CRA TraceView — Methodology
How we test whether privacy choices are honored.
CRA TraceView, a Charles River Associates practice, tests whether the tracking technologies on a website behave the way its privacy choices say they should. Each review runs the site through a matrix of consent states, privacy signals, jurisdictions, and page types; captures evidence across seven layers, from network traffic to server-side systems; and records every finding with its context, evidence, the consent state in effect at that moment, its impact, and a verifiable fix.
Last reviewed · Not legal advice
01 — Findings
What every finding establishes
A defensible finding answers seven questions. If any one is missing, the finding is incomplete.
- 01
Collection context
Under what conditions it was observed: time, property, page, browser, jurisdiction profile, privacy signals, and entry path.
- 02
Observation
What happened, stated as fact.
- 03
Evidence and provenance
How we know: the request, cookie, configuration, or line of code, tied to its source artifact.
- 04
Consent state at event time
What the visitor had chosen at that exact moment, and when that choice last changed.
- 05
Impact
Why it matters, to whom, and which legal or self-regulatory framework it touches.
- 06
Severity, scope, and confidence
How serious it is, how widespread, and how certain.
- 07
Remediation and verification
The specific fix, the system and team that own it, and the test that confirms it worked.
02 — Test matrix
The test matrix
A single browsing session proves little. Each site is tested under a matrix of conditions, because most failures appear only under specific combinations of consent state, signal, jurisdiction, and page.
| Consent state | How it is produced | What it answers |
|---|---|---|
| No interaction | Load the page and never touch the banner | What fires before any choice? Do defaults match the jurisdiction? |
| Accept all | Accept in the banner | The baseline inventory of everything the site can do |
| Reject all | Reject in the banner | What still fires? Anything beyond strictly necessary is a candidate finding. |
| Granular | Toggle individual categories | Does each category actually gate the vendors mapped to it? |
| Opt-out of sale/share | "Do Not Sell or Share" link or preference center | Is the US-model opt-out honored at runtime and downstream? |
| Withdrawal mid-session | Accept, browse, then opt out | Are earlier identifiers cleared? Do tags stop? |
| Return visit | Revisit after a choice, cookies intact | Does the choice persist without a silent reset? |
| Choice + login | Opt out anonymously, then sign in | Does the choice follow the visitor to the account? |
Privacy signals
Global Privacy Control (the Sec-GPC request header and navigator.globalPrivacyControl) is tested on, off, and in conflict with banner choices. Do Not Track is recorded as informational. Browser tracking protections — Safari ITP, Firefox ETP, Chrome third-party cookie settings — are recorded because they change what is observable.
Jurisdiction profiles
At minimum California, another US state with a universal opt-out requirement such as Colorado, a US state without a comprehensive privacy law, the EU/EEA, and the UK — confirming the consent platform shows the right banner, defaults, and signal format for each.
Page classes
Home and marketing, search results, product and content detail (including video), cart and checkout, forms, authenticated account pages, sensitive-topic pages, and error or redirect pages, which often bypass the consent template.
Entry paths
Direct, organic, and paid-click entries carrying click IDs (gclid, fbclid, msclkid, ttclid), email links with tracking parameters, and anonymous versus signed-in sessions.
03 — Evidence layers
Seven evidence layers
A consent platform only makes a signal available; every downstream system must read it and act on it. Evidence is collected from each layer so a failure can be attributed to the system where it occurred.
| Layer | What we capture | What we check | Common failure |
|---|---|---|---|
| Network traffic | A full HTTP archive per session: headers, payloads, timing, and the script that initiated each request | Every third-party destination by vendor and purpose; request timing relative to consent; personal data and identifiers in payloads and URLs; CNAME-cloaked and proxied endpoints | A tag fires before the consent platform loads, or ignores a rejected category |
| Tag management | Container exports per version, publish history, and runtime firing traces | Per-tag consent settings; consent defaults set before the first trigger; custom HTML reviewed line by line; version diffs that date when a failure began | A tag configured with no consent requirement sends advertising data |
| Consent platform and signal formats | Banner captures per jurisdiction, platform configuration, category-to-vendor map, consent receipts, and decoded signal strings at each change | Reject as easy as accept; correct defaults; accurate category mapping; IAB TCF v2.2, IAB GPP, legacy USP, and Google Consent Mode v2 values; retrievable receipts | The signal is correct at the source but ignored downstream |
| Browser storage | Cookies, local and session storage, and IndexedDB at each state change, with the script that wrote each entry | Entries set before consent or after rejection; identifiers cleared on withdrawal; lifetimes against the cookie policy; identifiers still read after opt-out | An analytics client ID survives opt-out and keeps linking sessions |
| Browser privacy signals | GPC sessions compared against matched non-GPC sessions | GPC detected and applied where it is recognized; every vendor receives an opt-out or no data, client- and server-side; precedence when GPC and a banner choice conflict | The consent platform honors GPC but server-side conversion APIs do not |
| First-party source code | Delivered JavaScript bundles, inline scripts, and source maps where available, cited by file and line | Vendor pixels hard-coded outside the tag manager; personal data pushed to the data layer; consent platform loaded before vendor scripts; session-replay masking | A purchase handler calls a vendor directly, bypassing consent |
| Server-side and downstream | Configuration exports, server logs, and interviews | Conversion APIs, server-side containers, and customer data platforms enforcing consent; privacy signals in bid requests; opt-outs propagated to CRM and audience exports | Opted-out visitors' events are still forwarded from the server |
Browser observation cannot see everything. Server-side findings are labeled corroborated or inferred unless server traffic was captured, and every report states where visibility ends.
04 — Timing
Timing and causality
“Fired after opt-out” is a claim about order, so order is established explicitly. Consent changes, script loads, requests, and storage writes go on one UTC timeline with millisecond precision, and each flagged event records the consent state in effect at that instant.
Pre-choice firing
The tag fired before the visitor could make a choice.
Race
The tag fired in the window between a choice and its enforcement.
Non-enforcement
The tag ignored a consent state that was already set.
Persistence
An identifier set earlier keeps being read and sent.
Sessions are repeated to separate deterministic failures from intermittent races, and the reproduction rate is reported.
05 — Data
Data classification
Severity depends heavily on what was sent, so every data element in a flagged payload is classified.
| Tier | Examples | Why it matters |
|---|---|---|
| Sensitive | Health conditions, precise geolocation, financial account data, sexual orientation, children’s data, government IDs | Often triggers heightened consent or limitation rights; a sensitive-topic page URL can disclose it on its own |
| Direct identifiers | Name, email, phone, postal address — hashed values included | Hashing is pseudonymization, not anonymization; vendors match hashes |
| Persistent identifiers | Cookie IDs, device and advertising IDs, account IDs, click IDs | Enable cross-session and cross-site linking |
| Behavioral | Page views, searches, video views, cart contents, purchase value | Context determines sensitivity |
| Technical | User agent, screen size, language | Low on their own; combined, they support fingerprinting |
06 — Verdicts
Verdicts, severity, and confidence
Each finding carries a verdict, a severity, and a confidence level, so readers can tell what is proven from what is suspected.
| Verdict | Meaning |
|---|---|
| FLAG | Behavior contradicts the visitor's choice, a required signal, or the site's own disclosure |
| WARN | Partial compliance, inconsistent behavior, or a configuration that will fail under foreseeable conditions |
| OK | The control works as intended under the tested conditions — recorded, because passes narrow the cause of failures |
| INFO | Noteworthy but not a compliance question, such as inventory or version changes |
| NOT TESTED | In scope but not exercised — always stated, never left implicit |
What drives severity
- 01Data tier — sensitive data and direct identifiers weigh most
- 02Recipient — advertising platforms and data brokers outweigh analytics vendors and contracted service providers
- 03Consent posture — sent after an explicit opt-out outweighs before any choice, which outweighs ambiguous defaults
- 04Scope — the share of pages, templates, and sessions affected
- 05Persistence — a one-off event versus ongoing identifier linkage
- 06Duration — how long the behavior has been live, from container history and archived snapshots
- 07Regulatory sensitivity — pages or data subject to sector rules such as health, children, or video viewing
Confidence levels
- Observed
- Captured directly in traffic, storage, or code during a controlled session
- Corroborated
- Observed indirectly and confirmed by a second source, such as a configuration export or server log
- Inferred
- Reasoned from configuration or partial evidence; needs confirmation before it is relied on
07 — Frameworks
Frameworks we map findings to
Each finding is mapped to the legal and self-regulatory frameworks it plausibly touches. Whether a framework applies, and whether it was violated, are determinations for counsel.
| Framework | What we look for | Primary sources |
|---|---|---|
| CCPA / CPRA (California) | Sale or sharing after an opt-out; opt-out preference signals such as GPC; sensitive personal information limits; symmetrical choice design. Enforcement has focused on GPC and opt-out handling (Sephora, 2022; DoorDash, 2024) and choice design (Honda, 2025). | |
| Other US state privacy laws | Targeted-advertising and sale opt-outs, universal opt-out mechanisms where required, and sensitive-data consent — for example in Colorado, Connecticut, Texas, and Oregon. | |
| Washington My Health My Data Act | Consumer health data — including inferences from page visits — collected or shared without consent. | |
| California Invasion of Privacy Act | Third-party code capturing communications or routing and addressing information, as plaintiffs allege against pixels, chat widgets, and session replay. Timing relative to consent is central. | |
| Video Privacy Protection Act | A video page or title sent to a third party together with a persistent identifier. | |
| Health sector | Tracking on health-related pages, portals, and apps, and disclosure of health information to advertisers. HHS tracking guidance was partially vacated in AHA v. Becerra (2024); FTC actions include GoodRx and BetterHelp (2023). | |
| GDPR / ePrivacy and UK PECR | Prior consent for non-essential storage access and tracking; valid, granular, freely given consent; reject as easy as accept. | |
| Signal standards | Correct signal values at each state change, and vendor adherence to the purposes they declare. | |
| The site's own disclosures | Behavior inconsistent with the privacy policy, cookie policy, or banner text — itself a deception theory under FTC Act §5 and state consumer-protection law. | — |
08 — Evidence handling
Evidence handling
Findings may support remediation, regulator responses, privileged investigations, or expert testimony, so every engagement is held to the strictest of those standards.
Reproducibility
Browser build, profile state, geolocation method, and tool versions are documented well enough for an independent party to repeat the session.
Chain of custody
Raw artifacts — HTTP archives, screenshots, recordings, container exports — are stored immutably with hashes and capture timestamps.
Observation separate from interpretation
The evidence section records facts; the impact section interprets them.
Historical reconstruction
Container version history, archived page snapshots, and vendor change logs establish when a behavior began.
Limits stated
Every report says what was not tested, what is invisible from the browser, and known sources of error such as bot detection, A/B tests, and geo-targeting variance.
Privilege
Where an engagement is at counsel's direction, work product is labeled accordingly and drafts are routed through counsel.
09 — FAQ
Frequently asked questions
Short answers to the questions we hear most often.
- Does a consent management platform stop tags from firing?
- Not by itself. A consent management platform records the visitor's choice and makes it available as a signal. Tag managers, customer data platforms, advertising vendors, and first-party code must each read that signal and act on it, which is why every downstream system is tested.
- Can CRA TraceView see server-side data flows?
- Not directly from the browser. Conversion APIs, server-side tag containers, and customer data platforms are assessed from configuration exports, logs, and interviews, and those findings are labeled corroborated or inferred unless server traffic was captured.
- Can an engagement be privileged?
- Yes. Work can be conducted at the direction of counsel, with work product labeled and routed accordingly.
- How large can a review be?
- Engagements range from a single-domain review to analysis across a thousand-plus digital properties, as a point-in-time assessment, a historical investigation, or ongoing monitoring.