Phase 1 — Capture what actually happens

  • Capture live network traffic with developer tools; export as HAR.
  • Capture in three consent states: before any choice, after accepting, after declining.
  • Capture in at least three browsers (tracking protection differs).
  • Capture on desktop and mobile.
  • Capture from at least two geographies.
  • Capture logged out and logged in.
  • Capture with a universal opt-out signal transmitted.
  • Cover these page types:
    • Home and marketing
    • Search and category
    • Detail pages
    • Any page whose URL reveals a sensitive attribute
    • Forms: contact, application, scheduling, checkout
    • Authentication
    • Account and portal
    • Pages with embedded video
    • Pages with a chat widget
    • Confirmation and success pages
  • Enter distinctive test data in every form field, then search the entire capture for those strings.

Phase 2 — Reconcile

  • Export the tag manager configuration.
  • Compare against the capture. Document the delta.
  • Identify the source of each unlisted destination: hard-coded, loaded by another tag, loaded by a widget, added by an agency.
  • Identify tags in the manager that no longer fire.
  • Identify tags firing on more pages than their triggers suggest.
  • Enumerate every domain and subdomain the organization operates; the list is longer than anyone expects.

Phase 3 — Map transmitted fields

For each destination:

  • Destination domain, resolved to the company behind it.
  • Full URL including every query parameter.
  • The Referer header — this is how sensitive page URLs leak automatically.
  • Cookie and identifier values.
  • Custom event names and parameters.
  • POST body contents, decoded.
  • Whether any form field value appears.
  • Whether keystrokes are captured.

Flag immediately:

  • Page URLs revealing health, financial, legal, or similarly sensitive attributes
  • Custom parameters carrying user-supplied values
  • Email addresses, phone numbers, or hashes derived from them
  • Keystroke capture in form fields
  • Chat message contents
  • Video titles or content identifiers paired with a persistent identifier

Phase 4 — Sort by legal theory

  • Contents of communications — session replay keystrokes, chat bodies, pre-submission field values. Strongest two-party consent facts under statutes descending from 18 U.S.C. § 2511.
  • Video plus identifier — the 18 U.S.C. § 2710 pattern; $2,500 liquidated damages per violation.
  • Sensitive-context URLs — health, financial, legal.
  • Children's data — persistent identifiers implicate 15 U.S.C. § 6501 and 16 C.F.R. Part 312.
  • Financial data — 15 U.S.C. § 6801 and 15 U.S.C. § 6802.
  • Everything else — sale and targeted advertising obligations, and accuracy under 15 U.S.C. § 45.

Phase 5 — Verify consent gating

The most important test in the audit.

  • Load the site with capture recording; decline all optional categories; browse.
  • Which tags fired anyway? List them.
  • Do any tags fire before any choice is made?
  • Do any fire on a second page load after a decline?
  • Is any advertising tag miscategorized as "necessary"?
  • Does the site honor a universal opt-out signal where required?
  • Re-test after every release; gating breaks silently.

A banner that does not gate is worse than no banner.

Phase 6 — Vendor contracts

For each destination:

  • Contract located? (Note any destination with no contract at all.)
  • May the vendor use the data for its own purposes? ← decides the party-exception analysis
  • Purpose limited to providing services to you?
  • Cross-customer use prohibited?
  • Independent profiling prohibited?
  • Onward transfers restricted and enumerated?
  • Retention defined; deletion on termination?
  • Deletion on request supported, with certification?
  • Audit or attestation rights?
  • Indemnity covering the vendor's own violations?
  • Role designated as processor or service provider, not independent controller?

Phase 7 — Disclosure accuracy

  • Does the privacy policy describe the categories actually collected?
  • Does it name the categories of third parties actually receiving data?
  • Does it accurately describe collection triggers?
  • Does it claim anything the site does not do?
  • Do state-specific disclosures match practice, including sale and targeted advertising characterization?
  • Does the cookie notice list the tags actually present?
  • Do app store data disclosures match the SDK behavior?

Phase 8 — Remediate in priority order

  • P1: Remove third-party advertising and analytics tags from health, financial account, children's, and authentication pages.
  • P2: Fix consent gating; re-test; re-test again after the next release.
  • P3: Remove session replay from all form pages; renegotiate or replace chat vendors permitting independent use.
  • P4: Stop transmitting video events with identifiers, or obtain consent in the separate, distinct, written, revocable form 18 U.S.C. § 2710 requires.
  • P5: Correct the privacy policy to describe actual practice.
  • P6: Renegotiate vendor contracts for purpose limitation.
  • P7: Audit custom events for user-supplied values.
  • P8: Implement governance.

Phase 9 — Design changes that prevent leakage

  • Remove sensitive attributes from URLs — move parameters to POST bodies or session state.
  • Set a restrictive Referrer-Policy header.
  • Segregate sensitive flows onto templates with no third-party tags, enforced at build.
  • Use first-party endpoints for measurement; decide server-side what to forward.
  • Never put form values in event parameters; send opaque event identifiers.
  • Disable vendor default features — enhanced matching, automatic event detection.
  • Sandbox or replace third-party widgets on sensitive pages.
  • Gate at the loader so the script never loads, not at the tag.
  • Automated build check failing on third-party scripts in restricted page sets.

Phase 10 — Mobile applications

  • Proxy device traffic with a trusted certificate; capture everything.
  • Inspect the build for embedded SDKs; compare to the dependency manifest.
  • Test each permission state: granted, denied, and platform tracking permission separately.
  • Test first launch — SDKs frequently transmit before the consent screen renders.
  • Map device identifiers, advertising identifiers, and hardware attributes.
  • Compare against app store data disclosures.
  • Review SDK contracts for the same purpose-limitation question.

Phase 11 — Governance

  • Tag inventory built from live scanning, reconciled to the manager.
  • Per-tag record: vendor, business owner, purpose, pages, fields transmitted, custom parameters, consent category, gating verified, contract reference, vendor permitted use, retention, approval date, last verified.
  • Approval required before any tag deployment or configuration change.
  • Publish rights in the tag manager restricted to named individuals.
  • Prohibited-page list enforced by automated scan.
  • Quarterly consent verification with a named owner.
  • Change triggers defined: new tag, config change, new page category, vendor change, new jurisdiction, consent platform update.
  • Vendor contract standards published for procurement.
  • Fast approval path for marketing (same week), or the rule will be bypassed.

Phase 12 — Documentation

  • Dated audit report: what was captured, when, in what configurations.
  • Findings and legal assessment.
  • Remediation record with dates.
  • Residual risk memorandum with business justification and a named executive acceptance.
  • Stated limitations: subdomains, acquired properties, microsites, partner-hosted pages, non-English sites, mobile.
  • Privilege structure considered with counsel.
  • Captures and inventory versions retained.

Phase 13 — Demand letter response

  • Preserve: tag manager history, consent platform logs, policy versions, page templates, vendor contracts.
  • Verify the allegation — scanners generate letters about tags not present.
  • Stop ongoing collection on the identified pages regardless of merits.
  • Assess arbitration first; an enforceable clause changes everything.
  • Assess standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) — and consider that winning sends the case to state court.
  • Build the party-exception record: vendor contracts and actual practice.
  • Separate contents from record information across the tag set.
  • Assemble all consent evidence.
  • Identify individualized issues supporting a certification defense.
  • Check vendor indemnities.
  • Do not produce the audit without a privilege analysis.
  • Do not remediate in a way that destroys evidence of the prior configuration.

Related documents