Prompt to fix: In production builds, sanitize console output and analytics dataLayer payloads to redact or replace session identifiers. Specifically: 1) Remove sessionId from DataLayer pushes destined for production; if a session identifier must be tracked, replace with a non-persistent, non-PII token or a cryptographic hash that cannot be used to reconstruct the session. 2) Audit all console.log/debug statements and analytics integration paths for sensitive data exposure; gate logs behind an env flag so that in production they do not print sensitive values. 3) Implement a centralized logging sanitizer utility and enforce it via code review and CI checks.

Mask or remove GA/Ads IDs from client-side console logs. Do not print AW- followed IDs or other third-party tracking identifiers in DataLayer logging. If IDs are needed for debugging, replace with non-identifying placeholders and enable a secure server-side logging path for real values.

On the page, wrap the Google Tag Manager/GA4 script loading with a consent check. Do not inject or execute GTM/GA4 scripts until the user has explicitly consented to analytics tracking. Dynamically load the scripts after consent, initialize gtag only after consent, and configure GA4 to minimize data collection (e.g., disable ad personalization features, enable IP anonymization if supported, and avoid sending sensitive data). Ensure a visible privacy/consent banner is present and that revoking consent stops data collection. Provide a minimal, compliant loading sequence and test with consent given and denied.