# The Website Specification — checklist (7 items)

## Privacy
- [ ] **Privacy policy** _(required)_ — A privacy policy tells visitors what personal data you collect, why, on what legal basis, who you share it with, how long you keep it, and what rights they have.
      https://specification.website/spec/privacy/privacy-policy/
- [ ] **Cookie consent** _(required)_ — In the EU and UK, non-essential cookies and similar storage require freely given, informed, specific, and unambiguous opt-in consent before they are set.
      https://specification.website/spec/privacy/cookie-consent/
- [ ] **Global Privacy Control (GPC)** _(recommended)_ — Global Privacy Control is a browser-level signal that tells websites the user opts out of the sale or sharing of their personal data. California and Colorado require sites to honour it.
      https://specification.website/spec/privacy/global-privacy-control/
- [ ] **Third-party scripts and privacy** _(recommended)_ — Every script loaded from another domain can read cookies, see the URL, and exfiltrate data from your page. Audit them, justify them, and lock them down.
      https://specification.website/spec/privacy/third-party-scripts/
- [ ] **Storage Access API** _(optional)_ — As browsers partition and block third-party cookies, embedded cross-site content uses the Storage Access API to request its own cookies behind a user gesture — instead of asking visitors to switch off tracking protection.
      https://specification.website/spec/privacy/storage-access-api/
- [ ] **Privacy-respecting analytics** _(recommended)_ — You can measure traffic without surveilling visitors. Aggregate, cookieless, EU-hosted analytics tools answer most product questions without the consent and transfer problems of ad-tech analytics.
      https://specification.website/spec/privacy/analytics-privacy/
- [ ] **Data minimisation** _(recommended)_ — Collect only the personal data you actually need for a specific purpose, keep it only as long as you need it, and redact it from anywhere it leaks unnecessarily.
      https://specification.website/spec/privacy/data-minimization/