Privacy & cookie consent checklist

Privacy law varies significantly by country, state and audience—this checklist is not a substitute for legal advice, and it can't tell you which specific regulations apply to your business. What it can do is walk through the practical, engineering-level groundwork almost every site needs regardless of exactly which law applies: knowing what data you actually collect, being honest about it, and giving visitors real choices.

Know what you actually collect

• There's an accurate, current inventory of every place the site collects personal data—forms, analytics, cookies, chat widgets, embedded third-party content
• Each data collection point has a genuine, understood purpose—data isn't collected just because a tool made it easy to turn on
• Third-party scripts and embeds are reviewed for what data they collect on your behalf, since a visitor doesn't distinguish between your code and an embedded widget's
• Data retention is considered explicitly—how long is information actually kept, and is that period justified

Cookie & tracking consent

• A consent mechanism is in place before non-essential cookies or trackers load, if required for your audience's jurisdiction—not fired automatically on page load with consent as an afterthought
• Strictly necessary cookies (the ones the site genuinely can't function without) are distinguished from analytics, marketing and other optional trackers
• Visitors have a genuine, equally easy way to decline optional tracking as to accept it—a consent flow that makes "reject" meaningfully harder to find than "accept" undermines the point of asking at all
• A visitor's choice is actually respected—declining doesn't just hide the banner while trackers keep firing in the background
• Consent choices can be reviewed or changed later, not just set once and forgotten

Privacy policy accuracy

• The privacy policy describes what the site actually does, not a generic template that doesn't match reality
• Every category of data collected, and why, is covered—including data collected by analytics and third-party embeds, not just first-party forms
• Contact information for privacy questions or data requests is accurate and actually monitored
• The policy is reviewed and updated whenever a new tool, tracker or data-collection point is added to the site—not just once at launch

Data minimization & handling

• Forms only ask for information genuinely needed for the stated purpose—collecting "just in case" data is a liability, not an asset
• Personal data submitted through forms is transmitted and stored securely, not emailed in plain text to a personal inbox as the only copy
• Access to any stored personal data is limited to people who genuinely need it
• There's a clear, working process for someone to request their data be deleted or corrected, if that applies to your audience

Third-party & vendor awareness

• Every analytics, advertising, chat, form, or embed vendor used on the site is known, not just installed and forgotten
• Vendor privacy practices are at least glanced at before adopting a new tool, rather than assumed to be fine because everyone uses it
• Vendors that are no longer actually used are removed, along with whatever data-collection footprint they left behind

Pair this with analytics & tracking setup for the practical side of privacy-respecting measurement, and the security checklist for keeping any data you do collect actually safe.