Launch audit — GDPR verification checklist

Run this before handing a site over. Every check must pass.

1. No third-party requests

For every published page (HTML body + additional_html_head_html + global html_head):

• No external hosts in script/link/img/iframe src or href: youtube.com, youtube-nocookie.com, vimeo.com, google.com/maps, facebook.com, doubleclick.net, hotjar.com, cdnjs.cloudflare.com, jsdelivr.net, unpkg.com, and no googleapis.com/gstatic.com references except fonts.googleapis.com / fonts.gstatic.com (auto-proxied)
• No preconnect or dns-prefetch to third-party domains in the head
• All assets use relative URLs (platform-served) or the site's own domain
• Google Fonts references are auto-proxied by the platform (no action needed); no other third-party CDN hosts present

2. No tracking

• No analytics/tracking scripts (GA, GTM, Meta Pixel, Hotjar, Plausible script, etc.)
• No cookie-setting widgets (chat, share buttons, newsletter popups)
• No cookie banner — the site is banner-free by design

3. Embeds (if any)

• Thumbnails are self-hosted assets, not hotlinked provider images
• No iframe with a real src to a provider in the HTML — only data-src
• Activation button label names the provider and the data transfer
• Post-click iframe uses youtube-nocookie.com (defense in depth)
• Network test: open the page in a fresh browser, DevTools Network tab — zero requests to the provider before clicking the activation button

4. Forms

• notification_email set and verified (owner clicked the verification link)
• Only necessary fields (no phone number on a simple contact form)
• Purpose statement + privacy policy link near the submit button
• Marketing consent is a separate, unchecked checkbox
• Privacy policy lists each form with purpose, legal basis, retention

5. Legal pages

• Privacy policy exists, in the site's language, with real controller identity
• Privacy policy lists every processing activity actually present (hosting, analytics, forms, embeds)
• Impressum exists for DE/AT commercial sites, with real data
• Both linked from the footer on every page
• No placeholder text, no invented company data

6. Platform defaults

• HTTPS (platform default — no mixed content)
• Site indexable flag matches the owner's intent