/trustanalytics/0.1.x/trustanalytics.min.js" data-site-key="YOUR_SITE_KEY"></script>

<script>
  window.trustanalyticsq = window.trustanalyticsq || [];
  trustanalyticsq.push(['setConsent', true]);
  trustanalyticsq.push(['track', 'newsletter_signup']);
</script>

npm install @trustcomponent/trustanalytics-frontend

import { Analytics } from '@trustcomponent/trustanalytics-frontend';

export const trustanalytics = new Analytics({ siteKey: 'YOUR_SITE_KEY' });

<script async src="/assets/trustanalytics-0.1.0.min.js" data-site-key="YOUR_SITE_KEY"
        data-replay-script="/assets/trustanalytics-replay-0.1.0.min.js"></script>

4. Open your site. The SDK reads the website’s tracking policy and sends the first pageview.
5. Check it arrived under Settings › Data collection & privacy › Last 24 hours of the website (Latest events lists them as they arrive): it shows the events of the last hours, and for every event that was not stored, the reason (for example a missing consent or a hostname that is not listed). See Dropped events.

That is all you need for pageviews, sessions, sources, devices and countries. Next, connect your consent banner (Consent & privacy) and add the events you care about (Events & users).

The SDK sends a pageview on load and whenever the path changes through the History API, so React, Angular, Vue, Svelte and similar routers work without extra code.

• Hash routers (/#/settings): set data-hash-routing="true" / hashRouting: true, otherwise only a new path counts as a new page.
• Report a page yourself: set data-auto-page="false" / autoPage: false and call trustanalytics.page() after every navigation.
• Neutral paths: trustanalytics.page({}, '/users/:id') reports the page under that path; every further event of the page uses it too. Combine it with autoPage: false so the real url is never sent.
• Route of the page: to group pages whose path carries a variable, tell the SDK the route your site already knows. Server-rendered pages put <meta name="ta:page-pattern" content="/products/:slug"> in the head; single-page apps call trustanalytics.page({}, { pattern: '/products/:slug' }) on every navigation, with autoPage: false. The route travels next to the address and is ignored if it does not start with /.
• Page patterns: under Settings › Data collection & privacy › Pages you can group pages such as /products/:id in the reports without changing what is stored. Without a route from the page or a matching pattern, numbers and generated ids in paths are shown as :id.
• Masked addresses: data-ta-mask-url must be in place before the navigation it should mask, see Keeping personal data out.

By default the SDK starts when it loads and leaves the browser as it found it.

• data-auto-start="false" / autoStart: false creates the SDK without measuring anything: no request of its own and no listener on the page (loading the script from the CDN is still a request). It reads the cookie trustanalytics and, with a consentSource, already follows your consent manager; a decision passed before start() — setConsent(), optOut() or from the consent source — takes effect and is stored in the cookie as usual. trustanalytics.start() loads the policy, installs everything and sends the first pageview; trustanalytics.stop() sends what is queued and removes every listener, timer and recording. Both can be called as often as needed, so a consent manager can switch the SDK on and off. Events raised while stopped are dropped; setConsent() and identify() work at any time.
• Nothing in web storage: the SDK never uses localStorage or sessionStorage. The server groups the pages of one visit itself — see Visitors — and your consent manager passes the consent on every page.
• trustanalytics.flush() sends the queued events now. The SDK otherwise sends them every few seconds and when the page is left.

Every option exists as a data attribute on the script tag and as a property of the Analytics constructor. Switching a collector off here only narrows what the website and the consent allow — it never widens it.