# Website Privacy

> Privacy and consent essentials for a website — privacy policy, cookie consent, Global Privacy Control, third-party script auditing, privacy-respecting analytics, and data minimisation. Use when handling personal data, consent flows, analytics, or third-party scripts.

- Skill: `paulgrape/website-privacy` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulgrape/website-privacy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulgrape/website-privacy/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: paulgrape (https://skillmd.com/u/paulgrape)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulgrape/website-privacy

---


# Website privacy

Consent, signals, and respecting visitor choice. Curated from the
[Website Specification — Privacy](https://specification.website/checklist/) (CC BY 4.0).

## Required

- Publish a privacy policy: what data you collect, why, legal basis, sharing, retention, and user rights.
- In the EU/UK, obtain freely given, informed, specific, unambiguous opt-in consent before setting non-essential cookies or storage.

## Recommended

- Honour the Global Privacy Control (`Sec-GPC`) signal — required in California and Colorado.
- Audit, justify, and lock down every third-party script (each can read cookies and exfiltrate data).
- Prefer aggregate, cookieless, EU-hosted analytics.
- Data minimisation: collect only what you need, keep it only as long as you need it.

## Optional

- Storage Access API for embedded cross-site content under a user gesture.

Full item list and rationale: https://specification.website/checklist/