Website Privacy

Privacy and consent essentials for a website — privacy policy, cookie consent, Global Privacy Control, third-party script auditing, privacy-respecting analytics, and data minimisation. Use when handling personal data, consent flows, analytics, or third-party scripts.

paulgrape fdaaf7d 1.2 KB Updated

File contents

Website privacy

Consent, signals, and respecting visitor choice. Curated from the Website Specification — Privacy (CC BY 4.0).

Required

  • Publish a privacy policy: what data you collect, why, legal basis, sharing, retention, and user rights.
  • In the EU/UK, obtain freely given, informed, specific, unambiguous opt-in consent before setting non-essential cookies or storage.

Recommended

  • Honour the Global Privacy Control (Sec-GPC) signal — required in California and Colorado.
  • Audit, justify, and lock down every third-party script (each can read cookies and exfiltrate data).
  • Prefer aggregate, cookieless, EU-hosted analytics.
  • Data minimisation: collect only what you need, keep it only as long as you need it.

Optional

  • Storage Access API for embedded cross-site content under a user gesture.

Full item list and rationale: https://specification.website/checklist/

paulgrape/skill-auditor/tree/main/templates/website-privacy commit fdaaf7d6b4

Frequently asked questions

npx skillmds@latest add paulgrape/website-privacy