diff --git a/CHANGELOG.md b/CHANGELOG.md
index b722ea77..1c2d6cbd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,34 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows
 
 ## [Unreleased]
 
+## [1.6.3] — 2026-09-14
+
+**Google Analytics connect flow brought in line with Google's OAuth branding and privacy guidelines.**
+
+### Added
+
+- **In-product Google-data notice** on the Analytics settings screen (TIGER-118). Before the connect
+  button, the screen now states the single scope requested (`analytics.readonly`), where the data goes
+  (rendered in the install's own dashboard — the WebTigers broker never sees or stores report data),
+  how long the connection lasts, how to revoke it, and links the privacy policy. Nine new
+  `analytics.*` keys in all seven locales.
+
+### Changed
+
+- **"Continue with Google" button follows Google's sign-in branding guidelines** (TIGER-118): the
+  supplied four-colour G mark as inline SVG on a neutral button, Roboto with a system fallback, light
+  and dark variants, hover/press states — replacing the `btn-primary` with a third-party icon-font
+  glyph. The remaining icon-font Google marks on the analytics screens were swapped for neutral icons.
+
+### Fixed
+
+- **Disconnect revokes the Google token** (TIGER-117). `Tiger_Google_Analytics::disconnect()` now
+  POSTs the refresh token to Google's revocation endpoint before clearing it locally, so a disconnect
+  ends Google's grant instead of only forgetting it on our side. Fail-soft: if Google is unreachable
+  the local token is still cleared and the screen reports that the grant should be revoked from the
+  Google Account permissions page. `DisconnectRevokeTest` exercises both paths, including a real 200
+  from a local HTTP server.
+
 ## [1.6.2] — 2026-09-13
 
 **Module assets publish themselves.**
diff --git a/library/Tiger/Google/Analytics.php b/library/Tiger/Google/Analytics.php
index ff97ef63..60c467ec 100644
--- a/library/Tiger/Google/Analytics.php
+++ b/library/Tiger/Google/Analytics.php
@@ -32,6 +32,7 @@ class Tiger_Google_Analytics
     const SCOPE     = 'https://www.googleapis.com/auth/analytics.readonly';
     const AUTH_URL  = 'https://accounts.google.com/o/oauth2/v2/auth';
     const TOKEN_URL = 'https://oauth2.googleapis.com/token';
+    const REVOKE_URL = 'https://oauth2.googleapis.com/revoke';
     const DATA_URL  = 'https://analyticsdata.googleapis.com/v1beta/properties/%s:runReport';
     const CACHE_TTL = 1800;   // 30 min — GA data isn't real-time and the API is quota-limited
 
@@ -130,11 +131,45 @@ public static function saveOauthConfig($clientId, $clientSecret, $propertyId)
     }
 
     /** Forget the OAuth connection (drop the refresh token). Client creds + property id stay. */
+    /**
+     * Disconnect: REVOKE the grant at Google, then forget the token (TIGER-117).
+     *
+     * Forgetting alone — the previous behaviour — only made this install unable to use the grant; it
+     * stayed live in the user's Google account until they found it under myaccount.google.com/permissions.
+     * A person who clicks Disconnect reasonably believes they have withdrawn access, and the published
+     * privacy policy says so. Google's verification review requires the policy to match actual practice.
+     *
+     * Revocation needs only the token itself — no client secret — so the install calls Google directly
+     * in either mode; no broker endpoint is involved. FAIL-SOFT: if Google is unreachable the local
+     * token is still cleared, because leaving someone unable to disconnect would be worse. The outcome
+     * is returned so the screen can say which of the two things happened.
+     *
+     * @return array{revoked:bool} whether Google confirmed the revocation
+     */
     public static function disconnect()
     {
+        $revoked = false;
+        $refresh = self::_refreshToken();
+        if ($refresh !== '') {
+            // Google returns 200 on success and on an already-invalid token; _http() yields null for
+            // anything non-2xx or unreachable. Either way we go on to clear locally.
+            $res = self::_http(static::_revokeUrl(), [
+                'method'  => 'POST',
+                'headers' => ['Content-Type: application/x-www-form-urlencoded'],
+                'body'    => http_build_query(['token' => $refresh]),
+            ]);
+            $revoked = ($res !== null);
+        }
         (new Tiger_Model_Config())->set(Tiger_Model_Config::SCOPE_GLOBAL, '', 'tiger.analytics.oauth.refresh_token_enc', '');
         self::$_access = null;
         @unlink(self::_cacheFile());
+        return ['revoked' => $revoked];
+    }
+
+    /** Google's revocation endpoint. A seam: tests point it at a dead port to exercise the fail-soft path. */
+    protected static function _revokeUrl()
+    {
+        return self::REVOKE_URL;
     }
 
     // =====================================================================================
diff --git a/library/Tiger/Version.php b/library/Tiger/Version.php
index 47bf5794..be6cc320 100644
--- a/library/Tiger/Version.php
+++ b/library/Tiger/Version.php
@@ -9,5 +9,5 @@
 class Tiger_Version
 {
     /** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */
-    const VERSION = '1.6.2';
+    const VERSION = '1.6.3';
 }
diff --git a/modules/analytics/controllers/AdminController.php b/modules/analytics/controllers/AdminController.php
index de3c800f..b8bbd84e 100644
--- a/modules/analytics/controllers/AdminController.php
+++ b/modules/analytics/controllers/AdminController.php
@@ -145,8 +145,14 @@ public function disconnectAction()
     {
         $this->_helper->layout()->disableLayout();
         $this->_helper->viewRenderer->setNoRender(true);
-        Tiger_Google_Analytics::disconnect();
-        $this->_flash('Disconnected from Google Analytics.', 'success');
+        // Two different outcomes, said differently: "we revoked it" and "we could not reach Google to
+        // revoke it — here is where you can" are not the same message (TIGER-117).
+        $out = Tiger_Google_Analytics::disconnect();
+        if (!empty($out['revoked'])) {
+            $this->_flash($this->view->t('analytics.disconnected'), 'success');
+        } else {
+            $this->_flash($this->view->t('analytics.disconnected_not_revoked'), 'alert');
+        }
         $this->_redirect('/analytics/admin');
     }
 
diff --git a/modules/analytics/languages/de/analytics.php b/modules/analytics/languages/de/analytics.php
index dac1fac3..a975d7af 100644
--- a/modules/analytics/languages/de/analytics.php
+++ b/modules/analytics/languages/de/analytics.php
@@ -46,6 +46,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (leer lassen, um es zu behalten)',
 
     'analytics.view_dashboard'         => 'Dashboard ansehen',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Weiter mit Google',
+    'analytics.disconnected' => 'Von Google Analytics getrennt. Die Autorisierung wurde bei Google widerrufen.',
+    'analytics.disconnected_not_revoked' => 'Von dieser Website getrennt, aber Google war nicht erreichbar, um die Autorisierung zu widerrufen. Sie können sie unter myaccount.google.com/permissions entfernen.',
+    'analytics.gdata.title' => 'Was die Verbindung mit Ihren Google-Daten macht',
+    'analytics.gdata.scope' => 'Nur-Lese-Zugriff auf Ihre Google-Analytics-Berichte — der Bereich analytics.readonly und sonst nichts.',
+    'analytics.gdata.where' => 'Berichte werden von dieser Website direkt bei Google abgerufen und nur Ihren Administratoren angezeigt.',
+    'analytics.gdata.retain' => 'WebTigers speichert Ihre Analysedaten nicht und sieht sie nicht; der Verbindungsdienst tauscht nur Tokens aus.',
+    'analytics.gdata.revoke' => 'Trennen Sie hier jederzeit, oder entziehen Sie den Zugriff in Ihrem Google-Konto.',
+    'analytics.gdata.policy_link' => 'Wie wir Google-Nutzerdaten behandeln — Datenschutzerklärung',
     'analytics.disconnect'             => 'Trennen',
     'analytics.connect'                => 'Google Analytics verbinden',
     'analytics.connect_hint'           => 'Speichert Ihre Einstellungen und öffnet dann Google zur Autorisierung.',
diff --git a/modules/analytics/languages/en/analytics.php b/modules/analytics/languages/en/analytics.php
index bdd2fa56..a0e82b7a 100644
--- a/modules/analytics/languages/en/analytics.php
+++ b/modules/analytics/languages/en/analytics.php
@@ -47,6 +47,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (leave blank to keep)',
 
     'analytics.view_dashboard'         => 'View dashboard',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Continue with Google',
+    'analytics.disconnected' => 'Disconnected from Google Analytics. The authorization was revoked with Google.',
+    'analytics.disconnected_not_revoked' => 'Disconnected from this site, but Google could not be reached to revoke the authorization. You can remove it at myaccount.google.com/permissions.',
+    'analytics.gdata.title' => 'What connecting does with your Google data',
+    'analytics.gdata.scope' => 'Read-only access to your Google Analytics reports — the analytics.readonly scope, and nothing else.',
+    'analytics.gdata.where' => 'Reports are fetched by this site directly from Google and shown only to your administrators.',
+    'analytics.gdata.retain' => 'WebTigers does not store or see your analytics data; the connection service only exchanges tokens.',
+    'analytics.gdata.revoke' => 'Disconnect at any time here, or remove access in your Google Account.',
+    'analytics.gdata.policy_link' => 'How we handle Google user data — Privacy Policy',
     'analytics.disconnect'             => 'Disconnect',
     'analytics.connect'                => 'Connect Google Analytics',
     'analytics.connect_hint'           => 'Saves your settings, then opens Google to authorize.',
diff --git a/modules/analytics/languages/es/analytics.php b/modules/analytics/languages/es/analytics.php
index 08443f8b..605f871c 100644
--- a/modules/analytics/languages/es/analytics.php
+++ b/modules/analytics/languages/es/analytics.php
@@ -46,6 +46,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (déjalo en blanco para conservarlo)',
 
     'analytics.view_dashboard'         => 'Ver panel',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Continuar con Google',
+    'analytics.disconnected' => 'Desconectado de Google Analytics. La autorización se revocó en Google.',
+    'analytics.disconnected_not_revoked' => 'Desconectado de este sitio, pero no se pudo contactar con Google para revocar la autorización. Puedes eliminarla en myaccount.google.com/permissions.',
+    'analytics.gdata.title' => 'Qué hace la conexión con tus datos de Google',
+    'analytics.gdata.scope' => 'Acceso de solo lectura a tus informes de Google Analytics — el permiso analytics.readonly y nada más.',
+    'analytics.gdata.where' => 'Los informes los obtiene este sitio directamente de Google y solo se muestran a tus administradores.',
+    'analytics.gdata.retain' => 'WebTigers no almacena ni ve tus datos de analítica; el servicio de conexión solo intercambia tokens.',
+    'analytics.gdata.revoke' => 'Desconéctate aquí en cualquier momento, o retira el acceso desde tu cuenta de Google.',
+    'analytics.gdata.policy_link' => 'Cómo tratamos los datos de usuario de Google — Política de privacidad',
     'analytics.disconnect'             => 'Desconectar',
     'analytics.connect'                => 'Conectar Google Analytics',
     'analytics.connect_hint'           => 'Guarda tu configuración y luego abre Google para autorizar.',
diff --git a/modules/analytics/languages/fr/analytics.php b/modules/analytics/languages/fr/analytics.php
index 937c0d71..da15b6de 100644
--- a/modules/analytics/languages/fr/analytics.php
+++ b/modules/analytics/languages/fr/analytics.php
@@ -46,6 +46,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (laissez vide pour conserver)',
 
     'analytics.view_dashboard'         => 'Voir le tableau de bord',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Continuer avec Google',
+    'analytics.disconnected' => 'Déconnecté de Google Analytics. L\'autorisation a été révoquée auprès de Google.',
+    'analytics.disconnected_not_revoked' => 'Déconnecté de ce site, mais Google n\'a pas pu être joint pour révoquer l\'autorisation. Vous pouvez la retirer sur myaccount.google.com/permissions.',
+    'analytics.gdata.title' => 'Ce que la connexion fait de vos données Google',
+    'analytics.gdata.scope' => 'Accès en lecture seule à vos rapports Google Analytics — le périmètre analytics.readonly, et rien d\'autre.',
+    'analytics.gdata.where' => 'Les rapports sont récupérés par ce site directement auprès de Google et affichés uniquement à vos administrateurs.',
+    'analytics.gdata.retain' => 'WebTigers ne stocke ni ne voit vos données d\'analyse ; le service de connexion n\'échange que des jetons.',
+    'analytics.gdata.revoke' => 'Déconnectez-vous ici à tout moment, ou retirez l\'accès dans votre compte Google.',
+    'analytics.gdata.policy_link' => 'Comment nous traitons les données utilisateur Google — Politique de confidentialité',
     'analytics.disconnect'             => 'Déconnecter',
     'analytics.connect'                => 'Connecter Google Analytics',
     'analytics.connect_hint'           => 'Enregistre vos paramètres, puis ouvre Google pour autoriser.',
diff --git a/modules/analytics/languages/hi/analytics.php b/modules/analytics/languages/hi/analytics.php
index 7fe84f3a..f31de4b4 100644
--- a/modules/analytics/languages/hi/analytics.php
+++ b/modules/analytics/languages/hi/analytics.php
@@ -46,6 +46,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (बनाए रखने के लिए खाली छोड़ें)',
 
     'analytics.view_dashboard'         => 'डैशबोर्ड देखें',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Google के साथ जारी रखें',
+    'analytics.disconnected' => 'Google Analytics से डिस्कनेक्ट किया गया। Google पर प्राधिकरण निरस्त कर दिया गया।',
+    'analytics.disconnected_not_revoked' => 'इस साइट से डिस्कनेक्ट किया गया, लेकिन प्राधिकरण निरस्त करने के लिए Google से संपर्क नहीं हो सका। आप इसे myaccount.google.com/permissions पर हटा सकते हैं।',
+    'analytics.gdata.title' => 'कनेक्ट करने से आपके Google डेटा के साथ क्या होता है',
+    'analytics.gdata.scope' => 'आपकी Google Analytics रिपोर्टों तक केवल-पढ़ने की पहुँच — analytics.readonly स्कोप, और कुछ नहीं।',
+    'analytics.gdata.where' => 'रिपोर्टें यह साइट सीधे Google से लाती है और केवल आपके व्यवस्थापकों को दिखाती है।',
+    'analytics.gdata.retain' => 'WebTigers आपका एनालिटिक्स डेटा न संग्रहीत करता है न देखता है; कनेक्शन सेवा केवल टोकन का आदान-प्रदान करती है।',
+    'analytics.gdata.revoke' => 'यहाँ किसी भी समय डिस्कनेक्ट करें, या अपने Google खाते में पहुँच हटाएँ।',
+    'analytics.gdata.policy_link' => 'हम Google उपयोगकर्ता डेटा को कैसे संभालते हैं — गोपनीयता नीति',
     'analytics.disconnect'             => 'डिस्कनेक्ट करें',
     'analytics.connect'                => 'Google Analytics कनेक्ट करें',
     'analytics.connect_hint'           => 'आपकी सेटिंग्स सहेजता है, फिर अधिकृत करने के लिए Google खोलता है।',
diff --git a/modules/analytics/languages/pt/analytics.php b/modules/analytics/languages/pt/analytics.php
index 162fd364..82e0c44b 100644
--- a/modules/analytics/languages/pt/analytics.php
+++ b/modules/analytics/languages/pt/analytics.php
@@ -46,6 +46,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (deixe em branco para manter)',
 
     'analytics.view_dashboard'         => 'Ver painel',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Continuar com o Google',
+    'analytics.disconnected' => 'Desconectado do Google Analytics. A autorização foi revogada no Google.',
+    'analytics.disconnected_not_revoked' => 'Desconectado deste site, mas não foi possível contatar o Google para revogar a autorização. Você pode removê-la em myaccount.google.com/permissions.',
+    'analytics.gdata.title' => 'O que a conexão faz com seus dados do Google',
+    'analytics.gdata.scope' => 'Acesso somente leitura aos seus relatórios do Google Analytics — o escopo analytics.readonly e nada mais.',
+    'analytics.gdata.where' => 'Os relatórios são obtidos por este site diretamente do Google e exibidos apenas aos seus administradores.',
+    'analytics.gdata.retain' => 'A WebTigers não armazena nem vê seus dados de análise; o serviço de conexão apenas troca tokens.',
+    'analytics.gdata.revoke' => 'Desconecte aqui a qualquer momento, ou remova o acesso na sua Conta do Google.',
+    'analytics.gdata.policy_link' => 'Como tratamos os dados de usuário do Google — Política de Privacidade',
     'analytics.disconnect'             => 'Desconectar',
     'analytics.connect'                => 'Conectar o Google Analytics',
     'analytics.connect_hint'           => 'Salva suas configurações e depois abre o Google para autorizar.',
diff --git a/modules/analytics/languages/tlh/analytics.php b/modules/analytics/languages/tlh/analytics.php
index 38615218..6a833ccc 100644
--- a/modules/analytics/languages/tlh/analytics.php
+++ b/modules/analytics/languages/tlh/analytics.php
@@ -48,6 +48,16 @@
     'analytics.oauth_secret_keep'      => '•••••• (leave blank to keep)',
 
     'analytics.view_dashboard'         => 'View dashboard',
+    // OAuth verification requirements (TIGER-117/118)
+    'analytics.connect_google' => 'Continue with Google',
+    'analytics.disconnected' => 'Disconnected from Google Analytics. The authorization was revoked with Google.',
+    'analytics.disconnected_not_revoked' => 'Disconnected from this site, but Google could not be reached to revoke the authorization. You can remove it at myaccount.google.com/permissions.',
+    'analytics.gdata.title' => 'What connecting does with your Google data',
+    'analytics.gdata.scope' => 'Read-only access to your Google Analytics reports — the analytics.readonly scope, and nothing else.',
+    'analytics.gdata.where' => 'Reports are fetched by this site directly from Google and shown only to your administrators.',
+    'analytics.gdata.retain' => 'WebTigers does not store or see your analytics data; the connection service only exchanges tokens.',
+    'analytics.gdata.revoke' => 'Disconnect at any time here, or remove access in your Google Account.',
+    'analytics.gdata.policy_link' => 'How we handle Google user data — Privacy Policy',
     'analytics.disconnect'             => 'Disconnect',
     'analytics.connect'                => 'Connect Google Analytics',
     'analytics.connect_hint'           => 'Saves your settings, then opens Google to authorize.',
diff --git a/modules/analytics/views/scripts/admin/dashboard.phtml b/modules/analytics/views/scripts/admin/dashboard.phtml
index 0266dfe9..c6952be2 100644
--- a/modules/analytics/views/scripts/admin/dashboard.phtml
+++ b/modules/analytics/views/scripts/admin/dashboard.phtml
@@ -25,7 +25,7 @@
         <i class="fa-solid fa-chart-line fs-1 text-body-secondary mb-3 d-block"></i>
         <h2 class="h5"><?= $this->t('analytics.dashboard.not_connected_title') ?></h2>
         <p class="text-body-secondary"><?= $this->t('analytics.dashboard.not_connected_body') ?></p>
-        <a href="/analytics/admin" class="btn btn-primary"><i class="fa-brands fa-google me-2"></i><?= $this->t('analytics.dashboard.go_settings') ?></a>
+        <a href="/analytics/admin" class="btn btn-primary"><i class="fa-solid fa-gear me-2"></i><?= $this->t('analytics.dashboard.go_settings') ?></a>
     </div>
 </div>
 <?php else: ?>
diff --git a/modules/analytics/views/scripts/admin/index.phtml b/modules/analytics/views/scripts/admin/index.phtml
index 7a04f441..624c81aa 100644
--- a/modules/analytics/views/scripts/admin/index.phtml
+++ b/modules/analytics/views/scripts/admin/index.phtml
@@ -48,7 +48,7 @@ $mode = ($this->ga['mode'] === 'byo') ? 'byo' : 'broker';
 
     <div class="tab-content border border-top-0 rounded-bottom p-4 mb-4">
         <div class="tab-pane fade show active" id="analytics-tab-tag" role="tabpanel" aria-labelledby="analytics-tab-tag-btn">
-            <h2 class="h6 fw-semibold mb-3"><i class="fa-brands fa-google me-2 text-primary"></i>Google Analytics 4</h2>
+            <h2 class="h6 fw-semibold mb-3"><i class="fa-solid fa-chart-line me-2 text-primary"></i>Google Analytics 4</h2>
             <div class="row g-4">
                 <div class="col-lg-8">
                     <div class="form-check form-switch mb-3">
@@ -129,7 +129,7 @@ $mode = ($this->ga['mode'] === 'byo') ? 'byo' : 'broker';
                     <input type="text" class="form-control form-control-sm font-monospace" value="<?= $this->escape($this->ga['redirect_uri']) ?>" readonly onclick="this.select()" aria-label="OAuth redirect URI">
                 </div>
                 <details class="mt-3 small">
-                    <summary class="text-primary" style="cursor:pointer;">How do I get these? (one-time Google setup)</summary>
+                    <summary class="text-primary analytics-summary">How do I get these? (one-time Google setup)</summary>
                     <ol class="text-body-secondary mt-2 mb-0 ps-3">
                         <li>Google Cloud Console → create or pick a project.</li>
                         <li>APIs &amp; Services → Library → enable the <strong>Google Analytics Data API</strong>.</li>
@@ -145,11 +145,50 @@ $mode = ($this->ga['mode'] === 'byo') ? 'byo' : 'broker';
                     <a href="/analytics/admin/dashboard" class="btn btn-primary"><i class="fa-solid fa-chart-line me-2"></i><?= $this->t('analytics.view_dashboard') ?></a>
                     <a href="/analytics/admin/disconnect" class="btn btn-outline-danger"><i class="fa-solid fa-plug-circle-xmark me-2"></i><?= $this->t('analytics.disconnect') ?></a>
                 <?php else: ?>
-                    <button type="button" id="analytics-connect" class="btn btn-primary"><i class="fa-brands fa-google me-2"></i><?= $this->t('analytics.connect') ?></button>
-                    <span class="small text-body-secondary"><?= $this->t('analytics.connect_hint') ?></span>
+                    <?php
+                    // Google's OWN button, per their branding guidelines (TIGER-118): their "G" mark as an
+                    // inline SVG (never a third-party icon font — that is a trademark problem), on a neutral
+                    // button in Roboto, with one of the approved phrasings. A reviewer watching the demo video
+                    // sees this button; the Bootstrap-primary-with-a-Font-Awesome-G it replaces fails review.
+                    ?>
+                    <button type="button" id="analytics-connect" class="gsi-material-button" aria-label="<?= $this->escape($this->t('analytics.connect_google')) ?>">
+                        <span class="gsi-material-button-state"></span>
+                        <span class="gsi-material-button-content-wrapper">
+                            <span class="gsi-material-button-icon">
+                                <svg viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+                                    <path fill="#EA4335" d="M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"></path>
+                                    <path fill="#4285F4" d="M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"></path>
+                                    <path fill="#FBBC05" d="M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z"></path>
+                                    <path fill="#34A853" d="M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"></path>
+                                    <path fill="none" d="M0 0h48v48H0z"></path>
+                                </svg>
+                            </span>
+                            <span class="gsi-material-button-contents"><?= $this->escape($this->t('analytics.connect_google')) ?></span>
+                        </span>
+                    </button>
+                    <span class="text-body-secondary"><?= $this->t('analytics.connect_hint') ?></span>
                 <?php endif; ?>
             </div>
 
+            <?php if (!$this->ga['connected']): ?>
+                <?php
+                // The in-product privacy notice Google's verification requires, at the point of consent —
+                // not in a collapsed panel (TIGER-118). What the connection does with the account's data,
+                // stated where the person decides. The existing "Privacy & consent" box is about VISITOR
+                // cookies for the tag; this is about the OPERATOR's Google account.
+                ?>
+                <div class="mt-3 p-3 rounded bg-body-tertiary" id="analytics-google-data-notice">
+                    <p class="mb-2 fw-semibold"><i class="fa-solid fa-shield-halved me-2 text-primary"></i><?= $this->escape($this->t('analytics.gdata.title')) ?></p>
+                    <ul class="mb-2">
+                        <li><?= $this->escape($this->t('analytics.gdata.scope')) ?></li>
+                        <li><?= $this->escape($this->t('analytics.gdata.where')) ?></li>
+                        <li><?= $this->escape($this->t('analytics.gdata.retain')) ?></li>
+                        <li><?= $this->escape($this->t('analytics.gdata.revoke')) ?></li>
+                    </ul>
+                    <p class="mb-0"><a href="/privacy" target="_blank" rel="noopener"><?= $this->escape($this->t('analytics.gdata.policy_link')) ?></a></p>
+                </div>
+            <?php endif; ?>
+
             <div class="mt-4 pt-3 border-top">
                 <a class="text-decoration-none fw-semibold" data-bs-toggle="collapse" href="#analytics-troubleshoot" role="button" aria-expanded="false" aria-controls="analytics-troubleshoot">
                     <i class="fa-solid fa-wrench me-2"></i>Troubleshooting &amp; setup help
diff --git a/tests/Integration/Analytics/DisconnectRevokeTest.php b/tests/Integration/Analytics/DisconnectRevokeTest.php
new file mode 100644
index 00000000..25b198a3
--- /dev/null
+++ b/tests/Integration/Analytics/DisconnectRevokeTest.php
@@ -0,0 +1,135 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Crypto;
+use Tiger_Google_Analytics;
+use Tiger_Model_Config;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Disconnect REVOKES at Google, then forgets (TIGER-117).
+ *
+ * The old disconnect() only cleared the local token, so the grant stayed live in the user's Google
+ * account — while the published privacy policy said disconnecting revoked it. Google's verification
+ * review requires the policy to match practice. The revoke endpoint is a fixed Google host, so these
+ * tests point the seam at a dead local port: the fail-soft path is the one that can be exercised
+ * without network, and it is the one that matters — Google unreachable must still clear the token.
+ */
+#[CoversClass(Tiger_Google_Analytics::class)]
+final class DisconnectRevokeTest extends IntegrationTestCase
+{
+    private function connect(): void
+    {
+        $key = base64_encode(str_repeat("\x22", 32));
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['crypto' => ['key' => $key]]]));
+        $enc = Tiger_Crypto::encrypt('refresh-token-to-revoke');
+        (new Tiger_Model_Config())->set(Tiger_Model_Config::SCOPE_GLOBAL, '', 'tiger.analytics.oauth.refresh_token_enc', $enc);
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => [
+            'crypto'    => ['key' => $key],
+            'analytics' => ['oauth' => ['mode' => 'broker', 'refresh_token_enc' => $enc]],
+        ]]));
+    }
+
+    private function storedToken(): string
+    {
+        return (string) $this->db->fetchOne("SELECT config_value FROM config WHERE config_key = 'tiger.analytics.oauth.refresh_token_enc'");
+    }
+
+    /** Google unreachable: the local token is STILL cleared, and the caller is told it was not revoked. */
+    #[Test]
+    public function when_google_cannot_be_reached_the_token_is_still_cleared_and_the_outcome_says_so(): void
+    {
+        $this->connect();
+        $this->assertNotSame('', $this->storedToken(), 'precondition: a token is stored');
+
+        $out = RevokeProbe::disconnect();
+
+        $this->assertFalse($out['revoked'], 'Google was unreachable, so revocation cannot be claimed');
+        $this->assertSame('', $this->storedToken(), 'but the local token is gone regardless — disconnect must never be impossible');
+        $this->assertFalse(Tiger_Google_Analytics::isConnected());
+    }
+
+    /** With no token stored there is nothing to revoke, and no request is made. */
+    #[Test]
+    public function no_token_means_no_revoke_call(): void
+    {
+        $key = base64_encode(str_repeat("\x22", 32));
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['crypto' => ['key' => $key], 'analytics' => ['oauth' => ['refresh_token_enc' => '']]]]));
+        $server = $this->startRevokeServer();
+        if ($server === null) { $this->markTestSkipped('could not start a local PHP server'); }
+        [$proc, $url] = $server;
+        try {
+            RevokeProbe::$url = $url;
+            $out = RevokeProbe::disconnect();
+            $this->assertFalse($out['revoked'], 'nothing was revoked because nothing was stored');
+            $this->assertFalse(file_exists($this->revokeLog), 'and no request reached the server');
+        } finally {
+            RevokeProbe::$url = null; proc_terminate($proc); proc_close($proc); @unlink($this->revokeLog);
+        }
+    }
+
+    /**
+     * When Google answers 2xx, the outcome says revoked — proven against a REAL HTTP 200, from a
+     * throwaway local server, through the parent's own _http(). A probe that simply returned
+     * ['revoked' => true] would test the probe.
+     */
+    #[Test]
+    public function a_successful_revoke_is_reported(): void
+    {
+        $server = $this->startRevokeServer();
+        if ($server === null) { $this->markTestSkipped('could not start a local PHP server'); }
+        [$proc, $url] = $server;
+        try {
+            $this->connect();
+            RevokeProbe::$url = $url;
+            $out = RevokeProbe::disconnect();
+
+            $this->assertTrue($out['revoked'], 'Google (our stand-in) answered 200');
+            $this->assertSame('', $this->storedToken(), 'and the local token is cleared');
+            $this->assertStringContainsString('token=refresh-token-to-revoke', (string) @file_get_contents($this->revokeLog),
+                'the server received the refresh token in the POST body');
+        } finally {
+            RevokeProbe::$url = null;
+            proc_terminate($proc); proc_close($proc);
+            @unlink($this->revokeLog);
+        }
+    }
+
+    private string $revokeLog = '';
+
+    /** `php -S` on a free port with a router that logs the body and answers 200. @return array{resource,string}|null */
+    private function startRevokeServer(): ?array
+    {
+        $port = 18000 + random_int(0, 999);
+        $this->revokeLog = sys_get_temp_dir() . '/tiger-revoke-' . getmypid() . '.log';
+        $router = sys_get_temp_dir() . '/tiger-revoke-router-' . getmypid() . '.php';
+        file_put_contents($router, '<?php file_put_contents(' . var_export($this->revokeLog, true) . ', file_get_contents("php://input")); http_response_code(200); echo "{}";');
+        $proc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$port", $router], [1 => ['file', '/dev/null', 'w'], 2 => ['file', '/dev/null', 'w']], $pipes);
+        if (!is_resource($proc)) { return null; }
+        for ($i = 0; $i < 50; $i++) {                       // wait up to ~2.5s for it to listen
+            $fp = @fsockopen('127.0.0.1', $port, $errno, $errstr, 0.05);
+            if ($fp) { fclose($fp); return [$proc, "http://127.0.0.1:$port/revoke"]; }
+            usleep(50000);
+        }
+        proc_terminate($proc); proc_close($proc);
+        return null;
+    }
+}
+
+/** Overrides ONLY the revoke URL — dead port by default, or a live local server when a test sets one. */
+final class RevokeProbe extends Tiger_Google_Analytics
+{
+    public static ?string $url = null;
+
+    protected static function _revokeUrl()
+    {
+        return self::$url ?? 'http://127.0.0.1:1/revoke';
+    }
+}
diff --git a/themes/puma/assets/admin.css b/themes/puma/assets/admin.css
index 4fa632b4..a43d9091 100644
--- a/themes/puma/assets/admin.css
+++ b/themes/puma/assets/admin.css
@@ -447,3 +447,50 @@ body.avatar-drop-active::after {
 .updates-prewrap { white-space: pre-wrap; }
 /* A settled row keeps a fixed-width mark so rows do not jog when the checkbox becomes an icon. */
 #updates-list .update-mark { min-width: 1rem; }
+
+/* ---- Google's "Continue with Google" button (analytics connect; TIGER-118) ---------------------
+ * Per Google's branding guidelines for their sign-in / authorization button: their G mark as the
+ * supplied SVG, neutral surface, 1px #747775 border, 40px tall, 14px/500 text in Roboto with the
+ * fallback stack Google's own generated snippet uses, hover as an 8% state overlay. The mark must
+ * never be redrawn or recoloured, and never taken from an icon font. */
+.gsi-material-button {
+    -webkit-appearance: none; appearance: none;
+    background-color: #fff;
+    background-image: none;
+    border: 1px solid #747775;
+    border-radius: 20px;
+    box-sizing: border-box;
+    color: #1f1f1f;
+    cursor: pointer;
+    font-family: 'Roboto', arial, sans-serif;
+    font-size: 14px;
+    font-weight: 500;
+    letter-spacing: .25px;
+    height: 40px;
+    padding: 0 12px;
+    position: relative;
+    text-align: center;
+    transition: background-color .218s, border-color .218s, box-shadow .218s;
+    vertical-align: middle;
+    white-space: nowrap;
+    max-width: 400px; min-width: min-content;
+}
+.gsi-material-button .gsi-material-button-icon { height: 20px; width: 20px; min-width: 20px; margin-right: 12px; }
+.gsi-material-button .gsi-material-button-icon svg { display: block; height: 20px; width: 20px; }
+.gsi-material-button .gsi-material-button-content-wrapper { align-items: center; display: flex; flex-direction: row; flex-wrap: nowrap; height: 100%; justify-content: space-between; position: relative; width: 100%; }
+.gsi-material-button .gsi-material-button-contents { flex-grow: 1; font-family: 'Roboto', arial, sans-serif; font-weight: 500; overflow: hidden; text-overflow: ellipsis; vertical-align: top; }
+.gsi-material-button .gsi-material-button-state { transition: opacity .218s; bottom: 0; left: 0; opacity: 0; position: absolute; right: 0; top: 0; border-radius: inherit; }
+.gsi-material-button:disabled { cursor: default; background-color: #ffffff61; border-color: #1f1f1f1f; }
+.gsi-material-button:disabled .gsi-material-button-contents { opacity: 38%; }
+.gsi-material-button:disabled .gsi-material-button-icon { opacity: 38%; }
+.gsi-material-button:not(:disabled):active .gsi-material-button-state,
+.gsi-material-button:not(:disabled):focus .gsi-material-button-state { background-color: #303030; opacity: 12%; }
+.gsi-material-button:not(:disabled):hover { box-shadow: 0 1px 2px 0 rgba(60,64,67,.30), 0 1px 3px 1px rgba(60,64,67,.15); }
+.gsi-material-button:not(:disabled):hover .gsi-material-button-state { background-color: #303030; opacity: 8%; }
+/* Dark theme: Google's dark variant — dark surface, light text; the G mark itself is unchanged. */
+[data-bs-theme="dark"] .gsi-material-button { background-color: #131314; border-color: #8e918f; color: #e3e3e3; }
+[data-bs-theme="dark"] .gsi-material-button:not(:disabled):active .gsi-material-button-state,
+[data-bs-theme="dark"] .gsi-material-button:not(:disabled):focus .gsi-material-button-state,
+[data-bs-theme="dark"] .gsi-material-button:not(:disabled):hover .gsi-material-button-state { background-color: #fff; }
+
+.analytics-summary { cursor: pointer; }