Cookie categories, consent wording, vendor list, retention periods, and regional rules must be reviewed before launch.

Only strictly necessary cookies or local storage items should be enabled by default. Analytics and advertising must remain off unless the user gives consent.

Withdrawing consent should be as easy as giving consent.

Analytics events may track non-sensitive milestones such as page view, pathway selected, form started, form step completed, consent submitted, or mock reference created.

Analytics events must not include disease names, diagnoses, symptoms, treatment history, file names, uploaded document details, free-text form content, passport data, or medical identifiers.

Advertising cookies, pixels, remarketing tags, and audience matching should be disabled by default and enabled only after consent where legally allowed.

Advertising tools must not receive medical condition data, form free text, uploaded file names, or sensitive health categories.