Web Development

Launch checklist: privacy, cookies, analytics, forms, backups

9 min readBy Jaskirat Singh Talwar

A hand ticking boxes on a clipboard checklist beside a laptop

Before a new website goes live, check five things that are easy to miss and costly to fix later: a privacy policy that describes what the site really collects, cookie consent that matches where your visitors are, analytics that still report something useful when people decline cookies, forms that deliver every enquiry, and backups you have actually restored once. Design polish can wait for the first round of feedback; these cannot, because they affect your legal position, your data and your leads from the first day.

Key takeaways

  • Write the privacy policy from an inventory of what the site collects (forms, analytics, chat, embedded video, ads tags), not from a template.
  • Cookie rules differ by region: in the UK and EU, non-essential cookies generally need consent before they are set; Canada's privacy regulator stresses clear purposes and express consent for sensitive or unexpected uses; India's DPDP Rules are being phased in until 2027.
  • Plan analytics for consent: decide what you will report when a visitor says no, and set up key events before launch.
  • Test every form end to end, from a phone, and make sure notification emails pass SPF or DKIM checks.
  • Keep backups following the 3-2-1 rule and do one test restore before launch. Automate HTTPS renewal: maximum certificate lifetimes fell to 200 days in March 2026 and keep falling.

This checklist is general information, not legal advice. Privacy and consent rules depend on where you and your visitors are; ask a lawyer about your own situation.

What should the privacy policy cover?

It should describe what your site actually does. Start with an inventory before anyone writes a word:

Source of personal data What to record
Contact, quote and newsletter forms Fields collected, where submissions are stored, who receives them, how long you keep them
Analytics and tag manager Which tools, which cookies, whether IP addresses or identifiers are sent, where the provider stores data
Advertising tags Which platforms receive data and for what purpose
Embedded services Video players, maps, chat widgets, booking tools, reviews widgets
Hosting, email and CRM Which providers process the data and in which countries

Then write the policy around what readers need to know. Canada's Office of the Privacy Commissioner, in its guidelines for obtaining meaningful consent, says to emphasise four things: what personal information is collected, which parties it is shared with, the purposes in plain language (it says vague phrases such as "service improvement" fall short), and any meaningful risk of harm. In the EU, Article 13 of the GDPR lists the information to give when you collect data from a person, including your identity and contact details, purposes, legal basis, recipients, retention and the person's rights.

If your site has AI features such as a chatbot, read our guide to privacy for AI features in Canada and India, which covers what to add to the policy.

Do you need a cookie banner?

It depends on who visits and which cookies you set. Three examples:

  • UK. The ICO published its final guidance on storage and access technologies on 29 April 2026. The core rule is unchanged: you need consent to store or read information on a visitor's device unless an exception applies. The guidance lists five exceptions, including strictly necessary storage and a narrow "statistical purposes" exception for collecting aggregate statistics about how your own service is used, with conditions such as clear information and a free, simple way to object. Online advertising has no exception. Consent cannot be pre-ticked and must be as easy to withdraw as to give.
  • EU. Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a device unless it is strictly necessary for a service the user asked for; each country's regulator publishes its own guidance, so check the countries you target.
  • Canada and India. Here the general privacy-law consent rules apply to the personal information that tracking collects. In Canada, the meaningful-consent guidelines above set the standard. In India, the Digital Personal Data Protection Rules, 2025 were notified in November 2025 with an 18-month phased compliance period, so most obligations, including consent notices, apply from around May 2027; plan for them now if you serve Indian users.

On our own site, as of October 2026, the consent banner is shown to visitors in the EEA, the UK and Switzerland, with Google's advanced Consent Mode, and our privacy policy describes this. That is one reasonable setup for a business with a global audience; yours depends on your audience and your lawyer's view.

How do you set up analytics so it still works with consent?

Decide what you will report before launch, because analytics cannot be fixed retroactively. A short list:

  1. Install through a tag manager, with consent settings wired in, so tags fire only when they are allowed to.
  2. Define key events for the actions that matter (enquiry sent, quote requested, call clicked) and test each one in a debug view. Our GA4 event plan for lead-generation websites lists events and the checks that catch broken tracking.
  3. Set expectations about gaps. When visitors decline, some measurement becomes modelled or disappears. Our guide to analytics when visitors decline cookies explains what to report instead.
  4. Verify Search Console and submit your XML sitemap. Google says it ignores the priority and changefreq values in a sitemap and uses lastmod only when it is accurate, so keep sitemaps simple and honest.

For the wider SEO launch list, see SEO for a new website in 2026; if you are replacing an existing site rather than launching a new one, redirects and audits matter more, and our relaunch SEO checklist covers them.

How do you make sure forms deliver every lead?

Test them like a customer would, then make them fail-safe:

  • Submit every form from a phone and a desktop, including the confirmation message and the thank-you page.
  • Check the notification email arrives, in the inbox and not in spam. Google's email sender guidelines require all senders to Gmail to authenticate with SPF or DKIM, and senders of more than 5,000 messages a day to use SPF, DKIM and DMARC. Send form notifications from an authenticated service, not from the web server's default mail.
  • Store a copy of every submission in the CMS, a CRM or a database, so a mail outage does not lose a lead.
  • Add spam protection that does not punish real users, and check that it does not block legitimate submissions from other countries.
  • Name a person who answers. A form that nobody monitors is worse than no form.
  • Check the consent wording on newsletter sign-ups matches what you will send.

What does a backup plan need before launch?

A backup you have never restored is a hope, not a plan. The US-CERT "Data Backup Options" paper recommends the 3-2-1 rule: keep three copies of important files (one primary and two backups), on two different types of storage, with one copy offsite. For a website that means:

  1. Back up files and the database together, on a schedule that matches how often content changes (daily for active sites).
  2. Keep at least one copy away from the host, in a separate account or provider, so one compromised account cannot delete everything.
  3. Do a test restore to a staging environment before launch and write down the steps and how long it took.
  4. Keep the source code in version control, so the site can be rebuilt even if a backup fails.

What technical checks belong on launch day?

Check Why
HTTPS on every URL, with automatic certificate renewal Maximum public certificate lifetimes fell from 398 to 200 days on 15 March 2026 and are scheduled to fall to 47 days by March 2029; manual renewal will not keep up
Remove "noindex" and staging passwords A staging setting left on can hide the whole site from search
Redirect www and non-www, http and https to one version One canonical address for every page
404 page and a working search (if any) Lost visitors need a way back
Mobile check on a real phone Menus, forms, tap targets, cookie banner
Accessibility basics Alt text, headings, colour contrast and keyboard use; WCAG 2.2 is the current W3C Recommendation
Uptime monitoring and alerts You hear about outages before customers do

What can wait until after launch?

Most visual polish. The original version of this post warned against perfectionism, and that advice still holds: launch when the essentials above are done, gather feedback from real users, and improve in small rounds. Have content planned for the first few weeks, but make it useful rather than frequent. Our website solutions team can run these checks with you before go-live.

FAQ

Do I need a privacy policy if my site only has a contact form?

Usually yes. A contact form collects personal information such as names and email addresses, and privacy laws in many countries expect you to explain what you collect and why. This is general information, not legal advice.

Do I need a cookie banner if I only use analytics?

In the UK and EU, analytics cookies have generally needed consent. The UK's 2026 guidance describes a narrow statistical-purposes exception with conditions, so check whether your setup qualifies. Outside Europe the rules differ; ask a lawyer about your audience.

Can I copy a privacy policy template?

A template is a starting point only. The policy must describe the tools and data flows your site actually has, which is why the inventory comes first.

How often should a new site be backed up?

Match the schedule to how often content changes: daily for sites with regular updates or enquiries stored on the site, and before every update or deployment. Keep one copy offsite and test a restore.

What is the most common launch mistake?

Leaving a staging setting in place, such as a "noindex" tag or a password, or a form whose notifications go to an unmonitored inbox. Both are quick to check on launch day.

Sources (13 links)
Share this article