Map the data before you choose the vendor.

A claim, a packet, and a legal conclusion are different things

The useful distinction in the imported privacy research is between observable technical behaviour, contractual promises, and a legal interpretation of both. A product can promise limited processing while its default configuration calls other parties. A network trace can show a request without establishing the recipient’s full retention or reuse practice.

Keep these evidence types in separate fields. Record the observed component and version, the relevant contract clause, the unresolved question, and who can answer it. “Yes, by default” is not an adequate explanation of a setting.

Two data paths to put on paper

For a direct contextual placement, map the page request, ad decision, creative delivery, any impression beacon, optional frequency control, click redirect, landing page, and aggregate report. A simple placement can acquire third parties through externally hosted creative or an advertiser-supplied pixel.

For a programmatic path, add the consent manager, wrapper, identity components, supply-side partners, demand-side recipients, ad server, creative hosts, measurement services, and synchronisation calls. Document which requests happen before a choice, after rejection, after acceptance, and after withdrawal. These are templates to inspect, not a statement that every vendor behaves identically.

“Cookieless” does not settle the question

EDPB guidance examines the technical scope of device access beyond traditional cookies, including pixels and tracking techniques. ICO guidance likewise addresses storage/access technologies and their purposes. Removing one cookie does not establish what every component reads or where the information goes.

Use a narrow statement you can substantiate, such as describing the exact information used to select a specific ad. Avoid an undefined “privacy-safe” badge or a blanket consent-free promise. Separate serving the page, choosing an ad, capping exposure, measuring delivery, and linking activity across visits.

Source notes: EDPB Guidelines 2/2023: Technical scope of Article 5(3) · ICO: Guidance on storage and access technologies · ICO: How do the rules apply to online advertising?

Ask for evidence that survives a configuration change

The research questionnaire covers identity, roles, technical behaviour, data handling, youth and sensitive contexts, supply-chain quality, and marketing claims. Use those families to assign an owner and an unanswered-question log. The following is a reusable review checklist, not an invitation to contact vendors automatically.

• Which legal entities process information, for which purposes, and under which claimed roles?
• Which cookies, browser keys, endpoints, identity techniques, and fourth parties are used?
• What happens with absent, malformed, rejected, or withdrawn consent and relevant opt-out signals?
• Can query strings or sensitive page context be removed before transmission?
• What are the retention, deletion, access, transfer, and subprocessor terms?
• Which per-page youth or sensitive-context controls propagate downstream?
• How can a creative, advertiser, or demand partner be blocked, and how is propagation tested?
• What evidence supports claims about anonymity, consent, or privacy, and what audit rights exist?

Make the acceptance test match the promise

Use a clean browser profile and capture the normal and failure paths. Compare the observed endpoints with the inventory rather than only the consent-manager vendor list. Repeat after a material release, a new partner, or a purpose change.

Treat contractual review and technical testing as complementary. Retain evidence safely with a defined deletion schedule; an ad-operations investigation should not become an unbounded store of reader data. The implementation and review work remains to be done for any live service.