Agent user analytics: respect opt-out before collecting events

Decision trace

From arrivals to a report

This experiment executes a small event collector over eight fictional arrivals. Each card identifies an event, its creation time, its receipt time and the collector decision. The initial state contains no collected records. The collector checks the fixture opt-out rule, event type, duplicate ID and arrival delay in that order, then optionally removes the email field before storage. The report is computed from stored records using their event times. A rejected event never enters storage or the report. All payloads are synthetic constants in this page; the experiment sends no event to a server.

Choose the collection policy

Honor event opt-out blocks e3 before field projection. Disable this switch to demonstrate a policy violation: e3 enters storage even if its email is removed. Remove email before storage deletes the fictional email property from accepted records; disable it to inspect that property in Complete collector state. This is field minimization, not anonymization: IDs and event times remain. Deduplicate event IDs suppresses the second e2 arrival using a set of previously accepted IDs. Disable it and both copies contribute to the completion count. IDs are assumed unique for genuine events within this one run; collisions, distributed races and expiring deduplication state are not modeled.

Reproduce the default counts

Keep all three switches enabled, Maximum arrival delay at five seconds and Report window at twenty. At the end, e1, e2, e6 and e7 are stored: two views and two completions. The retry of e2 is rejected as duplicate, e3 as opt-out, e4 as late, and e5 for its unknown event type. Disable deduplication, finish again, and observe five stored records and three completions. Restore it, then disable Honor event opt-out: the final report has three views and two completions, with one opt-out record stored. Redaction cannot repair that policy violation.

Test the exact time boundaries

Maximum arrival delay compares receipt time minus event time against an inclusive limit. Event e4 was created at second one and received at second eight. At six seconds it is late; at seven it is accepted, yielding five stored records and three completions under the otherwise default policy. At zero only e1 passes because its delay is zero. Report window changes reporting, not storage or deduplication. At the final receipt time fourteen, a three-second window includes e6 at eleven and e7 at thirteen; a two-second window excludes e6. The endpoints are inclusive. Return the window to twenty to see every accepted record again. This fixed delay limit is not an event-time watermark or a streaming engine implementation.

Inspect every transition

Play advances eight equally spaced arrival steps over sixty inspection seconds. The modeled receipt times on the cards remain distinct from this teaching clock. Pause freezes the current state; Next arrival pauses at the next arrival; Restart returns to the empty collector while retaining policy and speed. Inspection seeks backward or forward through the same computed history. Speed offers quarter, half, normal and double pace without changing results. A policy edit resets to the empty state without autoplay, and hiding the tab pauses playback. The textual report, decision trace and expandable Complete collector state provide the exact records behind the cards.

Keep a comparison and interpret limits

Capture baseline saves current settings and the visible arrival decision; Replace baseline updates it, and Clear baseline removes it. Write an observation in the notebook and use Export notes to download it; notes persist locally. Expand experiment enters fullscreen, and Exit full screen restores the page. Compare both stored record count and report count, since a narrow window can hide records without deleting them. These are event counts, not unique users, conversion rates or measured ADK performance. The consent flag is a trusted fixture input, not a real consent collection mechanism. There is no SDK, persistence, access control, legal compliance assessment, differential privacy or production identity resolution. The separate metrics and privacy-budget readings explain broader reporting concerns; this collector does not implement differential privacy.