1a - Privacy audit and technical discovery report

Milestone 1a - Privacy audit and technical discovery report (Task 1, Sprint 1–2)

Working doc: https://docs.google.com/document/d/1YMVN-9ZnrlbtYR7T51yOqX_Ow3NzXAr3T0BsvhU7CuM/edit?tab=t.8bstvabskqys

Tracking issue - closes when the published doc is finalised and linked (no PR).

Acceptance criteria

Published audit document enumerating every cookie set, every outbound third-party call and every tracking surface in a default install, with a code-level verification of what the 7.2 consent workstream already covers.

Checklist

• Every tracking surface enumerated (15 surfaces + taxonomy)
• Every cookie in a default install (12 cookies, code-verified with file:line)
• Every outbound third-party call (5 default + off-by-default + composer.lock)
• Code-level check of what the 7.2 consent workstream covers (PR #15844 - DNT/GPC and PR #16870 - unsubscribe validation)
• Runtime confirmation of 3 flagged items (session cookie on anon hit; client-side mtc.js writes under DNT/GPC; video DNT path)
• Final formatting pass in the published doc