Checklist · Technology

Building a Privacy Compliance Program: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2025-06-03
Topic
Technology

A twelve-phase operational checklist for building a United States consumer privacy compliance program from nothing, or for auditing one that already exists. The phases run in dependency order: determining which statutes apply, building a data inventory that reflects what the systems actually do, classifying sensitive and specially regulated data, writing notices that satisfy every required element, designing consent and choice architecture that survives the dark pattern rules, building an opt-out stack that propagates to server-side and offline paths, standing up rights intake with verification and appeal, repapering the vendor estate so that ordinary disclosures are not statutory sales, imposing minimization and retention limits, conducting risk assessments and governing automated decisionmaking, hardening security against the one private right of action in the comprehensive statutes, and installing the governance that keeps all of it true after the next product launch. Each phase carries commentary on the failure modes that produce enforcement. A worked example follows a national retailer through the program with specific numbers, decisions, and one avoidable mistake.

Building a Privacy Compliance Program: A Practical Checklist

Technology > Data Privacy | Published 3 June 2025 - Updated 20 July 2026 | UpLaw - uplaw.us

In brief. A privacy program is not a document set. It is a set of controls in production systems, plus the evidence that they work. Regulators test the controls from the outside before they ever ask for a document, and the two most common findings — an opt-out that does not propagate and a vendor contract that does not exist — are both engineering facts.

Keywords: applicability, data inventory, sensitive data, notice at collection, consent, universal opt-out, dark patterns, rights requests, appeal, vendor contracts, minimization, retention, assessments, ADMT, security, governance

How to use this. Phases 1–3 establish what you have and what law applies; nothing downstream is reliable without them. Phases 4–7 are the consumer-facing surface, which is what regulators test first. Phases 8–10 are the back office, which is where the enforcement narrative gets written. Phases 11–12 are resilience and durability. The doctrine is in Data Privacy Compliance: A Comprehensive Guide to State Privacy Laws and Consumer Rights. The narrative framing is Notice and Choice Is Dead: What the State Privacy Laws Actually Require. The resource map is The Data Privacy and Consumer Rights Toolkit.

A standing caution. There is no federal comprehensive privacy statute and no preemption. Every item below has state-specific variations, several statutes carry private rights of action that dwarf regulatory penalties, and the list of enacted states changes every legislative session. Confirm current law before relying on any item here.

Phase 1 — Applicability and Scoping

  • [ ] Count state residents whose personal data the company processes, state by state, not customers or accounts.
  • [ ] Test each state's threshold, including the low-threshold states — Delaware, Montana, New Hampshire, Rhode Island — before assuming coverage is limited to the large ones.
  • [ ] Test the no-threshold states, Texas and Nebraska, against the federal Small Business Administration size standard for the company's industry.
  • [ ] Determine whether an exemption applies at the entity level or only at the data level, and note that California is a data-level state for GLBA and HIPAA.
  • [ ] Confirm whether employee, applicant, contractor, and B2B contact data is in scope — it is in California and nowhere else.
  • [ ] Identify every special-category statute in play: biometric, consumer health, genetic, data broker registration.
  • [ ] Identify every sectoral regime: GLBA, HIPAA, FCRA, COPPA, VPPA, TCPA, FERPA, DPPA.
  • [ ] Determine whether the company or any affiliate meets a data broker registration definition in California, Texas, Oregon, or Vermont.
  • [ ] Identify foreign obligations: GDPR, UK GDPR, and any localization regime.
  • [ ] Record the applicability analysis in a dated memorandum with the thresholds used and the data supporting each count.
  • [ ] Calendar a quarterly re-run of the analysis and an annual legislative scan.

Why it matters, and the traps. Applicability is where programs are scoped too small and too late. Two errors recur. First, counting customers instead of residents, which understates by whatever fraction of processed data belongs to non-customers — prospects, site visitors, recipients of marketing, people in a purchased list. Second, assuming a GLBA or HIPAA exemption covers everything; in California it covers only the regulated data, leaving marketing, web analytics, and HR squarely in scope. The applicability memo is also the first document a regulator requests, and its absence establishes that nobody asked the question.

Phase 2 — Data Inventory and Mapping

  • [ ] Inventory every collection surface: website, mobile app, in-store kiosk, point of sale, loyalty enrollment, SMS keyword, QR code, IVR and call recording, connected device, chat, and third-party form.
  • [ ] For each surface, record what is collected, from whom, on what legal basis or disclosed purpose, and where it lands.
  • [ ] Inventory every system of record and every downstream copy: warehouse, lake, CRM, marketing platform, support tool, analytics, backups, and spreadsheets on shared drives.
  • [ ] Inventory every outbound flow: browser tags, mobile SDKs, server-side conversion APIs, offline event uploads, batch files, clean-room integrations, and API partners.
  • [ ] Pull the actual tag manager container and the mobile SDK manifest, and reconcile them against the vendor list. They will not match.
  • [ ] Identify derived and inferred data: scores, segments, propensities, model features, and embeddings.
  • [ ] Record retention for each store as it actually operates, not as policy states.
  • [ ] Map each flow to a role: controller, processor, or third party.
  • [ ] Identify data that leaves the United States or is accessible from outside it, including by support vendors.
  • [ ] Have the inventory validated by engineering, not populated by survey alone.
  • [ ] Store the inventory as a queryable artifact under change control, not as a slide.

Why it matters, and the traps. Every downstream obligation — notice content, opt-out propagation, deletion, retention, assessments — depends on knowing where the data is. The survey-based inventory is the classic failure: teams report what they intend, not what the code does, and the gap is always in the same places. Server-side integrations installed for measurement, an SDK bundled inside another SDK, a legacy batch file to a partner nobody remembers approving, and a marketing analyst's export sitting in cloud storage. Reconcile the inventory against the tag container and the network traffic, or it is fiction.

Phase 3 — Classification: Sensitive, Minors, and Regulated Categories

  • [ ] Classify each data element against each state's sensitive-data definition, not a single merged list.
  • [ ] Flag precise geolocation wherever collected, including by SDKs that collect it by default.
  • [ ] Flag inferred sensitive data: health, religion, sexual orientation, immigration status, and financial distress derived from behavior.
  • [ ] Identify anything meeting a biometric identifier definition — face geometry, voiceprint, fingerprint, iris — including in age estimation and authentication features.
  • [ ] Identify anything meeting the consumer health data definition in Washington and Nevada, which reaches inferences and is broader than any clinical definition.
  • [ ] Identify genetic information, including family medical history collected in any context.
  • [ ] Identify data of known minors, and determine which knowledge standard applies: actual knowledge, willful disregard, or knew-or-should-have-known.
  • [ ] Determine whether any product is directed to children under the COPPA multi-factor test.
  • [ ] Identify any data used, or usable, for an eligibility decision that could make a product a consumer report under the FCRA.
  • [ ] Identify video content anywhere on the properties, because it triggers the video privacy analysis.
  • [ ] Document the classification decisions and the reasoning, especially the negative ones.

Why it matters, and the traps. Classification errors are asymmetric: over-classifying costs money, under-classifying costs a class action. The two categories that get missed are inferences and biometrics. A propensity score derived from purchases is health data in several states even though no one disclosed a diagnosis. A vendor that says its age-estimation feature "does not store biometrics" is describing retention, not collection, and under the Illinois statute collection without a prior written release is the violation. Get the vendor's technical documentation, not its marketing page.

Phase 4 — Notices and Disclosures

  • [ ] Draft a privacy notice containing every required element for the strictest applicable state.
  • [ ] Include retention periods or the criteria for determining them, per category — a California requirement routinely omitted.
  • [ ] Include categories of third parties, and be prepared to name specific third parties on request for Oregon consumers.
  • [ ] Describe the rights, including the appeal process and the method to contact the attorney general.
  • [ ] Deploy notice at collection on every surface identified in Phase 2, at or before collection.
  • [ ] Deploy the required "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or the combined "Your Privacy Choices" control with the prescribed icon.
  • [ ] Confirm the notice is available in the languages in which the company ordinarily provides its services, and accessible under recognized accessibility guidelines.
  • [ ] Reconcile every statement in the notice against the Phase 2 inventory, line by line.
  • [ ] Version the notice, archive prior versions with effective dates, and record what changed.
  • [ ] Provide the required annual update and any state-specific refresh obligation.
  • [ ] Publish separate notices where required for employees, applicants, and job candidates in California.

Why it matters, and the traps. The notice will not win the case, but an inaccurate one loses it — a false statement about data practices is both a state privacy violation and a Section 5 deception claim, and it is the easiest claim a regulator can prove. The recurring defect is a notice describing an architecture the company retired two years ago. The second is notice at collection missing entirely from the physical and voice surfaces, because the privacy team owns the website and nobody owns the kiosk.

Phase 5 — Consent and Choice Architecture

  • [ ] Identify every processing activity requiring opt-in consent: sensitive data in most states, minors' data, biometrics, consumer health data, secondary uses beyond the disclosed purpose.
  • [ ] Design consent that is a clear affirmative act — no pre-checked boxes, no acceptance of general terms, no consent by continued use.
  • [ ] Make refusing as easy as accepting, in the same place, with the same prominence and the same number of steps.
  • [ ] Make withdrawal as easy as consent, and stop processing within the required period after withdrawal.
  • [ ] Test the interface against the dark pattern criteria: symmetry, plain language, non-manipulative framing, minimal steps, no excess information.
  • [ ] Remove guilt and shame language from decline options.
  • [ ] Obtain separate consent where separate consent is required — biometric release, consumer health collection versus sharing, COPPA third-party disclosure.
  • [ ] Capture consent records: what was shown, when, by whom, under which policy version, and through which interface.
  • [ ] For biometrics, capture a written release and publish a retention and destruction schedule before any collection occurs.
  • [ ] Run a usability test of the decline path with someone who did not build it.
  • [ ] Screenshot and archive every consent interface at each release, because the interface as it existed on the date of collection is the evidence.

Why it matters, and the traps. Consent obtained through a dark pattern is not consent, which means the processing it authorized was unlawful from the beginning — the defect is retroactive, not prospective. The most common violation is visible in a single screenshot: a prominent "Accept All" button beside a low-contrast "Manage Preferences" link that opens a four-screen flow. That asymmetry has been the core finding in multiple published enforcement resolutions. It is also, uniquely, a defect that can be fixed in an afternoon.

Phase 6 — The Opt-Out Stack and Universal Signals

  • [ ] Implement recognition of a universal opt-out mechanism on every web property, applied at page load.
  • [ ] Confirm the signal is read and the flag set before any third-party tag fires — not after.
  • [ ] Propagate suppression to every downstream path: browser tags, mobile SDKs, server-side conversion APIs, offline event uploads, CRM syncs, clean rooms, and partner batch files.
  • [ ] Where the signal can be associated with a known consumer, extend the opt-out to that consumer's other data as required.
  • [ ] Process opt-outs without verification — verification of an opt-out is itself a violation.
  • [ ] Honor the opt-out within the required period, commonly 15 business days, and forward it to third parties who received the data in the preceding period.
  • [ ] Do not display a confirmation pop-up asking the consumer to reconsider.
  • [ ] Log every opt-out with a timestamp, scope, source, and downstream confirmation.
  • [ ] Test with the signal enabled and watch the network requests; capture the test as evidence with a date.
  • [ ] Repeat the test after every release, and make it a blocking check in the deployment pipeline.
  • [ ] Confirm the opt-out survives session end, browser refresh, and app reinstall to the extent technically possible.
  • [ ] Track state-by-state effective dates for signal recognition; several arrived after the statutes did.

Why it matters, and the traps. This is the single most tested control in the field, because anyone with a browser can test it in ninety seconds without any legal process. The failure is almost always the same: the consent platform records the signal correctly and the suppression never reaches the server-side integration, which was installed by a different team through a different console for a different purpose. A screenshot of a consent banner proves nothing. A network capture with the signal enabled proves everything, in both directions.

Phase 7 — Rights Intake, Verification, Fulfillment, and Appeal

  • [ ] Publish at least two methods to submit requests, including a toll-free number where required for businesses that interact with consumers offline.
  • [ ] Build one intake queue, one verification standard, and one clock set to the strictest deadline.
  • [ ] Acknowledge receipt within the required period and record the received date, not the assigned date.
  • [ ] Verify identity to a reasonable degree of certainty, scaled to the sensitivity of the data — and collect nothing beyond what verification requires.
  • [ ] Never verify an opt-out.
  • [ ] Accept authorized agent requests with permitted proof of authority.
  • [ ] Fulfill access requests with categories, sources, purposes, categories of third parties, and specific pieces where required.
  • [ ] Fulfill deletion across systems of record, backups on their restoration schedule, derived data, and vendor copies — and direct service providers to delete and notify third parties who received the data.
  • [ ] Fulfill correction so it propagates to derived data, segments, and shared copies.
  • [ ] Deliver portability in a structured, commonly used, machine-readable format.
  • [ ] Build the appeal process required in every state except California, with a written explanation and the attorney general contact method.
  • [ ] Maintain a metrics log of requests received, complied with in whole or part, denied, and median response time, and publish it where required.
  • [ ] Sample-audit fulfilled requests quarterly to confirm the deletion actually occurred everywhere the inventory says the data lives.

Why it matters, and the traps. Three failure modes recur. Over-verification, which converts a rights process into a barrier and has produced published penalties on its own. Deletion that reaches the CRM and not the warehouse, the vendor, or the model. And the appeal response written as a customer-service reply, omitting the statutory explanation and the regulator's contact information — a document that goes straight to the attorney general who then reads it as an admission of process failure. Write every appeal response as though a regulator will read it, because the statute requires you to tell the consumer how to send it to one.

Phase 8 — Vendor Contracts and the Sale/Share Perimeter

  • [ ] Build a complete recipient list from the Phase 2 inventory, not from the procurement system.
  • [ ] Classify each recipient as processor/service provider or third party, and record the reasoning.
  • [ ] Confirm a compliant written contract exists with every processor, containing every mandatory term for every applicable state.
  • [ ] For California, confirm the contract limits use to specified purposes, prohibits sale and sharing, prohibits retention or use outside the direct business relationship, prohibits combining with other sources, and grants monitoring and remediation rights.
  • [ ] For other states, confirm confidentiality, deletion or return at termination, information sufficient to demonstrate compliance, audit or assessment rights, and subcontractor flow-down.
  • [ ] Compare each vendor's actual conduct against its contractual role — enrichment, resale, model training, and identity-graph building all break the processor role.
  • [ ] Repaper every legacy vendor onboarded before the applicable statute.
  • [ ] Paper affiliates as processors unless a definitional exemption clearly applies.
  • [ ] Add data-protection terms to the standard form so new vendors cannot onboard without them.
  • [ ] Exercise the audit or information right on at least the highest-risk vendors annually, and keep the response.
  • [ ] Confirm downstream vendors honor deletion and opt-out instructions, and get it in writing.
  • [ ] Assess whether any arrangement gives a country of concern access to bulk sensitive personal data under the federal data security rule.

Why it matters, and the traps. Under the CCPA the contract is not evidence of compliance; it is the operative fact that makes a disclosure something other than a sale. Missing contract, sale. Non-conforming contract, sale. Conforming contract contradicted by the vendor's conduct, sale — and now a misrepresentation problem as well. The audit right is the most valuable term in these agreements and the least exercised; a controller that has never asked a vendor to demonstrate compliance has a right it cannot claim to have relied on.

Phase 9 — Minimization, Purpose Limitation, and Retention

  • [ ] For each collection, state the specific purpose and test whether the collection is reasonably necessary and proportionate to it.
  • [ ] For any consumer in Maryland, test against the stricter standard: necessary to provide or maintain a product or service the consumer requested.
  • [ ] Eliminate collection that serves no current purpose — the fields nobody uses are pure liability.
  • [ ] Establish a retention schedule per data category with a defined trigger and period, and disclose it as required.
  • [ ] Implement automated deletion, and verify it ran.
  • [ ] Address backups with a documented restoration-cycle approach rather than pretending they do not exist.
  • [ ] Establish a secondary-use review gate: no new use of an existing dataset without a compatibility analysis.
  • [ ] Document each compatibility analysis: context of collection, relationship, notice specificity, sensitivity, and reasonable consumer expectation.
  • [ ] Apply the same discipline to derived data, models, and embeddings, which are personal data if reasonably linkable.
  • [ ] Apply true deidentification where possible — technical safeguards, a public commitment not to re-identify, and contractual flow-down; hashing alone is not enough.
  • [ ] Prohibit indefinite retention of children's data, and publish the retention periods the amended COPPA Rule requires.

Why it matters, and the traps. Minimization is the obligation with no visible surface, which is why it is the one that goes unbuilt. It surfaces at exactly two moments: when a regulator asks why five years of geolocation traces exist, and when a breach exposes a dataset the company had no reason to hold. The secondary-use gate is the highest-leverage control in this phase, because it catches the decision at the moment it is made rather than three years later in a document review.

Phase 10 — Assessments, Profiling, and Automated Decisionmaking

  • [ ] List every activity triggering a data protection assessment: targeted advertising, sale, sensitive data, heightened-risk profiling, and any heightened risk of harm.
  • [ ] Adopt one assessment template that satisfies the most demanding state's content requirements.
  • [ ] Complete the residual risk section honestly; a template with every risk marked "low" is worse than no template.
  • [ ] Record who reviewed and approved the assessment, and when.
  • [ ] Conduct assessments before the processing begins, and update them on material change.
  • [ ] Structure assessments to preserve privilege where possible — directed by counsel, for the purpose of legal advice — while recognizing the regulator can compel production in several states.
  • [ ] Build a model inventory covering every automated system that affects a consumer.
  • [ ] Identify any automated decision producing legal or similarly significant effects, using the enumerated categories.
  • [ ] Deploy pre-use notice, an opt-out or a human-review alternative, and an access/explanation artifact describing the logic, key parameters, and output.
  • [ ] Map the same model documentation to any applicable algorithmic discrimination statute, employment AI law, or bias-audit ordinance.
  • [ ] Schedule the cybersecurity audit obligations where applicable, on the phased revenue-based timetable.
  • [ ] Calendar assessment submission obligations to the regulator where they exist.

Why it matters, and the traps. The assessment is the first document a state regulator requests, and the request is usually a surprise because the company has never produced one. Two traps. First, the template with no residual risk analysis, which reads as a document created to satisfy a checklist rather than to make a decision — regulators recognize it instantly. Second, describing the same model four different ways to four different regimes, because four teams wrote four documents. One model inventory, one explanation artifact, four mappings.

Phase 11 — Security, Breach Readiness, and the Private Right of Action

  • [ ] Implement a written information security program proportionate to the data, meeting the strictest applicable standard — the amended Safeguards Rule where GLBA applies.
  • [ ] Encrypt personal information at rest and in transit; the California private right of action reaches nonencrypted, nonredacted personal information.
  • [ ] Enforce multifactor authentication, least privilege, and periodic access review.
  • [ ] Maintain an asset inventory and a vulnerability management cadence, and test.
  • [ ] Impose security requirements on vendors and verify them, rather than accepting attestations.
  • [ ] Maintain a breach response plan mapped to all fifty state statutes, plus GLBA's 30-day FTC notice for 500+ consumers, the HIPAA Breach Notification Rule, and the Health Breach Notification Rule for non-covered health apps.
  • [ ] Pre-identify counsel, forensics, and notification vendors, and pre-negotiate the engagements.
  • [ ] Run a tabletop exercise annually, including the decision points on regulator notice and public statements.
  • [ ] Confirm cyber insurance covers statutory damages and regulatory penalties where insurable.
  • [ ] Preserve privilege by directing the forensic engagement through counsel from the outset, and follow through in practice.
  • [ ] Track sector-specific incident reporting obligations that run on shorter clocks than the state statutes.

Why it matters, and the traps. The comprehensive privacy statutes are enforced by regulators, with one exception: California's private right of action for breaches of unencrypted personal information caused by a failure to maintain reasonable security, at $100 to $750 per consumer per incident. In a breach of four million records that arithmetic is the entire matter. Encryption is not merely a control — it is the statutory element that defeats the claim. And the privilege trap is real: a forensic report commissioned by IT and forwarded to counsel is usually discoverable; one commissioned by counsel and treated that way throughout usually is not.

Phase 12 — Governance, Training, and Change Control

  • [ ] Assign an accountable owner with authority over product decisions, not merely advisory input.
  • [ ] Install a privacy review gate in the product lifecycle, triggered by new data, new purpose, new vendor, or new automated decision.
  • [ ] Make the tag container a controlled environment: no marketing-team installs without review, and an inventory reconciled monthly.
  • [ ] Train by role: engineering on the inventory and signal handling, marketing on tags and choice architecture, support on rights intake, procurement on contract terms.
  • [ ] Maintain a legislative watch and calendar effective dates twelve months forward.
  • [ ] Re-run the applicability analysis quarterly and after any acquisition.
  • [ ] Include privacy in M&A diligence: what data comes with the target, under what notices and consents, with what vendor contracts, and with what pending claims.
  • [ ] Address data as an estate asset in insolvency planning — a promise never to sell may not bind a purchaser.
  • [ ] Audit the program annually against the phases above and record findings and remediation.
  • [ ] Retain evidence: network captures, screenshots, consent records, assessments, contracts, and rights metrics, with dates.
  • [ ] Report to the board or its equivalent at least annually, with metrics rather than adjectives.

Why it matters, and the traps. Programs decay at the speed of product releases. The control that most reliably keeps a program true is not the annual audit; it is the review gate that catches the new SDK, the new vendor, or the new model at the moment somebody proposes it. Companies that build the program once and audit it yearly discover, at the audit, that the state of the world changed eleven months earlier. The second trap is acquisition: the target's data arrives with the target's consents, notices, and defects, and the acquirer inherits all three.

Worked Example

Meridian Larder, Inc. (fictional), a direct-to-consumer grocery and meal-kit retailer, 4.2 million households, all fifty states, $860 million in annual revenue. Vendors include Vantage Reach, LLC (fictional) for advertising measurement, Tessellate (fictional) for site analytics and session replay, and a kiosk vendor providing face-based age estimation for alcohol sales. Northbeam Nutrition (fictional) is a coaching subsidiary. Calder Financial (fictional) issues the co-branded card.

Phase 1. Applicability confirmed in every comprehensive-law state. Employee and B2B data in scope in California. Northbeam is not a HIPAA covered entity, so the health exemption is unavailable and Washington's consumer health statute applies to its coaching data. The kiosk triggers the Illinois biometric statute. Counsel documents all of it in a nine-page memo.

Phase 2. The tag container holds 41 third-party tags. The vendor list from procurement holds 17. Twenty-four tags were installed by marketing over four years without review. Two server-side conversion integrations transmit hashed email and purchase value directly from Meridian's servers, invisible to any browser-based audit.

Phase 3. The recommendation engine produces a "glycemic-conscious" propensity score — classified as inferred health data, and therefore sensitive in most states and consumer health data in Washington. The mobile app collects precise geolocation by default through an SDK nobody chose; it is removed. The kiosk vendor's documentation confirms it computes face geometry locally and discards it after 400 milliseconds. Counsel concludes that is collection.

Phase 5. The kiosk is taken offline for eleven days. It returns with a pre-scan screen displaying the statutorily required disclosures, an electronic written release, and a published retention schedule stating that no template is retained beyond the transaction. The alternative path — show an ID to an associate — is given equal prominence.

Phase 6. With the Global Privacy Control enabled, the network capture shows 6 of 41 tags suppressed. The consent platform recorded the signal correctly; the flag was never read by the tag manager, and neither server-side integration consulted it at all. Remediation takes five weeks. A post-deploy network capture becomes a blocking check in the release pipeline.

Phase 8. Of 41 recipients, 12 have no data protection agreement and 9 have agreements predating the applicable statute. Vantage Reach's contract permits it to "use Client Data to improve Vantage services" — which makes it a third party, and every transmission to it a sale in every state using the valuable-consideration definition. Meridian renegotiates; Vantage refuses the combination prohibition; Meridian moves the measurement work and adds an opt-out link it had not previously needed. Tessellate's session-replay product is disabled on all pages until prior consent is implemented, after counsel scores the wiretap exposure.

Phase 10. Six assessments are completed: targeted advertising, the propensity model, the kiosk, loyalty analytics, the Northbeam coaching program, and the card partnership with Calder. The propensity model assessment identifies a residual risk that health inferences reach advertising partners; the mitigation is a hard exclusion of the score and all derived segments from any outbound flow.

The mistake. Nobody audited the customer service voice recordings, which had been analyzed by a sentiment tool since 2022. Voiceprint analysis in a call center is a biometric question, and the tool's documentation was ambiguous. It surfaced eight months later during acquisition diligence, cost $340,000 to investigate and remediate, and reduced the purchase price by more than that.

The outcome. A state attorney general inquiry arrives fourteen months in, asking for the targeted-advertising assessment, the vendor contract list, and evidence of signal recognition. Meridian produces all three, dated before the inquiry. The matter closes with no action.

What made it work: reconciling the inventory against the tag container instead of trusting the vendor list, treating the server-side integrations as part of the opt-out stack, classifying an inference as sensitive data before a regulator did, reading the kiosk vendor's technical documentation instead of its marketing page, and generating dated evidence of testing as a routine byproduct of deployment rather than as a response to a demand.

Related Documents

Articles

Guides

Checklists

Toolkits