Self hosted content with no images or video served from 3rd party sources
No CDN like CloudFlare (why?)
No social media sharing (why?)
Only using self hosted fonts
Only using web hosts that are GPDR ready and PCI-DSS compliant. Not even considering web hosts that inject code into web pages for monitoring like GoDaddy a while back.
Refusing to use page builders like Wix, Squarespace or others that inject tracking code
Must use SSL and preferably with HSTS preload enabled.
Mail sent over contact forms should not be routed to third party services like Office 365. This would be tricky, because a lot of end users (website owners) may want that.
A declaration that the website is checked regularly for any virus etc and updated regularly to in light of current security practices and technologies.
Assuming the TukuToi Zero Tracking Policy becomes widely recognised, how would one grant that the badge is not misused, in the sense that it is added to a site which in fact does any of the (by the policy) discouraged things?
Ideas in regard:
a signed agreement
some sort of magic code with JS or else that checks on major trackers, analysts and else codes in the site regularly, for example making the badge red on the fly if any issue encountered
do something with a blockchain? For example the badge needs to be purchased for a small fee (very small) but what the key point here is that the blockchain would show an public record and kind of act like a signed contract, guaranteeing the webmasters agreements to the policy