Off by default

Analytics uses PostHog and is switched off until you add a project token. Without one, PostHog never initializes and the site makes no third-party requests at all. A new project never sends traffic to someone else’s analytics account by accident.

Turning it on

Create a PostHog project. The EU Cloud region is the default here and the simpler choice for UK and EU visitors.

Add the project token to .env:

NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN="phc_..."
NEXT_PUBLIC_POSTHOG_HOST="https://eu.i.posthog.com"

In PostHog, open Settings → Project and enable Cookieless server hash mode.
Restart the dev server, or rebuild your deployment.

The PostHog dashboard also lags by a few minutes. Wait before deciding that nothing is arriving.

What is captured

The whole setup is src/instrumentation-client.ts, which Next.js runs before any application code in the browser. There is no analytics component to add to the layout. Each option there is a privacy decision, and each one is commented:

capture_pageviewOn: Page views and page leaves, including App Router navigations.
capture_performanceOn: Core Web Vitals, alongside each page view.
autocaptureOff: Clicks and the text of the elements clicked. Off under data minimisation. Turn it on only if your privacy notice says so.
disable_session_recordingRecording off: Session recording. A much larger privacy commitment than page counts, so it is not switched on for you.

Why there is no cookie banner

PostHog runs with cookieless_mode: "always". It stores nothing in cookies, local storage, or session storage, and counts visitors with a privacy-preserving hash calculated on PostHog’s servers. UK cookie consent rules (PECR regulation 6) only apply when something is stored on or read from the visitor’s device, so no consent banner is needed.

The trade-off is real, and it looks like a fault if you do not expect it:

No geography. PostHog discards the IP address after hashing and before it would look up a location. The Web Analytics world map shows zero for every country.
No bot filtering. Bot detection runs at the same stage, so it never happens either.
No identified users. identify() cannot be used, so there are no journeys across sessions.
Ad blockers. Many block PostHog’s domain, so a developer audience in particular will be undercounted.

Getting geography or identity back means cookies, a consent banner, and a rewritten privacy notice.

The privacy notice follows along

The privacy page reads the same configuration from src/lib/analytics.ts that the SDK uses. Without a token it says analytics is switched off. With one, it describes cookieless PostHog and names the region your host points at. If you change what is captured, update the notice in src/app/privacy/page.tsx to match.