Insights · Checklist
Privacy and consent checklist for practice websites
Practice websites handle sensitive inquiries and are under specific regulatory attention for tracking technology. This checklist removes what cannot be justified, implements consent and measurement that respect the law, and documents the data flows for the privacy program. Counsel confirms the legal determinations.
How to use it
Before the first step.
- Run with the privacy or compliance lead and counsel.
- Applies to the website, forms, chat, call tracking and any embedded tools.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Complete the third-party tag inventory; remove tags that send visitor behavior to advertising platforms without a lawful basis. | Technical owner with privacy lead | Inventory and removal record |
| 02 | Determine which privacy laws and sector rules apply to visitors and inquirers, with counsel. | Privacy lead with counsel | Applicability memo |
| 03 | Implement cookieless analytics; confirm no non-essential cookies are set before consent. | Technical owner | Cookie scan before and after |
| 04 | Decide whether a consent banner is required; if so, implement it minimally and honestly with real choices. | Privacy lead with counsel | Banner decision and configuration |
| 05 | Review every form: collect only what intake needs, state the purpose, obtain consent where required. | Privacy lead | Form review record |
| 06 | Route form submissions over encrypted channels to systems with access control; no inquiries in unprotected inboxes. | Technical owner | Routing diagram |
| 07 | Review chat, scheduling and call-tracking vendors for data handling and agreements; disable recording unless lawful and consented. | Privacy lead | Vendor review table |
| 08 | Set retention for inquiry data and implement deletion. | Privacy lead | Retention schedule and deletion record |
| 09 | Publish an accurate privacy notice describing what is actually collected and why. | Privacy lead with counsel | Notice URL and review date |
| 10 | Document the data flows for the privacy records and for any required assessment. | Privacy lead | Data flow documentation |
| 11 | Test the site as a new visitor: no unexpected requests, no data sent before consent, notice reachable. | Tester | Test capture |
| 12 | Schedule re-testing after any site, tag or vendor change. | Privacy lead | Schedule and trigger list |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days