Privacy rules differ by market and by business. Your tracking should follow the consent your visitors give, not guess.
Pick a consent mode per workspace: none, gpc (honour Global Privacy Control) or required. With required, nothing is stored or sent until consent is granted, either with tracko('consent', 'granted') or automatically when your banner grants it through Google Consent Mode v2, IAB TCF, OneTrust or Cookiebot. Password, card, CVV, one-time-code and similar fields are never read, and events carrying personal data are only retried from sessionStorage, never localStorage.