Agent WranglersPrivacy
Collect nothing you do not need. Write a full privacy policy, skip needless cookies and third parties, honour Global Privacy Control and delete data on time.
- Required 5
- Recommended 6
- Optional 1
Required
Explain what you keep and why
RequiredPublish a full privacy policy, linked from every page. It says who you are, what you collect and why, the legal basis, retention, recipients, rights and complaints.
Store nothing extra without a yes
RequiredAsk before storing anything non-essential. Make saying no as easy as saying yes, and store nothing until people agree.
Keep personal data out of addresses
RequiredNever put names, email addresses or other personal data in URLs. Send them in the body of a POST request instead. Only single-use links from an email may carry a random token.
Sign a contract with every processor
RequiredHave a data processing agreement with every service that handles personal data for you, such as hosting, email or analytics.
Let people see and delete their data
RequiredGive people a working way to get a copy of their data, correct it and have it deleted, and answer within one month.
Recommended
Treat the privacy signal as a no
RecommendedTreat a
Sec-GPC: 1signal as an opt-out of selling or sharing data, and say so in the privacy policy.Host everything yourself
RecommendedAvoid third-party scripts. Host what you need yourself, so visitors' data does not go to other companies.
Count visits without tracking people
RecommendedMeasure without tracking people. Use no analytics, or analytics without cookies or personal data.
Keep only what you need and delete it on time
RecommendedCollect only the data a task needs. Keep it only as long as needed, and delete it on schedule and on request.
Store each preference where it is needed
RecommendedKeep a visitor's preferences in local storage when only the browser needs them. Use a cookie only when the server must know the preference before it answers.
Plan for a data breach
RecommendedWrite down what to do when personal data leaks, before it happens.
Optional
Ask before embedded content uses cookies
OptionalIf embedded content needs its own cookies, ask for them with the Storage Access API. Don't rely on third-party cookies.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy.