I'm already committed to a few things:
- Not to use Facebook Pixel for marketing or any other similar social media mechanism
- Not to use Google Analytics and switch to a self hosted alternative
- Avoid any design dark patterns
- Don't store any data that is not absolutely essential and for the data that we store, always ask for permission clearly and using clear language
What are other mandatory items that I should add to this list and commit to?
You mention dark patterns, I think its good (and honestly healthy for business) to implement better-than-average product transparency. So have pricing very obvious and easy to find, little Q&A on refunds with refund process quick and fair.
Finally -the obligatory - talk to your customers :P What do they think an ethical site is? What do the crooks in your industry do that annoys them?
Also, make stuff that don't need Javascript to work when Javascript is off. Privacy-minded people might disable Javascript.
In my experience, the conversations we had with our clients, advisors, investors are really good because even when they make a mistake assuming something, we correct it on the spot: "No. We are not able to do that right now because we have B issue and we're working to solve it given we do not have expertise on this. It will take some time. For now, we're doing Y instead because of X. We don't have Z capability".
The trust that grows from having these conversations is invaluable. You can't build it back when it's gone. Even if you're not in a managerial or executive position and your manager makes the mistake of wrongly claiming something, you pull them aside and correct them. They most likely thought what they said was correct, and will follow up on that and send an erratum/clarification.
If ethics were something we could relate to use in an actionable way it would be so simple it wouldn't be necessary to do so.
If you want to go self-hosted with the analytics, but still need enough user data to test hypothesis or improve conversion rates you can check out the self-hosted platform I'm working on: https://www.usertrack.net/
This includes avoiding CDNs.
Do not ask for the credit card during the free trial signup.