AdTech Privacy Compliance & Litigation

CRA experts validate whether consent and opt-out mechanisms work in practice, not just on paper, and fix gaps that surface. A consent management platform (CMP) records user privacy choices and signals them to other systems. It does not, by itself, stop tracking technologies from firing. How we can advise:

– Testing whether tracking stops before consent and after opt-out, including opt-out-of-sale requests and Global Privacy Control (GPC) browser signals.
– Confirming that privacy disclosures, consent records, and observed data flows agree with one another.
– Reconfiguring tag management, the CMP, and downstream integrations so that both front-end and back-end systems honor user choices.

Where data continues to flow to third parties after an individual opts out, we identify the point of failure and implement the fix.

CRA experts advise clients on using, sharing, and monetizing data assets while managing contractual and compliance risk, and supporting clients in disputes over data use rights. How we can advise:

– Developing data monetization strategies that align with privacy regulations and contractual obligations.
– Performing audits of data licensees’ adherence to data use agreements.
– Testifying as experts in data licensing and data use rights disputes.

We help clients turn data into value while keeping that use defensible under their contracts and the law.

CRA experts testify as independent experts in complex privacy and technology disputes. How we can advise:

– Providing written declarations and expert reports, and testimony at deposition, hearing, and trial.
– Explaining technical concepts and findings in terms relevant to legal audiences.
– Ground opinions in verifiable, reproducible technical facts.

Our testimony gives courts and counsel a clear, credible, and technical foundation for the issues in dispute.

CRA experts support both plaintiff and defense counsel in class actions, regulatory matters, and other disputes involving tracking technologies. How we can advise:

– Performing privileged forensic collection and analysis under the direction of counsel, across network traffic, tag management platforms, source code, and consent platforms.
– Assessing what data the trackers transmitted, to whom, under what conditions, and whether consent controls functioned effectively, both currently and historically.
– Developing expert reports and evidentiary analysis that link observed network behavior to the configurations and code that produced it.

We base every analysis on the real-world operation of tracking systems and employ methodologies that are reproducible and testable.

CRA TraceView is our hosted monitoring platform for AdTech governance. It continuously observes an organization’s websites and reconciles evidence from four sources: network traffic, tag management systems, source code, and consent management platforms – something a point-in-time scanner cannot do. How we can advise:

– Maintaining a real-time inventory of tracking technologies, validated across client-side execution, source code, and tag management platforms.
– Monitoring consent signal integrity end to end, including the Interactive Advertising Bureau (IAB) standardized consent strings known as the Global Privacy Platform (GPP) and the Transparency and Consent Framework (TCF), GPC signal propagation, opt-out suppression, and consent persistence.
– Alerting on personal data exposure and on unauthorized changes to tag manager containers, with review of historical configurations.
– Mapping upstream and downstream data flows and generating forensic reports for use in investigations and litigation.

CRA experts are available on call to investigate platform alerts with clients and advise on resolution.

CRA experts conduct forensic assessments of the tracking technologies deployed across an organization’s websites and mobile applications, providing organizations with a clear view into what their trackers do.

– Assembling an inventory of pixels, SDKs, cookies, and third-party scripts, validated across browser-level network traffic, source code, and tag management configurations.
– Analyzing what user data the trackers collect and send to third parties, and whether the data includes personal or sensitive information.
– Mapping data flows between the organization and its vendors, and assessing how that behavior has changed over time.

The result gives organizations a clear understanding of which trackers they deploy and what data those trackers share before those facts become the subject of a dispute.

CRA’s IAB Assessment Team provides a fixed-scope technical assessment that evaluates how a publisher manages and implements GPP consent strings, the IAB Tech Lab standard for encoding and transmitting user privacy choices. CRA experts confirm conformance with the publisher’s obligations as a signatory to the Multi-State Privacy Agreement (MSPA), the IAB’s contractual framework for U.S. state privacy law compliance in digital advertising. How we can advise:

– Confirming client-side and server-side GPP string generation, encoding accuracy, and transmission across the publisher’s data flows.
– Mapping and documenting GPP string data flows, identifying gaps, and providing prioritized recommendations.
– Delivering a GPP Health Check Report and a Data Flow Analytics Report, followed by a review workshop.

We scope the assessment per web property on a fixed-fee basis. An optional remediation and re-assessment phase confirms corrected GPP string handling.