Privacy
Consent, signals, and respecting visitor choice.
7 topics in this category.
About this category
This section collects production-verified specifications, implementation standards, and operational guidelines for privacy. Each specification provides clear compliance levels (Required, Recommended, Optional, or Avoid) alongside concrete testing methods and platform considerations.
Topics
Privacy policy
RequiredA privacy policy tells visitors what personal data you collect, why, on what legal basis, who you share it with, how long you keep it, and what rights they have.
Cookie consent
RequiredIn the EU and UK, non-essential cookies and similar storage require freely given, informed, specific, and unambiguous opt-in consent before they are set.
Global Privacy Control (GPC)
RecommendedGlobal Privacy Control is a browser-level signal that tells websites the user opts out of the sale or sharing of their personal data. California and Colorado require sites to honour it.
Third-party scripts and privacy
RecommendedEvery script loaded from another domain can read cookies, see the URL, and exfiltrate data from your page. Audit them, justify them, and lock them down.
Storage Access API
OptionalAs browsers partition and block third-party cookies, embedded cross-site content uses the Storage Access API to request its own cookies behind a user gesture - instead of asking visitors to switch off tracking protection.
Privacy-respecting analytics
RecommendedYou can measure traffic without surveilling visitors. Aggregate, cookieless, EU-hosted analytics tools answer most product questions without the consent and transfer problems of ad-tech analytics.
Data minimisation
RecommendedCollect only the personal data you actually need for a specific purpose, keep it only as long as you need it, and redact it from anywhere it leaks unnecessarily.