Current state
General publisher pages do not activate advertising tags. The Phase 1 reports at go.womensdailycare.com/report-cranberry and go.womensdailycare.com/report-cranberry-brief load Meta Pixel and send PageView, ViewContent, and custom OutboundClick events without Women's Daily Care custom parameters. Our browser code does not send Lead, InitiateCheckout, Purchase, or Upsell. Meta's code can set or read identifiers such as _fbp and derive or use _fbc. The reports also temporarily send PostHog one fixed-schema pageview per eligible visit and one fixed-schema handoff event when a governed presentation link is chosen; each event's custom fields contain only a schema version, fixed eligible report path and corresponding fixed variant, and allowlisted CTA location. A separate 20% sample of visits lasting at least three seconds receives content-masked session replay. The integration writes no PostHog cookie or local storage, honors Global Privacy Control and Do Not Track, uses 30-day retention, and is scheduled to stop by August 23, 2026 or after 50 useful mobile sessions are reviewed. A same-origin script also copies one allowlisted opaque source key and one valid fbclid into the managed merchant-link request; it creates no browser storage and makes no separate network request. Cloudflare processes essential request and security information to deliver and protect both sites.
Technology categories
Current paid-page measurement is limited to Meta Pixel, the temporary route-limited PostHog diagnostic described here, and ClickBank's active, filtered server-side Facebook integration. A new cookie, local-storage key, pixel, server-side tag, or similar technology requires an updated notice with its provider, purpose, data fields, duration, trigger, and choices before activation.
- Strictly necessary: security, load delivery, fraud prevention, form integrity, and storage of privacy choices.
- Functional: a feature or preference requested by the reader; off until needed and approved.
- Measurement: the current paid-report Meta events and temporary fixed-schema PostHog events plus masked replay sample described above; general publisher-page measurement remains off.
- Advertising and social: the current paid-report Meta attribution flow is the narrow approved exception; retargeting, audience building, embedded social features, and any additional advertising technology remain prohibited by default and subject to heightened health-data review.
Affiliate links
Following the reviewed FemiCore link sends a minimized, random click identifier and, when present and valid, the incoming fbclid to FemiCore and ClickBank so a later transaction can be attributed. The outbound destination controls its own cookies and privacy practices. Our redirect does not place health topics, symptoms, form data, page variants, source keys, or arbitrary UTM values into the outbound identifier, and our D1 ledger stores only whether fbclid was present rather than its raw value.
The ClickBank postback to Women's Daily Care is a separate server-to-server request that does not set a browser cookie or forward the D1 record to Meta. ClickBank's Facebook integration for affiliate tastemake is active and configured to send server-side InitiateCheckout, Purchase, and Upsell events to Meta using ClickBank's attribution and transaction data when the traffic source is marked facebook.
Consent and withdrawal
The Phase 1 paid reports load Meta Pixel and the temporary PostHog diagnostic without a separate on-page consent banner under the operator's initial United States campaign decision. The complete PostHog integration does not load when Global Privacy Control or Do Not Track is present and is configured not to use browser persistence. Browser and content-blocking settings can prevent either integration or remove Meta cookies, and privacy rights can be exercised through the Privacy Choices page. Blocking nonessential tracking does not block editorial content. A consent control will be added before the flow is offered where one is required.
Browser controls and GPC
Browsers can block or delete storage, although doing so may remove saved choices. Where required, a recognized Global Privacy Control signal is treated as an opt-out of sale or sharing for the sending browser or device. The temporary PostHog diagnostic—including named events and replay—also stops when either Global Privacy Control or the legacy Do Not Track signal is present; Do Not Track is an additional technical suppression for that integration, not a substitute for applicable legal opt-out signals.