Marketing Privacy Compliance Checklist: Notices, Consent, Vendors, and Rights Requests

By Casey Scott McKay · 2023-10-15

Sixteen phases for the privacy work a consumer brand's marketing stack actually generates, ordered by risk reduction per dollar rather than by statute. Phase one is a three-pass tag inventory including a network capture, because the tag manager tells you what marketing thinks is running and the capture tells you what is running. Early phases handle the four fixes that remove most litigation exposure in six weeks - session replay, consent gating, URL restructuring, and sensitive-page tag suppression. Later phases build the sale-and-share analysis, the recipient register, the contract terms that follow from it, the notice set including the financial incentive notice, the rights request workflow with verification and appeals, the marketing-channel consent records that decide TCPA cases, retention automation, and assessments. The last phase installs tag change control, which is what keeps the whole thing from decaying. One invented matter, Fernvale Wellness, runs throughout.

IP and Technology > Privacy Data Security | Checklist | Published 15 October 2023 - Updated 26 September 2025 | Casey Scott McKay - marksy.us

Summary. Sixteen phases for the privacy work a consumer brand's marketing stack actually generates, ordered by risk reduction per dollar rather than by statute. Phase one is a three-pass tag inventory including a network capture, because the tag manager tells you what marketing thinks is running and the capture tells you what is running. Early phases handle the four fixes that remove most litigation exposure in six weeks — session replay, consent gating, URL restructuring, and sensitive-page tag suppression. Later phases build the sale-and-share analysis, the recipient register, the contract terms that follow from it, the notice set including the financial incentive notice, the rights request workflow with verification and appeals, the marketing-channel consent records that decide TCPA cases, retention automation, and assessments. The last phase installs tag change control, which is what keeps the whole thing from decaying. One invented matter, Fernvale Wellness, runs throughout.

Keywords: tag inventory · network capture audit · url sensitivity review · session replay removal · consent gating · global privacy control · sale and share analysis · service provider recategorization · processor contract terms · privacy notice rewrite · just-in-time notice · financial incentive notice · rights request workflow · verification and appeals · tcpa consent record · can-spam opt-out testing · coppa assessment · biometric consent · retention automation · tag change control

What this checklist is for

This is the working document for the privacy obligations a marketing stack creates. It does not re-teach the law. If you cannot say in one sentence why a supplement company can be sued under the Video Privacy Protection Act, read The Data Behind the Marketing first. The reasoning behind each box — why the network capture beats the tag manager export, why URLs are legal artifacts, why the sale-and-share analysis precedes the contracts — is in Building a Privacy Compliance Program for a Consumer Brand. This document tells you what to do, in order.

Who should use it. In-house counsel at a consumer brand with no privacy engineer; outside counsel scoping a remediation; a general counsel who has just received a demand letter about a pixel; and anyone who has been told the company is "CCPA compliant" and wants to verify it.

What you'll need before you start. Administrative access to the tag manager; a browser with developer tools; the mobile app dependency manifests; the vendor contract file; the current privacy notice with its version history; the SMS and email platform consent exports; the loyalty program terms; and engineering time, because roughly half of this is engineering work.

The worked matter. Fernvale Wellness — direct-to-consumer supplements and at-home diagnostic kits, $70 million revenue, a video content library, a product-recommendation quiz, a loyalty program, an SMS program, and aggressive retargeting. The audit finds 31 production tags of which marketing can identify 19; a conversion pixel firing on /quiz/results/thyroid-support; site-wide session replay including checkout; a consent banner that loads after the tags; a 2021 privacy notice that omits three vendors; no Global Privacy Control; SMS consent records with no disclosure text; and three vendor contracts with no processor terms.

| Phase | What you accomplish | Typical elapsed time | |---|---|---| | 1 | Three-pass tag inventory | 2-4 weeks | | 2 | The week-one emergency fixes | 1 week | | 3 | URL sensitivity review and restructuring | 3-6 weeks | | 4 | Consent architecture that gates | 1-2 weeks | | 5 | Universal opt-out signals | 1 week | | 6 | Sale-and-share analysis and recipient register | 4-8 weeks | | 7 | Vendor contract remediation | 6-12 weeks | | 8 | Notice rewrite and just-in-time notices | 4 weeks | | 9 | Financial incentive notice | 1 week | | 10 | Rights request workflow | 8 weeks | | 11 | Marketing channel consent records | 4 weeks | | 12 | Special categories: children, biometrics, health, video | 3-6 weeks | | 13 | Retention, deletion, and de-identification | 8 weeks | | 14 | Data protection assessments | 4 weeks | | 15 | Incident playbook | 2 weeks | | 16 | Tag change control and quarterly audit | ongoing |

Phase 1 — Three-pass tag inventory

[ ] Pass one, tag manager export. Every container, tag, trigger, and variable, with creator and date.
[ ] Pass two, network capture. Load each distinct page type in a clean browser with developer tools recording: home, category, product, article, video, quiz, cart, checkout, account, confirmation. Record every third-party domain, the payload, and whether it fired before any consent interaction.
- Why both passes. The tag manager tells you what marketing thinks is running. The capture tells you what is running, and it will be longer.
[ ] Pass three, mobile SDKs. Export the dependency manifest for each app build; capture app traffic on a proxy for a representative session.
[ ] Record per tag: vendor; purpose; pages; data elements transmitted; whether it fires before consent; contract and category; whether the vendor may use data for its own purposes; internal owner.
[ ] Note whether any tag fires on checkout or on any page where payment or credential fields appear.

Phase 2 — The week-one emergency fixes

[ ] Remove session replay from checkout and from every sensitive page.
- Why. It is the highest-risk tool in a typical stack, it is enabled site-wide by default, and it supports interception claims under Cal. Penal Code §§ 630-638 and the federal Wiretap Act.
[ ] Suppress all non-essential tags on health-adjacent, financial, and children's pages.
[ ] Suppress third-party tags on video pages, or accept the 18 U.S.C. § 2710 analysis at $2,500 per violation.
[ ] Stop non-essential tags from firing before consent.
- Trap. Consent obtained after tracking began does not authorize what already happened. Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022).
[ ] Document each fix with a date. In the litigation that follows a configuration problem, "we found it and fixed it" is a defense that requires a record.

Phase 3 — URL sensitivity review and restructuring

[ ] Enumerate every URL pattern the site generates, including query parameters and fragments.
[ ] Flag any pattern encoding a health condition, diagnosis, medication, financial status, religious or political affiliation, sexual orientation, immigration status, precise location, or video title.
[ ] Restructure flagged patterns to opaque identifiers, with descriptive content in the page body rather than the path.
[ ] Strip identifying query parameters before they reach analytics, or configure URL redaction in the tag manager.
[ ] Repeat for mobile app screen names and event names.
- Why this phase earns its place. Every tag on a page receives the page URL regardless of configuration. This is a one-sprint engineering task with an outsized effect on the largest exposures, and it never appears on a privacy work plan.

Phase 4 — Consent architecture that gates

[ ] Block non-essential tags by default until a consent signal exists, in the tag manager or by not loading vendor scripts at all.
[ ] Classify every tag as strictly necessary, functional, analytics, or advertising, and map each class to a consent state.
[ ] Record the consent event: timestamp, banner version, the exact text displayed, the choices made, and a durable identifier.
- Trap. A consent you cannot reconstruct is a consent you cannot prove.
[ ] Honor withdrawal immediately, and propagate the signal to vendors that accept one.
[ ] Eliminate dark patterns: equal prominence for accept and reject; no pre-checked boxes for non-essential purposes; no multi-click reject against one-click accept.
- Why. Several statutes provide that consent obtained through a dark pattern is not consent, and the FTC treats the design itself as deceptive under 15 U.S.C. § 45.
[ ] Where EU or UK users are in scope, meet the prior-consent and GDPR standards, and run one global architecture rather than two.

Phase 5 — Universal opt-out signals

[ ] Implement recognition of Global Privacy Control at page load, as an opt-out of sale, share, and targeted advertising.
[ ] Verify it works from outside the company, in a clean browser, the way a regulator or plaintiff would test it.
[ ] Apply the signal to the authenticated user's profile where one exists, not only to the browser session.
[ ] Document the implementation and the test.
- Why. Several statutes require it, it is a technical obligation rather than a policy statement, and it is trivially testable from outside. Colo. Rev. Stat. § 6-1-1301; Cal. Civ. Code §§ 1798.100-1798.199.100.

Phase 6 — Sale-and-share analysis and recipient register

[ ] For each recipient, answer six questions: what does the contract permit; what do the vendor's published terms say; does it combine your data with other clients' data; does it use the data to improve its own models, products, or audiences; does it retain data after termination; and what does the tag configuration actually send, into what?
[ ] Classify each as service provider / processor / contractor or third party.
- Why it decides everything. Disclosure to a third party is generally a sale or share, triggering opt-out rights, notice obligations, and consent requirements for sensitive data. Cal. Civ. Code § 1798.140.
- Trap. The label in the contract does not control. Most brands have miscategorized at least one advertising platform whose integration contributes event data into shared audience systems.
[ ] Build the recipient register: vendor, category, contract, data received, legal basis, owner.
- Why you will need it later. Phase 10's downstream deletion obligation is impossible without it.

Phase 7 — Vendor contract remediation

[ ] For processors, require: purpose limitation to specified business purposes; no selling or sharing; no retaining, using, or disclosing outside the direct business relationship; no combining with other sources except as permitted; assistance with rights requests and assessments; audit or certification rights; security obligations; breach notification with a firm deadline; deletion or return at termination; and flow-down to subprocessors with an approved list.
[ ] For third parties, confirm the opt-out mechanism, the notice disclosure, and the downstream obligation to honor opt-out signals.
[ ] For international transfers, address the transfer mechanism separately from the commercial terms.
[ ] Sequence correctly.
- Trap. A processor agreement negotiated before Phase 6 will describe a relationship that does not match the tag configuration, and you will negotiate it twice.

Phase 8 — Notice rewrite and just-in-time notices

[ ] Rewrite only after Phases 1 and 6.
- Why. A notice written before the inventory is a more precise description of something unverified.
[ ] Include: categories collected and sources; business and commercial purposes; categories disclosed and recipient categories; whether information is sold or shared and to whom; sensitive data and purposes; retention periods or criteria; rights and how to exercise them including the appeal path; and contact information.
[ ] Use the statutory category names, because regulators read for them.
[ ] Place just-in-time notices where collection happens: before the first sensitive quiz question; at SMS signup with the disclosure captured into the consent record; at loyalty signup; at any camera, microphone, or biometric feature; and at account creation where profile data serves purposes beyond the account.
[ ] Archive every version with effective dates and a screenshot of how it rendered.
- Why. In litigation the question is what a consumer saw on a particular day, and the current version answers a question nobody asked.

Phase 9 — Financial incentive notice

[ ] Identify every financial incentive: loyalty program, discount for a mailing-list signup, a percentage off for completing a quiz.
[ ] Draft the notice: a summary of the incentive, material terms, how to opt in, how to withdraw at any time, and a good-faith estimate of the value of the consumer's data with the calculation method.
[ ] Document the methodology — incremental margin of program members over non-members, or the marginal cost of acquiring an equivalent customer through paid channels — with a date, and review it annually.
- Trap. Nobody enjoys writing the estimate, and leaving the field blank is the one option that is clearly wrong.

Phase 10 — Rights request workflow

[ ] Intake: at least two methods including a web form, a toll-free number where required, an authorized-agent path, and a route for requests arriving at the address customers actually use.
[ ] Verification proportional to sensitivity; collect no new personal information beyond what is necessary and use it for nothing else.
[ ] Fulfillment processes per right — access, deletion, correction, portability, opt-out of sale or share, opt-out of targeted advertising, limit use of sensitive data — with the systems each touches listed.
[ ] Downstream propagation: direct service providers and contractors to delete; notify third parties that received the information.
- Trap. This is the step most programs cannot perform. Phase 6 produced the recipient register; use it.
[ ] Deadlines and extensions calendared per statute, with the extension notice pre-drafted.
[ ] Appeals with a distinct reviewer, a response deadline, and the statutorily required referral information on denial. Conn. Gen. Stat. § 42-515; Va. Code § 59.1-575.
[ ] A log of every request, category, dates, outcome, and verification performed.
- Why. Regulators ask for this log first.

Phase 11 — Marketing channel consent records

[ ] SMS and calls. For every number, be able to produce: date and time of consent; mechanism; the exact disclosure text displayed at that moment; IP address or device; checkbox state; and opt-out history.
- Why. 47 U.S.C. § 227 and 47 C.F.R. § 64.1200 provide $500 per violation, trebled for willful violations, with a private right of action and no cap. The consent record is the entire defense, and most programs store a number and a timestamp.
- Note. Facebook, Inc. v. Duguid, 592 U.S. 395 (2021) narrowed the autodialer definition, but the prerecorded-voice provision, do-not-call rules, and state mini-TCPA statutes remain.
[ ] Email. Verify accurate headers and subject lines, advertisement identification, a valid physical postal address, a working opt-out, and opt-outs honored within ten business days. 15 U.S.C. § 7704; 16 C.F.R. Part 316.
- Test the opt-out quarterly. It is the requirement that silently breaks.
[ ] Telemarketing. Do-not-call scrubbing, disclosures, and record-keeping. 16 C.F.R. Part 310.
[ ] Subscriptions. Confirm the cancellation path is no harder than the signup path. 16 C.F.R. Part 425.

Phase 12 — Special categories

[ ] Children. Assess whether any property is directed to children under 13 using the Rule's factors — subject matter, visual content, animated characters, music, model age, celebrity appeal, advertising placement, audience evidence. Where it is, or where there is actual knowledge, implement direct parental notice and verifiable parental consent, and remove third-party tags collecting persistent identifiers. 15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312.
[ ] Teens. Apply opt-in consent for targeted advertising and restrictions on sale for minors under 16 or 18 where state law requires, and treat teen data as sensitive by policy.
[ ] Biometrics. Written policy with a retention schedule, informed written consent before collection, and no sale. 740 ILCS 14; Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (Ill. 2019); Cothron v. White Castle System, Inc., 216 N.E.3d 918 (Ill. 2023); Tex. Bus. & Com. Code § 503.001.
- Where to look. Virtual try-on tools, in-store cameras, voice analysis in customer service, and biometric employee time clocks — the last of which is how most defendants arrived in this litigation.
[ ] Health-adjacent data. Separate consent for collection and separate authorization for sale. Wash. Rev. Code ch. 19.373; 16 C.F.R. Part 318.
[ ] Video. Suppress third-party tags on video pages, or obtain standalone, informed, written consent meeting the statute's specific requirements — which a cookie banner does not. 18 U.S.C. § 2710.
[ ] Employment data. Several statutes cover employees and applicants on the same terms as consumers. Check applicant tracking, background screening under the Fair Credit Reporting Act, and biometric time clocks.

Phase 13 — Retention, deletion, and de-identification

[ ] Write a retention schedule with actual periods per category, enforced by automated deletion.
- Trap. A retention policy with no automated enforcement describes an intention, and regulators read it as one.
[ ] Enumerate the copies: data warehouse, customer data platform, email service provider, uploaded advertising audiences, backups, analytics exports on laptops, support ticketing, vendor systems, and any acquired company's stack.
[ ] Test a deletion request end to end and record which systems were missed.
[ ] Apply de-identification only where the standard is met: not reasonably linkable to an individual, reasonable measures against reidentification, a public commitment to maintain de-identified form, and contractual obligations on recipients.
- Trap. A hashed email address does not qualify. A hash is a stable identifier that matches across systems, which is precisely why advertising platforms accept it.

Phase 14 — Data protection assessments

[ ] Identify processing requiring an assessment: targeted advertising, sale, sensitive data, and profiling with significant effects.
[ ] For each, document: the processing concretely; the purposes; the categories of data and data subjects; benefits to the business, consumer, and public; risks to consumers; safeguards; residual risk and why it is justified; the decision and who made it; and the date.
[ ] Do them for the real things: retargeting, the quiz, the loyalty program, any biometric processing, precise location, and any profiling affecting pricing or access.
[ ] Keep them, because several statutes require production on request and an assessment written after the request arrives is worth less.

Phase 15 — Incident playbook

[ ] Name an incident lead, a legal lead, and a communications lead, with alternates and after-hours contacts.
[ ] Engage outside counsel and a forensic firm in advance, so privilege is established before an investigation starts.
[ ] Build a notification decision tree with state-by-state thresholds and deadlines mapped.
[ ] Pre-draft notice templates for consumers, regulators, and credit bureaus.
[ ] Write a preservation protocol: logs, tag configurations, consent records, and vendor communications preserved on discovery.
[ ] Require dated documentation of remediation as it happens.
[ ] Run a tabletop once a year with the actual people.
[ ] Distinguish the three incident types: a security incident triggering state breach statutes and possibly 16 C.F.R. Part 318; a vendor incident, where obligations still run to your consumers; and a configuration incident, which is usually not a statutory breach and is the fact pattern that produces the class action.
- Trap. The instinct on finding a misconfigured tag is to remove it quietly. Preserve the configuration history first and document the discovery and fix.

Phase 16 — Tag change control and quarterly audit

[ ] No new tag, SDK, or pixel reaches production without privacy review.
[ ] Separate configuration from publication: marketing builds, a named owner approves what goes live.
[ ] Every review answers five questions: what does it send, on which pages, to whom, under what contract, and does it fire before consent.
[ ] Run a quarterly network-capture audit verifying production against the register.
[ ] Add a procurement gate: no vendor receiving personal information is onboarded without a privacy review.
[ ] Attach data-map maintenance to the quarterly audit rather than creating a separate process.
[ ] Deliver a fifteen-minute training to marketing and engineering covering five things: what a pixel sends, why URLs matter, what the consent banner is supposed to do, which pages are sensitive, and who to call before adding a tag.
- Why this phase matters most. Without it, the stack drifts back within eighteen months, one reasonable decision at a time.

Phase 6A — The other doors data comes in through

Pixels get the attention. Most of a brand's data arrives through channels the marketing team designed as engagement, and each carries its own obligations.

[ ] The loyalty program. It is a data-collection program with a discount attached. Confirm the financial incentive notice (Phase 9), the opt-in, the withdrawal path, and the documented value estimate.
[ ] The quiz and the product recommender. These collect inferences, and inference data is personal information under every comprehensive statute. Where the inferences concern health, mental health, sexual orientation, religious belief, or precise location, they are sensitive data requiring opt-in consent or a limited-use commitment.
- Where to look. A skincare quiz asking about pregnancy. A supplement quiz asking about a diagnosis. A fitness quiz asking about an injury.
[ ] Mobile SDKs. The least-audited component of most stacks and the most permissive. Many collect device identifiers, location, installed-app lists, and network information by default, on a schedule the brand does not control. Inventory them the way you inventory web tags and read what each may do with the data for its own purposes.
[ ] Precise geolocation. Sensitive in nearly every statute. A store locator does not need to retain it and does not need to transmit it to advertising partners; do neither.
[ ] Customer service transcripts and call recordings. Recorded calls implicate two-party consent statutes; chat transcripts processed by a third-party vendor implicate the same interception theories as session replay. Both routinely contain sensitive information volunteered by the customer and retained indefinitely in a system nobody classified.
[ ] User-generated content and reviews. Photographs submitted by customers may contain faces, which raises the biometric analysis if any tool processes them, and the identity analysis if the brand republishes them in advertising. See Clearing and Licensing Name, Image, and Likeness.
[ ] Offline and in-store collection. Point-of-sale email capture, Wi-Fi analytics, in-store cameras, and loyalty card scans. These are outside the website audit entirely and they are frequently outside the privacy notice too.
[ ] Acquired data. Lists purchased or received from partners. Confirm the source had the right to provide it, that the intended use is within the notice the individual received, and that the contract permits it. A purchased list is the fastest route to a 47 U.S.C. § 227 problem, because you cannot produce the consent record for a number you did not collect.

Phase 16A — The quarterly and annual calendar

Everything above decays on a predictable schedule. Put the maintenance on a calendar owned by a named person and it survives; leave it to judgment and it does not.

Quarterly.

[ ] Network-capture audit of every page type, reconciled against the tag register.
[ ] Test the email opt-out mechanism end to end.
[ ] Test Global Privacy Control recognition from a clean browser.
[ ] Review the rights request log for missed deadlines and appeal outcomes.
[ ] Review new vendors onboarded since the last audit against the procurement gate.
[ ] Spot-check five SMS consent records for completeness, including the disclosure text.

Annually.

[ ] Refresh the data map and the recipient register.
[ ] Refresh the data protection assessments, and add any new high-risk processing.
[ ] Review the retention schedule against actual system behavior — not the policy, the systems.
[ ] Re-verify the privacy notice against the current stack, and archive the prior version.
[ ] Update the financial incentive value estimate.
[ ] Run the incident tabletop.
[ ] Deliver the fifteen-minute training to marketing and engineering, including new hires.
[ ] Review the statutory landscape for newly effective state laws and adjust the notice, rights workflow, and universal opt-out handling.

On every material change.

[ ] A new marketing channel, a new app, a new market, a new acquisition, or a new category of data triggers a fresh assessment rather than an assumption that the existing program covers it.
[ ] An acquisition in particular: the acquired company's stack becomes yours, including its tags, its consent records, its retention gaps, and its liabilities. Run Phases 1 through 3 on it before integrating anything. See IP Due Diligence Toolkit.
[ ] Budget the program as an annual number rather than a series of projects. A credible first-year build for a mid-size consumer brand runs $200,000 to $500,000 including engineering, then $80,000 to $200,000 a year. Present it in two tranches: weeks 1-6 (session replay, consent gating, the inventory, the URLs) is roughly a quarter of the spend and removes the majority of the private-litigation exposure; everything after reduces regulatory risk. Boards approve the first tranche readily when it is framed that way.

Key Authorities at a Glance

| Authority | What it provides | Phase | |---|---|---| | 15 U.S.C. § 45 | Deception, unfairness, dark patterns | 4 | | 18 U.S.C. § 2710 | Video Privacy Protection Act | 2, 12 | | 18 U.S.C. §§ 2510-2523 | Federal Wiretap Act | 2 | | Cal. Penal Code §§ 630-638 | CIPA | 2 | | Cal. Civ. Code §§ 1798.100-1798.199.100 | Rights, notices, contracts, opt-outs | 5-10 | | Cal. Civ. Code § 1798.140 | Sale and share definitions | 6 | | Colo. Rev. Stat. § 6-1-1301 | Universal opt-out | 5 | | Conn. Gen. Stat. § 42-515 | Appeals | 10 | | Va. Code § 59.1-575 | Rights and assessments | 10, 14 | | Tex. Bus. & Com. Code § 541.001 | Texas comprehensive statute | 8 | | Wash. Rev. Code ch. 19.373 | Consumer health data; private right of action | 12 | | 740 ILCS 14 | BIPA | 12 | | Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197 (Ill. 2019) | No actual injury required | 12 | | Cothron v. White Castle Sys., Inc., 216 N.E.3d 918 (Ill. 2023) | Per-scan accrual | 12 | | Tex. Bus. & Com. Code § 503.001 | Texas biometric statute | 12 | | 15 U.S.C. §§ 6501-6506 | COPPA | 12 | | 16 C.F.R. Part 312 | COPPA Rule | 12 | | 47 U.S.C. § 227 | TCPA | 11 | | 47 C.F.R. § 64.1200 | TCPA rules | 11 | | Facebook, Inc. v. Duguid, 592 U.S. 395 (2021) | Autodialer definition | 11 | | 15 U.S.C. § 7704 | CAN-SPAM | 11 | | 16 C.F.R. Part 316 | CAN-SPAM Rule | 11 | | 16 C.F.R. Part 310 | Telemarketing Sales Rule | 11 | | 16 C.F.R. Part 318 | Health Breach Notification Rule | 12, 15 | | 16 C.F.R. Part 425 | Negative option and cancellation | 11 | | 15 U.S.C. § 1681 | FCRA, background screening | 12 | | TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) | Concrete harm and standing | 1 | | Regulation (EU) 2016/679 | GDPR, where EU users are in scope | 4 |

The five things people get wrong

Trusting the tag manager export. It lists what marketing knows about. The network capture lists what is running, and the gap is where the exposure lives.

Writing the privacy notice first. A notice drafted before the inventory is a more precise description of something unverified, and an inaccurate notice is a deception problem on top of the underlying one.

Treating the banner as the fix. A banner that appears while the tags are already firing provides no defense and adds a second violation, because it tells the user something untrue.

Ignoring the URL. Every tag on a page receives the page path. A path that names a condition transmits that condition to every third party, regardless of what any tag was configured to send.

Skipping tag change control. Everything in this checklist decays without it, because each new tag is added by a reasonable person solving a reasonable problem.