diff --git a/public/css/style.css b/public/css/style.css
index 93dee54..7fb0b6b 100644
--- a/public/css/style.css
+++ b/public/css/style.css
@@ -798,6 +798,182 @@ section {
   color: var(--muted);
 }
 
+.footer-right {
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+}
+
+.footer-sep {
+  color: var(--border);
+}
+
+.footer a {
+  color: var(--dim);
+  transition: color 0.2s;
+}
+
+.footer a:hover {
+  color: var(--accent);
+}
+
+/* =============================================
+   COOKIE CONSENT BANNER
+   ============================================= */
+.cookie-banner {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: 200;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1.5rem;
+  padding: 1.25rem 2.5rem;
+  background: var(--dark);
+  border-top: 1px solid var(--border);
+  flex-wrap: wrap;
+}
+
+.cookie-banner[hidden] { display: none; }
+
+.cookie-text {
+  font-size: 0.78rem;
+  color: var(--dim);
+  line-height: 1.6;
+  flex: 1;
+  min-width: 0;
+}
+
+.cookie-text a {
+  color: var(--accent);
+  text-decoration: underline;
+  margin-left: 0.4rem;
+}
+
+.cookie-actions {
+  display: flex;
+  gap: 0.75rem;
+  flex-shrink: 0;
+}
+
+.cookie-btn {
+  font-family: var(--font-mono);
+  font-size: 0.72rem;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  padding: 0.55rem 1.25rem;
+  border: 1px solid var(--border);
+  background: transparent;
+  color: var(--dim);
+  cursor: pointer;
+  transition: color 0.2s, border-color 0.2s, background 0.2s;
+}
+
+.cookie-btn:hover {
+  color: var(--text);
+  border-color: var(--muted);
+}
+
+.cookie-btn-accept {
+  background: var(--accent);
+  color: var(--black);
+  border-color: var(--accent);
+}
+
+.cookie-btn-accept:hover {
+  background: var(--white);
+  border-color: var(--white);
+  color: var(--black);
+}
+
+/* =============================================
+   PRIVACY POLICY PAGE
+   ============================================= */
+.policy-wrap {
+  max-width: 760px;
+  margin: 0 auto;
+  padding: 7rem 2.5rem 6rem;
+}
+
+.policy-wrap h1 {
+  font-family: var(--font-display);
+  font-size: clamp(3rem, 6vw, 5.5rem);
+  line-height: 1;
+  color: var(--white);
+  letter-spacing: 0.02em;
+  margin-bottom: 0.5rem;
+}
+
+.policy-effective {
+  font-size: 0.72rem;
+  letter-spacing: 0.15em;
+  text-transform: uppercase;
+  color: var(--dim);
+  margin-bottom: 3.5rem;
+}
+
+.policy-section {
+  margin-bottom: 2.5rem;
+  border-top: 1px solid var(--border);
+  padding-top: 2rem;
+}
+
+.policy-section h2 {
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  font-weight: 500;
+  letter-spacing: 0.2em;
+  text-transform: uppercase;
+  color: var(--accent);
+  margin-bottom: 1rem;
+}
+
+.policy-section p,
+.policy-section li {
+  font-size: 0.88rem;
+  color: var(--dim);
+  line-height: 1.9;
+  margin-bottom: 0.8rem;
+}
+
+.policy-section ul {
+  list-style: none;
+  padding: 0;
+}
+
+.policy-section ul li::before {
+  content: '→ ';
+  color: var(--accent);
+}
+
+.policy-section a {
+  color: var(--accent);
+  text-decoration: underline;
+}
+
+.policy-section a:hover {
+  color: var(--white);
+}
+
+.policy-back {
+  display: inline-block;
+  font-size: 0.75rem;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--dim);
+  border-bottom: 1px solid var(--border);
+  padding-bottom: 0.2rem;
+  margin-bottom: 3rem;
+  transition: color 0.2s, border-color 0.2s;
+}
+
+.policy-back:hover {
+  color: var(--accent);
+  border-color: var(--accent);
+}
+
 /* =============================================
    ANIMATIONS
    ============================================= */
@@ -878,8 +1054,28 @@ section {
     text-align: center;
   }
 
+  .footer-right {
+    justify-content: center;
+  }
+
   .projects-footer {
     flex-direction: column;
     align-items: flex-start;
   }
+
+  .cookie-banner {
+    padding: 1.25rem 1.5rem;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 1rem;
+  }
+
+  .cookie-actions {
+    width: 100%;
+    justify-content: flex-end;
+  }
+
+  .policy-wrap {
+    padding: 6rem 1.5rem 4rem;
+  }
 }
diff --git a/public/index.html b/public/index.html
index ad6b120..6a8bdbe 100644
--- a/public/index.html
+++ b/public/index.html
@@ -11,14 +11,13 @@
   <link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=DM+Mono:ital,wght@0,300;0,400;0,500;1,300&family=Instrument+Serif:ital@0;1&display=swap" rel="stylesheet" />
   <link rel="stylesheet" href="css/style.css" />
 
-  <!-- Google tag (gtag.js) -->
+  <!-- Google tag (gtag.js) — analytics_storage denied until user consents -->
   <script async src="https://www.googletagmanager.com/gtag/js?id=G-QNSWDZWZ74"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
     function gtag(){dataLayer.push(arguments);}
     gtag('js', new Date());
-
-    gtag('config', 'G-QNSWDZWZ74');
+    gtag('consent', 'default', { 'analytics_storage': 'denied' });
   </script>
 </head>
 <body>
@@ -243,10 +242,25 @@ <h2 class="section-title">Ready to see what <em>AI can do for you?</em></h2>
       © 2026 LookAtWhatAiCanDo, LLC
     </div>
     <div class="footer-right">
+      <a href="/privacy.html">Privacy Policy</a>
+      <span class="footer-sep">·</span>
       lookatwhataicando.llc
     </div>
   </footer>
 
+  <!-- COOKIE CONSENT BANNER -->
+  <div id="cookie-banner" class="cookie-banner" hidden aria-live="polite" role="region" aria-label="Cookie consent">
+    <p class="cookie-text">
+      We use <strong>Google Analytics</strong> to understand how visitors use this site. No advertising cookies are set.
+      <a href="/privacy.html">Privacy Policy</a>
+    </p>
+    <div class="cookie-actions">
+      <button type="button" id="cookie-decline" class="cookie-btn cookie-btn-decline">Decline</button>
+      <button type="button" id="cookie-accept" class="cookie-btn cookie-btn-accept">Accept</button>
+    </div>
+  </div>
+
+  <script src="js/consent.js"></script>
   <script src="js/app.js"></script>
 </body>
 </html>
diff --git a/public/js/app.js b/public/js/app.js
index 2ac01d0..130db02 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -4,6 +4,11 @@
    generated at deploy time by GitHub Actions.
    ============================================= */
 
+// Returns true if the user has consented to tracking and gtag is available, false otherwise.
+function canTrack() {
+  return window.analyticsConsented === true && typeof gtag === 'function';
+}
+
 function timeAgo(dateString) {
   if (!dateString) return null;
   const date = new Date(dateString);
@@ -55,7 +60,7 @@ function renderProjects(projects, fromCache = false) {
 
     // Track project card clicks
     card.addEventListener('click', () => {
-      if (typeof gtag !== 'undefined') {
+      if (canTrack()) {
         gtag('event', 'project_click', {
           'project_name': p.name,
           'project_url': p.url
@@ -117,11 +122,10 @@ loadProjects();
 
 // ── Analytics Event Tracking ──────────────────────────────────────────────────
 (function initAnalyticsTracking() {
-  if (typeof gtag === 'undefined') return;
-
   // Track CTA button clicks
   document.querySelectorAll('.btn-primary, .btn-ghost').forEach(btn => {
     btn.addEventListener('click', () => {
+      if (!canTrack()) return;
       gtag('event', 'cta_click', {
         'button_text': btn.textContent.trim(),
         'button_href': btn.getAttribute('href')
@@ -133,6 +137,7 @@ loadProjects();
   const emailLink = document.querySelector('a[href^="mailto:"]');
   if (emailLink) {
     emailLink.addEventListener('click', () => {
+      if (!canTrack()) return;
       gtag('event', 'contact_email_click', {
         'contact_method': 'email_link'
       });
@@ -142,6 +147,7 @@ loadProjects();
   // Track social media link clicks
   document.querySelectorAll('.social-link').forEach(link => {
     link.addEventListener('click', () => {
+      if (!canTrack()) return;
       gtag('event', 'social_click', {
         'platform': link.querySelector('.social-name')?.textContent || 'unknown',
         'url': link.getAttribute('href')
diff --git a/public/js/consent.js b/public/js/consent.js
new file mode 100644
index 0000000..303a260
--- /dev/null
+++ b/public/js/consent.js
@@ -0,0 +1,65 @@
+/* =============================================
+   consent.js — LookAtWhatAiCanDo
+   Cookie consent management.
+   - Checks localStorage for a stored decision.
+   - Shows/hides the consent banner accordingly.
+   - On accept: upgrades GA4 consent and fires config.
+   - On decline: stores decision and hides banner.
+   ============================================= */
+
+(function initConsent() {
+  var STORAGE_KEY = 'cookie_consent';
+  var GA_ID = 'G-QNSWDZWZ74';
+
+  function enableAnalytics() {
+    if (typeof gtag !== 'function') return;
+    gtag('consent', 'update', { 'analytics_storage': 'granted' });
+    gtag('config', GA_ID);
+    window.analyticsConsented = true;
+  }
+
+  function showBanner() {
+    var banner = document.getElementById('cookie-banner');
+    if (banner) banner.removeAttribute('hidden');
+  }
+
+  function hideBanner() {
+    var banner = document.getElementById('cookie-banner');
+    if (banner) banner.setAttribute('hidden', '');
+  }
+
+  // Apply any previously stored decision immediately
+  var stored = null;
+  try {
+    stored = localStorage.getItem(STORAGE_KEY);
+  } catch (e) {
+    // Storage unavailable — treat as no decision
+  }
+  if (stored === 'accepted') {
+    enableAnalytics();
+  } else if (!stored) {
+    // No decision yet — show the banner
+    showBanner();
+  }
+  // 'declined' — do nothing (analytics stays denied)
+
+  // Wire up banner buttons
+  var acceptBtn = document.getElementById('cookie-accept');
+  var declineBtn = document.getElementById('cookie-decline');
+
+  if (acceptBtn) {
+    acceptBtn.addEventListener('click', function () {
+      var saved = false;
+      try { localStorage.setItem(STORAGE_KEY, 'accepted'); saved = true; } catch (e) {}
+      if (saved) enableAnalytics();
+      hideBanner();
+    });
+  }
+
+  if (declineBtn) {
+    declineBtn.addEventListener('click', function () {
+      try { localStorage.setItem(STORAGE_KEY, 'declined'); } catch (e) {}
+      hideBanner();
+    });
+  }
+}());
diff --git a/public/privacy.html b/public/privacy.html
new file mode 100644
index 0000000..1262848
--- /dev/null
+++ b/public/privacy.html
@@ -0,0 +1,174 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Privacy Policy — LookAtWhatAiCanDo</title>
+  <meta name="description" content="Privacy policy for LookAtWhatAiCanDo, LLC — what data we collect, how we use it, and your rights." />
+  <meta name="robots" content="noindex" />
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+  <link rel="preconnect" href="https://fonts.googleapis.com" />
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+  <link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=DM+Mono:ital,wght@0,300;0,400;0,500;1,300&family=Instrument+Serif:ital@0;1&display=swap" rel="stylesheet" />
+  <link rel="stylesheet" href="css/style.css" />
+</head>
+<body>
+
+  <!-- NOISE OVERLAY -->
+  <div class="noise"></div>
+
+  <!-- NAV -->
+  <nav class="nav">
+    <div class="nav-logo"><a href="/"><img src="favicon.svg" class="nav-logo-img" alt="">LAWACD</a></div>
+    <div class="nav-links">
+      <a href="/#services">Services</a>
+      <a href="/#projects">Projects</a>
+      <a href="/#contact">Contact</a>
+    </div>
+  </nav>
+
+  <main class="policy-wrap">
+    <a href="/" class="policy-back">← Back to Home</a>
+
+    <div class="section-label">// Legal</div>
+    <h1>Privacy Policy</h1>
+    <p class="policy-effective">Effective date: March 28, 2026</p>
+
+    <div class="policy-section">
+      <h2>01 — Who We Are</h2>
+      <p>
+        LookAtWhatAiCanDo, LLC ("we", "our", "us") operates the website at
+        <a href="https://lookatwhataicando.llc">lookatwhataicando.llc</a>.
+        We are an AI consulting company. Questions about this policy can be sent to
+        <a href="mailto:hello@lookatwhataicando.llc">hello@lookatwhataicando.llc</a>.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>02 — What Data We Collect</h2>
+      <p>This site does not collect personal information directly. When you consent to analytics, Google Analytics 4 may collect:</p>
+      <ul>
+        <li>Your anonymized IP address (used only to infer approximate country/region)</li>
+        <li>Pages you visit and how long you spend on them</li>
+        <li>The browser, device type, and operating system you use</li>
+        <li>The source that referred you to this site (e.g. a search engine or social link)</li>
+        <li>Interactions such as button clicks and link navigation</li>
+      </ul>
+      <p>We do not collect your name, email address, or any other identifying information unless you contact us directly.</p>
+    </div>
+
+    <div class="policy-section">
+      <h2>03 — Cookies</h2>
+      <p>
+        This site stores your consent choice in your browser's <code>localStorage</code> under the key
+        <code>cookie_consent</code>. This is a local browser storage entry — not an HTTP cookie — and
+        is never transmitted to our servers.
+      </p>
+      <p>
+        If you accept analytics, Google Analytics 4 sets HTTP cookies (e.g. <code>_ga</code>, <code>_ga_*</code>)
+        to distinguish visitors and sessions. In our standard setup these are first-party cookies set on
+        this domain in connection with a service provided by Google, and data collected via these cookies is
+        subject to
+        <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">Google's Privacy Policy</a>.
+      </p>
+      <p>
+        If you decline, no analytics cookies are set.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>04 — How We Use Your Data</h2>
+      <p>Analytics data is used solely to understand how visitors use this site so we can improve it. We do not:</p>
+      <ul>
+        <li>Sell or share your data with advertisers</li>
+        <li>Use it for retargeting or ad campaigns</li>
+        <li>Combine it with data from other sources to identify you</li>
+      </ul>
+    </div>
+
+    <div class="policy-section">
+      <h2>05 — Third-Party Services</h2>
+      <p>
+        We use <strong>Google Analytics 4</strong> (Google LLC, USA). When analytics is enabled, data is transferred to
+        Google servers in the United States under Google's standard contractual clauses. For details, see
+        <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">Google's Privacy Policy</a> and
+        <a href="https://support.google.com/analytics/answer/6004245" target="_blank" rel="noopener">Google Analytics data safeguards</a>.
+      </p>
+      <p>
+        This site also loads fonts from <strong>Google Fonts</strong>. Google may log your IP address when
+        serving font files. See
+        <a href="https://developers.google.com/fonts/faq/privacy" target="_blank" rel="noopener">Google Fonts privacy FAQ</a>.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>06 — Data Retention</h2>
+      <p>
+        Google Analytics retains event-level data for 14 months by default. Aggregated reports may be retained
+        indefinitely. You can request deletion of your data at any time by contacting us.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>07 — Your Rights</h2>
+      <p>Depending on your location, you may have the right to:</p>
+      <ul>
+        <li>Access the personal data we hold about you</li>
+        <li>Request correction or deletion of that data</li>
+        <li>Object to or restrict how we process your data</li>
+        <li>Withdraw consent at any time (this will not affect past processing)</li>
+        <li>Lodge a complaint with your local data protection authority (e.g. the ICO in the UK, or your EU supervisory authority)</li>
+      </ul>
+      <p>To exercise these rights, email <a href="mailto:hello@lookatwhataicando.llc">hello@lookatwhataicando.llc</a>.</p>
+    </div>
+
+    <div class="policy-section">
+      <h2>08 — How to Opt Out or Change Your Choice</h2>
+      <p>You can change your analytics consent at any time:</p>
+      <ul>
+        <li>Clear your browser's <code>localStorage</code> for this site, then reload — the consent banner will reappear</li>
+        <li>Install the <a href="https://tools.google.com/dlpage/gaoptout" target="_blank" rel="noopener">Google Analytics Opt-out Browser Add-on</a></li>
+        <li>Use your browser's built-in privacy or tracking-protection settings</li>
+      </ul>
+    </div>
+
+    <div class="policy-section">
+      <h2>09 — Children's Privacy</h2>
+      <p>
+        This site is not directed at children under 13 (or under 16 in the EU/UK). We do not knowingly
+        collect data from children.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>10 — Changes to This Policy</h2>
+      <p>
+        We may update this policy from time to time. The effective date at the top of this page will be
+        updated when changes are made. Continued use of this site after changes constitutes acceptance of
+        the revised policy.
+      </p>
+    </div>
+
+    <div class="policy-section">
+      <h2>11 — Contact</h2>
+      <p>
+        LookAtWhatAiCanDo, LLC<br />
+        <a href="mailto:hello@lookatwhataicando.llc">hello@lookatwhataicando.llc</a>
+      </p>
+    </div>
+  </main>
+
+  <!-- FOOTER -->
+  <footer class="footer">
+    <div class="footer-left">
+      © 2026 LookAtWhatAiCanDo, LLC
+    </div>
+    <div class="footer-right">
+      <a href="/privacy.html">Privacy Policy</a>
+      <span class="footer-sep">·</span>
+      lookatwhataicando.llc
+    </div>
+  </footer>
+
+</body>
+</html>