# Launch audit — GDPR verification checklist

Run this before handing a site over. Every check must pass.

## 1. No third-party requests

For every published page (HTML body + additional_html_head_html + global html_head):

- [ ] No external hosts in script/link/img/iframe src or href: youtube.com, youtube-nocookie.com, vimeo.com, google.com/maps, facebook.com, doubleclick.net, hotjar.com, cdnjs.cloudflare.com, jsdelivr.net, unpkg.com, and no googleapis.com/gstatic.com references except fonts.googleapis.com / fonts.gstatic.com (auto-proxied)
- [ ] No preconnect or dns-prefetch to third-party domains in the head
- [ ] All assets use relative URLs (platform-served) or the site's own domain
- [ ] Google Fonts references are auto-proxied by the platform (no action needed); no other third-party CDN hosts present

## 2. No tracking

- [ ] No analytics/tracking scripts (GA, GTM, Meta Pixel, Hotjar, Plausible script, etc.)
- [ ] No cookie-setting widgets (chat, share buttons, newsletter popups)
- [ ] No cookie banner — the site is banner-free by design

## 3. Embeds (if any)

- [ ] Thumbnails are self-hosted assets, not hotlinked provider images
- [ ] No iframe with a real src to a provider in the HTML — only data-src
- [ ] Activation button label names the provider and the data transfer
- [ ] Post-click iframe uses youtube-nocookie.com (defense in depth)
- [ ] Network test: open the page in a fresh browser, DevTools Network tab — zero requests to the provider before clicking the activation button

## 4. Forms

- [ ] notification_email set and verified (owner clicked the verification link)
- [ ] Only necessary fields (no phone number on a simple contact form)
- [ ] Purpose statement + privacy policy link near the submit button
- [ ] Marketing consent is a separate, unchecked checkbox
- [ ] Privacy policy lists each form with purpose, legal basis, retention

## 5. Legal pages

- [ ] Privacy policy exists, in the site's language, with real controller identity
- [ ] Privacy policy lists every processing activity actually present (hosting, analytics, forms, embeds)
- [ ] Impressum exists for DE/AT commercial sites, with real data
- [ ] Both linked from the footer on every page
- [ ] No placeholder text, no invented company data

## 6. Platform defaults

- [ ] HTTPS (platform default — no mixed content)
- [ ] Site indexable flag matches the owner's intent