Website privacy and consent review

Eighteen checks on what a site actually does with a visitor's data, as distinct from what its policy page says. None of them is a legal opinion, and this list cannot tell you whether a site complies with anything: what it can do is replace an assumption with a reading. The order matters. Everything a page does before the visitor answers the banner is the first group, because a consent mechanism that runs after the tags is decoration. The second group is data leaving the page, which happens through channels that survive a CORS error and through a header nobody thinks of as a payload. The third group is what happens when a visitor asks for something: a signal, a copy of their data, or its deletion. Every check here was run against a local fixture, and each page says what the browser contributed to the result, since a jar read reports the browser's defences as readily as the site's behaviour.