Intake questions

Answer these ten questions when you start a project. It takes about five minutes.

The "Always" rules apply to every project, whatever you answer. Each "yes" below adds a few more things to do. They're listed under each question in plain words. On the website, point at a rule number to see the full rule.

If you're not sure of an answer, say yes for now. It's easier to drop something later than to add it after launch.

Do you collect or store personal data?

Personal data is anything that can identify a person, like a name, email address, phone number or IP address. A simple contact form counts.

If yes:

• Let people see, download and delete their data (rule 14Rule 14. Only if you hold personal data: let people see their data, download it and delete it.).
• Use the higher security level (rule 22Rule 22. Always. Meet level 1 of OWASP's security checklist for apps (ASVS). Only if you hold personal, health or payment data: meet level 2. Only if it's a mobile app: also meet OWASP's mobile checklist (MASVS).).
• Scramble stored passwords and encrypt sensitive data (rule 26Rule 26. Always. Encrypt all traffic with TLS 1.2 or newer, the padlock in the browser. Only if you store passwords or sensitive data: scramble passwords with Argon2 or bcrypt, and encrypt the data you store.).
• Publish a privacy notice that explains what you collect and why (rule 45Rule 45. Always. Publish an accessibility statement. Only if you hold personal data: publish a privacy notice. Only if you use cookies: publish a cookie policy. Only if you have accounts or payments: publish terms that explain clearly how to cancel.).
• Have a plan for data leaks, including who you tell and how fast (rule 50Rule 50. Always. Have a plan for security incidents. Only if you hold personal data: also have a plan for data breaches, including reporting them within 72 hours where the law requires it.).
• Answer people's requests about their data within a month (rule 51Rule 51. Only if you hold personal data: answer people's requests about their data within a month. Only if users can post content: remove reported intimate images within 48 hours.).
• If it's health, fingerprint, face or payment data, do a written privacy risk check before you build (rule 3Rule 3. Only if you handle personal data, especially health, biometric or payment data: write down the privacy risks and how you'll reduce them before you build. This is called a privacy risk assessment (DPIA).).

Do you have visitors from the EU or UK?

If yes, and you use optional cookies, analytics or tracking tags:

• Don't load anything optional until the visitor says yes (rule 15Rule 15. Only if you have visitors from the EU or UK and use optional cookies or tracking tags: don't load anything optional until the visitor says yes.).
• Put "Reject all" right next to "Accept all", the same size and style (rule 16Rule 16. Only if you show a cookie banner: put "Reject all" and "Accept all" side by side on the first screen, looking exactly the same.).
• Add a cookie settings link to your footer, and remember each choice for six months (rule 19Rule 19. Only if you use optional cookies: put a cookie settings link in every footer, and remember each visitor's choice for six months.).
• Check your cookies every three months, and each time you add a plugin or tag (rule 20Rule 20. Only if you use optional cookies or tags: check every cookie your site sets every three months, and again whenever you add a plugin or tag.).

Do you have visitors from the US?

If yes:

• If you sell or share visitors' data or run targeted ads, respect the browser's "don't sell my data" signal and add a "Do Not Sell or Share" link (rule 17Rule 17. Only if you have visitors from the US and you sell or share their data or run targeted ads: respect Global Privacy Control, a browser setting that says "don't sell my data", and show a "Do Not Sell or Share" link.).
• If you track visitors, don't record their screens or chats without asking first, and don't put ad tracking on sensitive pages like health, money or account pages (rule 18Rule 18. Only if you have visitors from the US and use tracking: ad and analytics pixels follow rule 17. But never record visitors' screens (session replay) or chats without telling them and asking first, and never put ad pixels on sensitive pages, like health, money, children's or account pages.).

Could children use it?

If yes:

• Don't use endless feeds for anyone under 18 (rule 8Rule 8. Only if your product has a feed: give it natural stopping points, like "You're all caught up". Never use endless scrolling for anyone under 18.).
• Use the safest settings by default: no profiling, location off, parental consent where the law needs it, and nothing designed to be addictive (rule 43Rule 43. Only if children might use it: use the safest settings by default. No profiling, location off, parental consent where the law needs it, and no addictive features.).

Does it use AI?

If yes, follow the points that fit your product:

• Label replies written by AI (rule 36aRule 36a. Only if users chat with AI or read replies it writes: show a small "AI" label, unless that's already obvious, for example on a "Generate with AI" button.).
• If the AI has a human name, face or voice, say clearly that it's AI (rule 36bRule 36b. Only if your AI has a human form, like a face, a human name or a voice: say clearly at the start that it's AI, never let it claim to have feelings, and remind users during long chats.).
• Label images, audio and video made by AI (rule 37Rule 37. Only if your AI makes images, audio or video: label them with C2PA Content Credentials, a tag inside the file that shows AI made it.).
• Treat everything the AI reads or writes as untrusted, and guard against known AI attacks (rule 38Rule 38. Only if you use AI: treat everything that goes into the AI as untrusted, and guard against the risks in OWASP's Top 10 for AI apps (the LLM Top 10).).
• Give the AI as little power as possible. A person approves anything that spends money, sends messages or deletes things (rule 39Rule 39. Only if your AI can take actions: give it as little power as possible, and have a person approve anything that spends money, sends messages or deletes things.).
• A person checks AI decisions about money, health, jobs or legal matters (rule 40Rule 40. Only if your AI's answers affect money, health, jobs or legal matters: have a person check them.).
• Don't track people's moods or use emotional pressure to keep them using it (rule 41Rule 41. Only if you use AI: don't track people's moods, and don't use emotional pressure to keep them using it.).
• Try hard to make it misbehave before launch, so you find the problems first (rule 42Rule 42. Only if you use AI: try hard to make it misbehave before launch and after any big change. This is called red-teaming.).

Does it take payments or subscriptions?

If yes:

• Never store card numbers yourself. Use a payment provider like Stripe or PayPal (rule 31Rule 31. Only if you take payments: never store card details yourself. Use a payment provider.).
• Write terms that make cancelling clear and easy (rule 45Rule 45. Always. Publish an accessibility statement. Only if you hold personal data: publish a privacy notice. Only if you use cookies: publish a cookie policy. Only if you have accounts or payments: publish terms that explain clearly how to cancel.).

Can users post content, images or messages?

If yes:

• If you rank or recommend posts, reward helpful ones, not outrage (rule 11Rule 11. Only if your product ranks or recommends posts: reward the helpful ones, not the ones that make people angry.).
• Remove reported intimate images within 48 hours (rule 51Rule 51. Only if you hold personal data: answer people's requests about their data within a month. Only if users can post content: remove reported intimate images within 48 hours.).

Do you use optional cookies, pixels or tracking?

If yes:

• Follow the cookie points under the EU, UK and US questions above for the places your visitors come from.
• Check your cookies before every release (rule 33Rule 33. Always. Before every release, run a security scan on the live site (DAST), an accessibility check and a dark pattern review. Only if users log in: also test that each type of user can only reach what they should. Only if you use tracking: also check your cookies.).
• Publish a cookie policy (rule 45Rule 45. Always. Publish an accessibility statement. Only if you hold personal data: publish a privacy notice. Only if you use cookies: publish a cookie policy. Only if you have accounts or payments: publish terms that explain clearly how to cancel.).

Is it a mobile app or software people install?

If yes:

• Mobile apps also meet the mobile security standard (rule 22Rule 22. Always. Meet level 1 of OWASP's security checklist for apps (ASVS). Only if you hold personal, health or payment data: meet level 2. Only if it's a mobile app: also meet OWASP's mobile checklist (MASVS).).
• Tell people how long you'll keep sending security updates (rule 47Rule 47. Only if it's an app or software people install, not just a website: say how long you'll keep releasing security updates.).

Do users log in?

If yes:

• Set privacy options to the most private choice by default (rule 13Rule 13. Only if users have accounts: set every privacy option to the most private choice by default.).
• Check on the server that each person is allowed to do what they ask, every time (rule 23Rule 23. Only if users log in: check on the server, every time, that the person is allowed to do what they're asking. When in doubt, the answer is no.).
• Test that each type of user can only reach what they should (rule 33Rule 33. Always. Before every release, run a security scan on the live site (DAST), an accessibility check and a dark pattern review. Only if users log in: also test that each type of user can only reach what they should. Only if you use tracking: also check your cookies.).
• Write terms that make closing an account clear and easy (rule 45Rule 45. Always. Publish an accessibility statement. Only if you hold personal data: publish a privacy notice. Only if you use cookies: publish a cookie policy. Only if you have accounts or payments: publish terms that explain clearly how to cancel.).

Also check for these

Some rules depend on features rather than the questions above. If your product has any of these, add them too:

• Notifications: keep them off by default, except essential ones (rule 6Rule 6. Only if your product sends notifications: keep them off by default, except essential ones like security alerts or booking reminders. Never use red badges to push marketing.).
• Video or audio: no autoplay (rule 7Rule 7. Only if your product plays video or audio: don't play it automatically unless the user turns that on.).
• A feed: add natural stopping points (rule 8Rule 8. Only if your product has a feed: give it natural stopping points, like "You're all caught up". Never use endless scrolling for anyone under 18.).
• A big launch, or a product that's been live a year: get a security test by an expert (rule 34Rule 34. Only if it's a big launch, or the product has been live for a year: get a penetration test, where an expert tries to break in. Also review your threat model and practise restoring from a backup.).
• Points, badges or rewards: make them earned and predictable (rule 57Rule 57. Only if your product has rewards, points or badges: make rewards earned and predictable. No random rewards designed to keep people hooked.).
• Invites: people choose who to invite, one by one (rule 58Rule 58. Only if users can invite others: let them choose each person. Never send automatic invites from uploaded contact lists, and limit how many invites can be sent.).
• Something people use every day: give them quiet hours, limits and snooze (rule 59Rule 59. Only if people use your product regularly: give them controls like quiet hours, a daily limit, snooze and optional usage summaries.).
• Numbers or reviews on screen: only real ones, no fake urgency (rule 60Rule 60. Only if you show numbers or reviews: show only real, current figures and genuine reviews. No fake urgency like "Only 2 left!" unless it's true.).

What to do with your answers

Write them down in the project template, with the list of rules that apply.

Answer the questions again whenever the product gets a big new feature, such as accounts, payments or AI.