Opt-out

For a visitor

One flag, set in the browser’s own storage:

localStorage.setItem("tracing_disabled", "1");

From then on the tracker sends nothing from that browser, on that origin, for every hit type: pageviews, custom events, outbound clicks, revenue events, identify() calls and the time-on-page flush.

To be counted again:

localStorage.removeItem("tracing_disabled");

The flag is per browser and per origin. Clearing site data clears it too.

The identity probe still runs

GET /c/:key is fired before the first hit, so it goes out regardless. It carries no information about the visitor, returns only the site’s identity mode and sets nothing. Nothing about the visitor is recorded.

Offering it on your site

Drop this anywhere on the page:

<button id="tt-optout" type="button"></button>
<script>
  (function () {
    const KEY = "tracing_disabled";
    const button = document.getElementById("tt-optout");

    function isOff() {
      try { return localStorage.getItem(KEY) === "1"; } catch { return false; }
    }

    function render() {
      button.textContent = isOff()
        ? "Analytics is off for this browser — turn it back on"
        : "Do not count my visits";
      button.setAttribute("aria-pressed", String(isOff()));
    }

    button.addEventListener("click", function () {
      try {
        if (isOff()) localStorage.removeItem(KEY);
        else localStorage.setItem(KEY, "1");
      } catch {}
      render();
    });

    render();
  })();
</script>

Put it in your privacy notice, next to the paragraph that describes the analytics.

Set it before the tracker loads to suppress the first hit

The flag is read on every send, so setting it later stops everything from that moment — but the pageview that was already sent stays. Set it from an inline script above the tracker tag if you need the landing hit suppressed too.

Browser signals

The tracker does not read Do Not Track (navigator.doNotTrack) or Global Privacy Control (navigator.globalPrivacyControl).

DNT is effectively dead — removed from Safari and Firefox’s UI, never widely honoured — and GPC is a sale/share opt-out signal whose legal scope does not map onto a cookieless analytics hit. If you want to honour either on your own site, it is three lines above the tracker tag:

<script>
  if (navigator.globalPrivacyControl || navigator.doNotTrack === "1") {
    try { localStorage.setItem("tracing_disabled", "1"); } catch {}
  }
</script>
<script defer data-site="pk_live_xxxxxxxx" src="https://ingest.tracing.tools/t.js"></script>

That is a deliberate design choice, not an oversight: the product does not decide your policy for you.

Consent-gated loading

If your legal basis is consent, do not load the tracker until you have it. Either inject the script tag after the decision, or load it with data-auto="false" and call tracing.pageview() once consent is given.

// after the visitor accepts
const s = document.createElement("script");
s.defer = true;
s.src = "https://ingest.tracing.tools/t.js";
s.dataset.site = "pk_live_xxxxxxxx";
document.head.appendChild(s);

Other ways traffic is excluded

Method	Scope	Set by
tracing_disabled	one browser	the visitor, or you
Excluded IPs	every browser at that address	the site owner, in Settings
Excluded paths	whole sections of the site	the site owner, in Settings
data-exclude	whole sections, client-side	the script tag
Bot detection	crawlers and headless tools	automatic

See Bots & exclusions.

Related

• Opt-out & debugging
• Cookieless & GDPR