Solid practical advice—too many people assume "private by default" without verifying leaks. Your checklist reminds me of how age verification laws (often poorly implemented) add new attack surfaces for surveillance. Recent piece on that:
https://theboard.world/articles/age-verification-mandates-privacy-risks-explained