Script options

Every attribute the snippet accepts: test mode, debug logging, and the privacy signals.

Attributes

Every option rides on the script tag itself. A missing attribute means the server decides; false and 0 are the only falsey values.

Attribute	Effect
`data-test-mode`	Marks the traffic non-production. It never bills, and it stays out of every chart, rollup and realtime view. Use it on staging and local environments.
`data-debug`	Logs transport failures to the browser console. Useful while installing, off in production.
`data-respect-gpc`	Honour Global Privacy Control. On by default.
`data-respect-dnt`	Honour Do Not Track, in any of its spellings. On by default.
`data-require-consent`	Collect nothing until your consent banner calls oa.consent('granted'). Off by default, because the tracker is cookieless.

One attribute is weaker than it looks, on purpose: data-respect-gpc="false" cannot make GPC visitors countable. Our servers discard any request carrying the Sec-GPC header regardless of the snippet, so the attribute only controls whether the browser bothers sending. The DNT attribute works as written; GPC is the signal with legal force, and it is enforced on both ends.

Example: staging install

<head> on staging

<script
  async
  src="https://c.getopen.so/oa.js"
  data-key="YOUR_TRACKING_KEY"
  data-collector="https://c.getopen.so"
  data-test-mode="true"
  data-debug="true"
></script>

What the script does on its own

With no options at all, the tracker records pageviews (including client-side route changes), engagement time (visible time, and active time near a real interaction), Core Web Vitals, and the events you mark up. Pageviews send immediately; everything else batches for about a second and leaves via sendBeacon when a tab closes, so nothing is lost to navigation.

Site-level behaviour (heartbeat cadence, redacted query keys, no-code rules, sampling) comes from your site's configuration and updates without touching the snippet.

What it never does

No cookies, no identifier stored on the device, no fingerprinting, no keystrokes, no form values, no session replay. The full list, with the reasons, is on the privacy and consent page.