Interview objective: Connect contractual data descriptions with observable browser behaviour.
Put this to: Michelle W. Cohen, the supplier’s privacy lead and the publisher’s engineer.
Why it matters to buyers: California’s privacy regulator explains that covered businesses must honour qualifying opt-out preference signals, such as Global Privacy Control, as requests to opt out of sale or sharing. This does not mean every publisher or every network request is covered; applicability and the nature of the processing require assessment. (cppa.ca.gov)
Draft framing — a good answer should cover:
- A data-flow map identifying recipients, purposes, identifiers and retention.
- Applicable roles and contractual restrictions for each party.
- Behaviour before interaction, after launch and under relevant privacy choices.
- Whether optional analytics and advertising can be disabled independently of gameplay.
- How opt-out or consent choices are transmitted, tested and recorded.
- What happens when the supplier changes a tracker, recipient or purpose.
Sharp follow-up: “Show us the difference in network behaviour with the relevant privacy choice active. Which remaining requests are necessary, and who has assessed that?”
Buyer output: A counsel-reviewed data inventory and an engineering test record.
Do not accept either “it is inside an iframe, so it is not our problem” or “a consent banner solves it” as a completed assessment. Request the specific responsibilities and technical controls for this implementation.
Expert quote — awaiting interview: [Approved quotation and attribution.]