Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense

Summary. The working documents of an adtech privacy practice, annotated.

Template 1 — Capture protocol

Hand this to an engineer. Do not ask marketing for a list.

TRACKING CAPTURE PROTOCOL                      DATE: ______

SETUP
  Browser dev tools open, Network tab, "Preserve log" ENABLED
  Clear cookies and site data between runs
  Export each run as HAR, named:
    [pagetype]_[browser]_[device]_[consent]_[geo]_[auth].har

MATRIX — run every combination that applies
  Consent:   before choice | accepted all | declined all
  Browser:   Chromium | Firefox | Safari
  Device:    Desktop | Mobile
  Geography: [state with privacy law] | [state without]
  Auth:      Logged out | Logged in
  Signal:    With GPC/opt-out signal | Without

PAGES — capture each
  [ ] Home
  [ ] Category / search results
  [ ] Detail page
  [ ] *** Any page whose URL reveals a sensitive attribute ***
  [ ] Contact form
  [ ] Application / scheduling form
  [ ] Checkout
  [ ] Login page
  [ ] Account / portal page
  [ ] Page with embedded video
  [ ] Page with chat widget
  [ ] Confirmation / success page

DISTINCTIVE TEST DATA — enter unique strings in EVERY field
  Name:    ZZQX-TESTNAME-7741
  Email:   zzqx7741@example.invalid
  Phone:   555-0100-7741
  Amount:  13,747
  Free text: "quixotic vermillion 7741"
  Then SEARCH every HAR for these strings.

RECORD
  Date, time, tester, site version / release number

What it prevents: an inventory that is 40% complete and an analysis based on it.

Template 2 — Tag inventory record

One row per destination. The bolded fields decide the legal analysis.

Template 3 — Consent verification procedure

Quarterly. Assign a named owner. Takes an afternoon.

CONSENT GATING VERIFICATION            DATE: ______  TESTER: ______

1. Clear all cookies and site data.
2. Open dev tools, Network tab, preserve log ON.
3. Load the home page. Record every destination that fires
   BEFORE any consent choice:
   ____________________________________________
4. DECLINE all optional categories.
5. Browse: home -> category -> detail -> form page.
6. Record every destination that fired AFTER the decline:
   ____________________________________________
7. Open a new tab and load a second page. Record destinations:
   ____________________________________________
8. Repeat with a universal opt-out signal transmitted.
   Behavior changed?  Y/N
9. Compare against the approved inventory's consent categories.
   Any advertising tag categorized as "necessary"?  Y/N
10. RESULT:   [ ] PASS   [ ] FAIL — findings below
11. Findings routed to: ______  Remediation due: ______

Run it after every release. Gating breaks silently when unrelated code changes.

Template 4 — Prohibited page list

Enforce by automated scan, not by policy document.

Build check: fail the build if a third-party script appears on a page matching a prohibited pattern.

Template 5 — Vendor contract clauses

Purpose limitation. Vendor will process Personal Information solely to provide the Services to Customer and for no other purpose. Vendor will not (a) use Personal Information for its own commercial purposes, including product development, model training, or advertising; (b) combine Personal Information with data received from any other source or customer; (c) build or contribute to any profile of any individual for any purpose other than providing the Services to Customer; or (d) sell, share, or disclose Personal Information except to subprocessors listed in Schedule [ ].

Role. Vendor acts solely as Customer's [processor / service provider] and not as an independent [controller / business]. Vendor certifies that it understands and will comply with these restrictions.

No independent identification. Vendor will not attempt to identify any individual from Personal Information received under this Agreement except as necessary to provide the Services.

Retention and deletion. Vendor will retain Personal Information only as long as necessary to provide the Services, and will delete it within [30] days of termination or of Customer's request, and will certify deletion in writing.

Subprocessors. Vendor will not engage any subprocessor without Customer's prior written consent, and will impose these obligations on any approved subprocessor.

Audit. Vendor will make available information sufficient to demonstrate compliance, and will permit an audit or provide an independent attestation annually.

Feature defaults. Vendor will not enable any feature that transmits additional Personal Information — including identifier matching, automatic event detection, or enhanced conversion features — without Customer's prior written approval.

Indemnity. Vendor will indemnify Customer against claims arising from Vendor's breach of this Section.

The clause that matters most is purpose limitation. It is the factual predicate for arguing the vendor is an extension of the operator rather than a third party intercepting communications. A vendor that will not accept it is telling you how it will be characterized.

The feature-defaults clause is the one nobody includes and everybody needs. Vendors enable transmission features by default and by update.

Template 6 — Tag approval form

TAG APPROVAL REQUEST                    REQUESTED BY: ______

1. VENDOR AND TAG
2. BUSINESS PURPOSE — what decision does this data inform?
3. PAGES IT WILL FIRE ON
   Does any match the prohibited page list?  Y/N
4. DATA TRANSMITTED — enumerate every field
   Any user-supplied value?  Any identifier?  Any URL parameter?
5. CUSTOM EVENTS AND PARAMETERS CONFIGURED
6. VENDOR FEATURES ENABLED
   Enhanced matching? Automatic event detection? Session recording?
7. CONSENT CATEGORY
   Will it be gated?  Verified how?
8. CONTRACT
   Executed?  Purpose limitation clause present?  Reference: ______
9. ALTERNATIVES CONSIDERED
   First-party collection?  Server-side?  Aggregated reporting?
10. LEGAL REVIEW:  Approved / Approved with conditions / Denied
    Conditions: ______        Reviewer: ______   Date: ______

Turnaround commitment: same week. A three-week review produces hard-coded tags.

Template 7 — Privacy policy language

Describe what happens. Resist writing broadly enough to cover everything.

Information collected automatically. When you use our website, we and certain third parties we work with automatically collect information about your device and your activity, including your IP address, browser and device characteristics, the pages you view, the links you click, and the pages that referred you.

Third parties that receive this information. We use the following categories of third-party services, and information is transmitted directly from your browser to them: [analytics providers; advertising networks; customer support tools]. A current list is available at [link] and in our cookie notice.

What we do not do. We do not permit third-party advertising or analytics tags on pages relating to [health services / your account / applications]. We do not transmit the contents of messages you send through our support chat to advertising networks. We do not transmit information about videos you view together with information identifying you.

Your choices. You may control non-essential tracking through our consent banner at [link], and we honor the Global Privacy Control signal.

Sale and targeted advertising. [State plainly whether these disclosures constitute a "sale" or "sharing for targeted advertising" under applicable state law, and how to opt out.]

The "What we do not do" section is unusual and valuable. Specific negative commitments are defensible if true, and they answer the deception claim directly. Only include commitments the audit confirms.

Template 8 — Residual risk memorandum

RESIDUAL RISK — WEBSITE TRACKING              DATE: ______
PREPARED AT THE DIRECTION OF COUNSEL

1. REMEDIATED
   [Item / date / verification]

2. RETAINED, AND WHY
   For each:
     Tag or practice:
     Business justification:
     Claim theories it supports:
     Population affected (est.):
     Statutory damages exposure (est.):
     Mitigations applied:
     ACCEPTED BY: ____________  TITLE: ______  DATE: ______

3. HISTORICAL EXPOSURE
   Practice / period it ran / limitations periods / population /
   preservation status

4. MONITORING
   Quarterly consent verification owner:
   Annual audit date:
   Change triggers:

5. LIMITATIONS — WHAT THIS AUDIT DID NOT COVER
   [ ] Subdomains       [ ] Acquired properties
   [ ] Microsites       [ ] Partner-hosted pages
   [ ] Non-English sites [ ] Mobile applications

Section 2's acceptance line is the purpose of the document. Unaccepted residual risk becomes, later, an oversight.

Template 9 — Preservation notice

To: Engineering, Marketing, Privacy, Vendor Management Re: Litigation hold — website tracking

Preserve, and do not alter or delete, the following, effective immediately:

1. Tag manager configuration and version history for all containers
2. Consent management platform configuration and all consent event logs
3. All versions of the privacy policy, cookie notice, and terms of service, with effective dates
4. Page templates and the source repository history for all pages
5. All contracts, amendments, and data processing agreements with tag vendors
6. All communications with vendors regarding data collection, features, or configuration
7. Any prior tracking audits, scans, or assessments
8. Web server access logs for the period [ ]
9. Analytics account configuration and custom event definitions
10. Mobile application build artifacts and SDK dependency manifests

Do not remediate in a manner that overwrites configuration history. Where remediation is required to stop ongoing collection, export the prior configuration first and record the change with a timestamp.

The bolded instruction is the one people miss. Tag manager version history is routinely overwritten, and it is the best evidence of what the site did and when.

Template 10 — Discovery requests (defense side, to plaintiff)

1. All documents concerning Plaintiff's visits to the Website, including browser history, cookies, and local storage.
2. Documents sufficient to identify every device and browser Plaintiff used.
3. All privacy settings, extensions, and tracking-protection configurations in use.
4. Documents concerning any consent choice Plaintiff made on the Website.
5. All accounts Plaintiff holds with each third party alleged to have received information.
6. Documents concerning any harm Plaintiff contends resulted.
7. All communications with counsel's investigators or with any scanning service prior to filing.
8. Documents concerning Plaintiff's use of similar websites during the same period.
9. Any agreement Plaintiff accepted on the Website, including terms containing an arbitration provision.

Item 7 matters. Many of these cases originate with an automated scan rather than with a user's experience, and the origin bears on typicality and on standing.

Template 11 — Expert declaration outline (technical, defense)

I.    QUALIFICATIONS
II.   MATERIALS AND METHODOLOGY
      Traffic captures performed; configurations tested
III.  HOW THE WEBSITE OPERATES
      A. Page structure and templates
      B. Tag management and loading
      C. Consent management and gating
IV.   WHAT IS AND IS NOT TRANSMITTED
      A. Field-by-field description for each destination
      B. Distinction between contents and record information
      C. What identifiers are and are not linkable to an individual
V.    VARIABILITY ACROSS SESSIONS
      A. Browser tracking protection differences
      B. Consent state differences
      C. Geographic and device differences
      D. Why what any given visitor experienced cannot be determined
         from the site configuration alone
VI.   THE VENDOR'S ROLE
      Contractual and technical constraints on vendor use
VII.  OPINIONS AND BASES
VIII. DECLARATION UNDER 28 U.S.C. § 1746

Section V is the class certification argument. Individualized variability in what each visitor's browser transmitted is the strongest predominance defense available.

Template 12 — Mobile SDK inventory

The recurring finding: an SDK transmitting on launch before the consent screen renders. Fix it in initialization order.

Related documents

• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech
• Auditing Your Website Tracking Stack: A Practical Guide
• Website Tracking Compliance Checklist: A Practical Checklist
• Privacy and Data Protection Toolkit: Building and Running a Privacy Program
• Data Breach and Incident Response Toolkit: From Detection to Notification
• Class Action Defense Toolkit: From Complaint Through Settlement Approval
• Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design