A Practical Tracking Compliance Checklist
Not legal advice, but a working list of what to check so your tracking does not become a problem later.
This is not legal advice and I am not a lawyer. What follows is the practical checklist I work through on client setups, which covers the things that actually come up.
If your legal team has a position, theirs wins. This is for the very common situation where nobody has a position and everyone assumes somebody else handled it.
Start with an inventory
You cannot make a judgement about data you do not know you are collecting.
List every tag in your GTM container and what it sends.
List every script on the site that is not in GTM.
For each one, note what data it collects and where that data goes.
Note which are essential to the site working and which are analytics or advertising.
Most people find at least one thing they did not know was there. That is normal and it is the point of the exercise: how to audit a GTM container.
Consent
A consent mechanism exists and appears before non essential cookies are set.
Rejecting is as easy as accepting, with equally prominent controls.
Consent defaults are denied in jurisdictions that require it, and set by region rather than globally.
All four Consent Mode v2 signals are set: analytics_storage, ad_storage, ad_user_data, ad_personalization.
Consent choices are recorded, with a timestamp, in a form you could produce if asked.
Users can change their mind later through a visible control.
Your consent platform is on Google’s certified list if you advertise on Google in the EEA or UK.
Verify the second and third points yourself in a fresh browser profile. Do not take the vendor’s word for it.
What you are actually sending
This is where most real problems live, and they are nearly always accidental.
No email addresses, phone numbers or names in page URLs being sent to analytics.
No personal data in event parameters or custom dimensions.
Customer data sent for matching is hashed before it leaves the browser or server.
No form field values captured by auto event tracking.
Page titles do not contain customer names on account pages.
Referrer URLs are not carrying parameters from elsewhere.
If you have a server container, this is a good place to enforce it centrally rather than hoping every tag behaves: stripping sensitive data before it leaves your server.
Your policies say what you actually do
Frequently not the case, and it is the cheapest thing on this list to fix.
Your privacy policy names the categories of data you collect and who you share it with.
Your cookie declaration matches the cookies actually set. An automatic scanner keeps this honest.
If you upload customer lists to ad platforms, your policy says you share data with advertising partners.
If you use session recording, your policy says so, and sensitive fields are masked in the recordings.
That third point is the one that catches people using Customer Match without having updated anything: Customer Match setup.
Retention
GA4 data retention is set deliberately rather than left on the default.
Any raw event data you export has a retention policy and someone responsible for it.
You can delete an individual’s data if asked, and somebody knows how.
Backups and exports are included in whatever your retention policy says.
On the first point, most people should set this to fourteen months and almost nobody has: GA4 data retention settings.
Third parties
You have a data processing agreement with each vendor that processes personal data for you.
You know where each vendor stores data, particularly whether it leaves your region.
Ad platform data sharing settings have been reviewed rather than left at default.
You have removed vendors you no longer use, in the tool and in the contract.
The practical failure modes
In my experience, four things cause nearly all the real trouble.
Personal data in URLs reaching analytics, usually through a password reset or a search page.
Tags firing before consent because of a trigger misconfiguration.
A privacy policy written three years ago that does not mention the ad platforms you now use.
A script somebody added directly to the site, outside GTM, that nobody has looked at since.
None of these are complicated. They are all things that happen when nobody has ownership.
Make it a habit
A compliance check is not a project you finish. Sites change, tools get added, regulations move.
A quarterly review of the inventory and this list takes an hour and keeps the gap small. An annual review means the gap has a year to grow.
When to get actual advice
Talk to a lawyer if you handle health, financial or children’s data, if you operate across several jurisdictions with different rules, if you are doing anything unusual with data sharing, or if somebody has complained.
For a normal business running normal advertising, this checklist plus a reasonable consent tool covers the practical ground. The gap between that and where most sites currently are is large enough to be worth closing first.
Need this built properly?
Most compliance problems in tracking are accidents nobody has looked for. I set up and repair tracking for ecommerce stores and lead generation businesses, so the numbers in your ad accounts match the money in your bank account.
Have a look at what I do, or book a call and we can go through your setup together.
