Website privacy
Consent, signals, and respecting visitor choice. Curated from the Website Specification — Privacy (CC BY 4.0).
Required
- Publish a privacy policy: what data you collect, why, legal basis, sharing, retention, and user rights.
- In the EU/UK, obtain freely given, informed, specific, unambiguous opt-in consent before setting non-essential cookies or storage.
Recommended
- Honour the Global Privacy Control (
Sec-GPC) signal — required in California and Colorado. - Audit, justify, and lock down every third-party script (each can read cookies and exfiltrate data).
- Prefer aggregate, cookieless, EU-hosted analytics.
- Data minimisation: collect only what you need, keep it only as long as you need it.
Optional
- Storage Access API for embedded cross-site content under a user gesture.
Full item list and rationale: https://specification.website/checklist/