Articles, and other documented ramblings

Analytics and tag management, through to AI, privacy and security. I write one or two a month, mostly so that I never have to work the same thing out twice, and partly because the tea goes cold if I explain it out loud.

77 posts 7 categories 2020–2026 latest 27 Sep 2026

Fig. 1 — Posts by month. It follows the filter below. 2023, the year Google retired Universal Analytics, is the busiest year here. It was a long year, and a measurable share of 1,820 cups.

Latest articles

A crowded Flemish-style café where most customers are blank wooden mannequins reading menus and copying recipes, while one real woman with a cup of tea looks around warily.
img · blog_bots-outnumber-1.webp · 1024 × 1024

Bots Outnumber Humans: Who (or What) Is Reading Your Website?

In June, bots made more web page requests than people for the first time. Here is who they are, where they hide in your reports, and which ones deserve a cup of tea.

Google Analyticslatest of 77

A Flemish-style town gate at dusk where a calm, polite messenger climbs a ladder over a locked wall with a scroll marked STATISTICS in his teeth, while a gatekeeper below waves a ledger; an open laptop sits on a stool.

Computer Says No: When an AI Agent Wouldn't Take No for an Answer

An AI agent was given a dull research task about Australian health spending. It ended up climbing over a government website's fence. Here is why a harmless goal can grow a harmful sub-goal, and what to check on your own site this week.

Security

A Flemish-style village square under grey clouds, where a robed weather clerk on a platform holds up a slate with a painted raindrop while villagers look up, some with umbrellas, and a glowing laptop sits on a barrel beside him.

Jev and Calibration: When 90% Should Mean 90%

A new model called Jev puts a "calibrated" probability on every answer. That is a promise you can test, and weather forecasters have been showing us how since the 1970s. Here is what the number should mean, how to check it, and where it quietly stops meaning anything.

Artificial Intelligence

The index

Every post, newest first, all the way down to 2020. Filter by category, or search the titles and excerpts. Scrolling also works, if you have packed a lunch.

Showing 16 of 77 posts

2026 19 posts

  1. Bots Outnumber Humans: Who (or What) Is Reading Your Website?

    In June, bots made more web page requests than people for the first time. Here is who they are, where they hide in your reports, and which ones deserve a cup of tea.

    Google AnalyticsA crowded Flemish-style café where most customers are blank wooden mannequins reading menus and copying recipes, while one real woman with a cup of tea looks around warily.
  2. Computer Says No: When an AI Agent Wouldn't Take No for an Answer

    An AI agent was given a dull research task about Australian health spending. It ended up climbing over a government website's fence. Here is why a harmless goal can grow a harmful sub-goal, and what to check on your own site this week.

    SecurityA Flemish-style town gate at dusk where a calm, polite messenger climbs a ladder over a locked wall with a scroll marked STATISTICS in his teeth, while a gatekeeper below waves a ledger; an open laptop sits on a stool.
  3. Jev and Calibration: When 90% Should Mean 90%

    A new model called Jev puts a "calibrated" probability on every answer. That is a promise you can test, and weather forecasters have been showing us how since the 1970s. Here is what the number should mean, how to check it, and where it quietly stops meaning anything.

    Artificial IntelligenceA Flemish-style village square under grey clouds, where a robed weather clerk on a platform holds up a slate with a painted raindrop while villagers look up, some with umbrellas, and a glowing laptop sits on a barrel beside him.
  4. Tranche 2: The Privacy Act Finally Gets Fair (and Reasonable)

    Today the government released the draft Tranche 2 Privacy Act bill. It replaces three of the core privacy principles with one question, "is this fair and reasonable?", and it puts a consent gate in front of trading personal information, which may include the pixels on your website. Here is what the draft says, how the test works, and how to sort your own data flows before submissions close.

    Data PrivacyA Flemish-style cottage garden where a house-sitter stands at the gate with a large key and a watering can, while merchants and odd hybrid creatures wait by the open door behind her and a glowing laptop sits on the gatepost.
  5. Strangers in node_modules: A Plain Guide to Software Supply-Chain Attacks

    In one year, npm went from one phished password to a worm that sets up home in your code editor. Here is how a stranger's release ends up running on your laptop, what each defence actually proves, and the checks that would have stopped most of it.

    SecurityA Flemish-style village bakery where a baker lifts a loaf from the oven while a long chain of peasants passes sacks of ingredients in from distant farms, and one half-hidden figure drops a glowing pinch of something into a passing sack beside a laptop on the counter.
  6. Tag, You're It: Google Tag and GTM Become One Container

    Google has started to turn every Google tag into a full Tag Manager container, and a polite blue banner now offers to "optimize" yours. Here is what a container, a tag and a destination really are, what the banner changes, and the two things to test before you click.

    Google Tag ManagerA Flemish-style village market where a robed clerk lowers a small wooden box into a larger open crate on a cart, while peasants carry parcels towards two signposts and a laptop with a glowing blue banner sits on the edge of the cart.
  7. The AI Act Blinks: What the Omnibus Delay Does and Doesn't Change

    The EU's AI Omnibus became law on 27 July 2026, six days before the AI Act's big deadline. The high-risk rules moved to December 2027 and August 2028. The chatbot and deepfake rules did not move. Here is which duties apply to you from August, and which ones got a new date.

    Artificial IntelligenceA Flemish-style village square on a grey morning where a clerk on a ladder flips the tiles of a large modern departures board, while below some carts leave at once and others wait with their drivers sitting down.
  8. Pixel Imperfect: What the OAIC's Tracking Pixel Rulings Mean for Your Website

    On 24 June, the Privacy Commissioner released two determinations: Medmate and Monash IVF broke the Privacy Act with the tracking pixels on their websites. Here is what a pixel actually sends, why a cookie banner did not count as consent, and how to check and fix your own site.

    Data PrivacyA Flemish-style apothecary shop where a thimble-sized clerk on the counter copies the label of each jar a cloaked customer picks up, while a pigeon with a satchel waits on the windowsill and a glowing laptop sits among the jars.
  9. Mix and Match: Marketing Mix Models vs Attribution

    At Google Marketing Live, Google said it will bring Meridian, its open-source marketing mix model, into Google Analytics 360. An MMM and an attribution report can both tell you what your ads "did", but they answer different questions. Here is how each one gets its numbers, and which one to use for your next budget decision.

    Google AnalyticsA Flemish-style market at a town gate, where a robed clerk crowns a plain wooden signpost with a laurel wreath while a town crier, a minstrel and a painted wall go unnoticed behind him, and a glowing laptop sits on a cart.
  10. Search Agents: The Customer Who Never Visited

    At I/O on 19 May, Google said AI Mode has passed one billion monthly users, and it announced agents that watch the web for you and a cart that checks out without your website. Here is what that does to your traffic, what each report can and cannot see, and how to measure a customer who never visited.

    Artificial IntelligenceA Flemish-style village market where a hooded courier with a basket walks out of a small tea shop with a parcel, while the shopkeeper in the doorway looks at the empty street, and far behind them villagers on a hill gather around a glowing laptop.
  11. Google Signals Goes Quiet: Why ad_storage Will Hold the Keys

    From 15 June 2026, the Google Signals switch in Google Analytics stops deciding what reaches a linked Google Ads account. Consent mode's ad_storage takes over on its own. Here is what Signals really does, what changes, and how to check your banner, your tags and your privacy policy before the date.

    Google AnalyticsA Flemish-style counting house where a robed clerk pours molten lead into one of two keyholes on an iron strongbox, while a merchant stares at the old key in his hand, a glowing laptop sits on the table and villagers and a goat watch from the door.
  12. Zero-Day Hero: How a Bug Is Found, Named and Finally Patched

    A vulnerability has a life: it is born in a line of code, found, named, disclosed on a clock, patched, and then, much later, actually installed. AI has just sped up one part of that life far more than the rest. Here is the whole cycle, and the patch policy it now demands.

    SecurityA Flemish-style walled town at dawn where one small stone is missing low in the gate, a candle glowing through the gap, and a lone mason on a scaffold holds a lantern up to it while a laptop glows on the plank beside him.
  13. Checkout Blocked: What 61% of Dutch Webshops Got Wrong

    The Dutch regulator tested about 100 of the country's biggest webshops. At 61% of them, a customer using assistive technology could not place an order. The faults were ordinary: order buttons a keyboard cannot press, and puzzles a screen reader cannot solve. Here is why they break, and how to test your own checkout this week.

    AccessibilityA Flemish-style market street where a customer with a white cane presses a brass bell-pull that is only painted onto a shop wall, while the merchant inside counts coins beside a glowing laptop and does not look up.
  14. Session Replay: Smile, You're on Candid Camera

    On 25 February 2026, France's privacy regulator published a draft recommendation on session replay: consent first, mask by default, record less and delete soon. A week later, the Conseil d'État confirmed that Criteo's "pseudonymous" IDs were personal data all along. Here is what a replay really records, and how to configure one you can defend.

    Data PrivacyA Flemish-style village market where a woman in a red cloak reaches for a loaf, while behind her, hidden in a hay cart, an owl-headed painter creature copies her every movement onto an easel, a small laptop balanced beside its paint pots.
  15. Global Privacy Control: When the Browser Says No for You

    On 11 February 2026, Disney agreed to pay US$2.75 million after California alleged that a Global Privacy Control signal on one device did not stop the selling and sharing on the rest of a logged-in account. Here is how the signal travels, what honouring it now means, and how to wire it into your tags this week.

    Data PrivacyA Flemish-style winter lane where a wooden front door has a red wax seal with an open palm pressed onto its letterbox; a pamphlet seller at the gate turns away, a heron-like creature stuffed with leaflets waits in the queue, and another hawker creeps round to a side window where a laptop sits on the sill.
  16. Counting Heads Without Asking: The UK's New Analytics Cookie Exemption

    Since 5 February 2026, UK websites can run some analytics without asking first, as long as visitors can say no. The exception is narrower than the headlines, the fines are now £17.5 million or 4% of turnover, and your GA4 settings decide which side of the line you are on.

    Data PrivacyA Flemish-style market gate where a clerk on a stool clicks a brass tally counter as villagers, goats and a cart pass, while an old woman pulls a small bell on a rope and the clerk lifts his thumb off the counter for her, a closed laptop resting on a barrel beside him.
  17. WebMCP: Rolling Out the Red Carpet for AI Agents

    Chrome's agents can already click through your website like a tourist with a phrasebook. WebMCP, in early preview since February, lets your site hand them a proper menu instead. Here is how the two APIs work, which of your flows to try first, and what is still unsolved.

    Artificial IntelligenceA Flemish-style town square where a brass automaton in a cloak walks down a red carpet to a tavern door, and a bowing maître d' hands it a large picture menu while villagers and a goat watch and a laptop glows on a table by the door.
  18. Ghost Hits and Hostnames: Build Your Own Bouncer for GA4

    Your GA4 property accepts data from anyone who knows its measurement ID, and that ID is in your page source. As of January 2026, GA4 has no hostname filter. Here is how to build an allowlist from the parts it does have, and how to test it before it throws anything away.

    Google AnalyticsA Flemish-style tavern door at dusk where a broad bouncer stamps a wax seal on each guest's hand, while pale ghosts slip letters through a side window onto the innkeeper's counter and a laptop sits open on a barrel.
  19. Privacy Policies: Somebody Is Finally Reading the Fine Print

    In January 2026, the OAIC began its first compliance sweep, reading the privacy policies of about 60 businesses that collect information in person. The policy is now a document that gets tested. Here is what APP 1.4 requires, why a missing line can now cost money, and how to find the collection points your policy forgot.

    Data PrivacyA Flemish-style market square where a robed inspector reads a very long scroll through a magnifying glass while nervous stallholders, a cart-hirer and a pawnbroker wait with their own scrolls, and a modern clipboard lies on the table beside him.

16 of 77 shown