diff --git a/.env.example b/.env.example
index 4ccec42..3b223be 100644
--- a/.env.example
+++ b/.env.example
@@ -17,10 +17,11 @@ NEXT_PUBLIC_ADMIN_DID=did:plc:pgwr6hkosgznfl5nz7egajei
 # Leave empty to disable Google Analytics. NEXT_PUBLIC_ prefix exposes it to the client.
 NEXT_PUBLIC_GA_ID=
 
-# Analytics cookie-consent banner. ON by default: the consent banner + footer
-# "Cookie settings" link are shown and analytics only loads after the visitor
-# agrees. Set to "off" to hide the banner and load analytics directly.
-NEXT_PUBLIC_COOKIE_CONSENT=on
+# Analytics cookie-consent banner. OFF by default: no banner is shown and
+# analytics loads directly (cookies still set) when NEXT_PUBLIC_GA_ID is set.
+# Set to "on" to show the consent banner + footer "Cookie settings" link and
+# gate analytics on the visitor's choice (recommended for EU/UK).
+NEXT_PUBLIC_COOKIE_CONSENT=off
 
 # GraphQL indexer URL for org.plresearch.* records
 # Default: https://api.hi.gainforest.app/graphql
diff --git a/README.md b/README.md
index 75bbb71..f67bc7a 100644
--- a/README.md
+++ b/README.md
@@ -111,7 +111,7 @@ These files are edited directly as JSON and consumed by hardcoded FA2 sub-pages
 | `COOKIE_SECRET` | Yes | 32+ character secret for encrypting session cookies |
 | `PUBLIC_URL` | No | Production URL (empty defaults to localhost) |
 | `NEXT_PUBLIC_GA_ID` | No | Google Analytics 4 Measurement ID (empty disables analytics) |
-| `NEXT_PUBLIC_COOKIE_CONSENT` | No | `off` hides the analytics consent banner + footer link and loads analytics directly; anything else (default) shows the consent banner |
+| `NEXT_PUBLIC_COOKIE_CONSENT` | No | `on` shows the analytics consent banner + footer link and gates analytics on consent; anything else (default) hides the banner and loads analytics directly (cookies still set) |
 
 ## Deployment
 
diff --git a/src/lib/cookie-consent.ts b/src/lib/cookie-consent.ts
index ed616f0..ae40ed4 100644
--- a/src/lib/cookie-consent.ts
+++ b/src/lib/cookie-consent.ts
@@ -1,8 +1,9 @@
 // Feature flag for the analytics cookie-consent banner + footer "Cookie
 // settings" link.
 //
-// ON by default: the consent banner is shown and Google Analytics only loads
-// after the visitor agrees. Set NEXT_PUBLIC_COOKIE_CONSENT=off to hide the
-// banner and load analytics directly.
+// OFF by default: no consent banner is shown and Google Analytics loads
+// directly (cookies still set) whenever NEXT_PUBLIC_GA_ID is present. Set
+// NEXT_PUBLIC_COOKIE_CONSENT=on to bring the consent banner back and gate
+// analytics on the visitor's choice.
 export const COOKIE_CONSENT_ENABLED =
-  process.env.NEXT_PUBLIC_COOKIE_CONSENT !== 'off'
+  process.env.NEXT_PUBLIC_COOKIE_CONSENT === 'on'