# Marketing Analytics Privacy Assessment Workflows

## Workflow 1: Marketing Processing Screening
1. Inventory all marketing processing activities (profiling, targeting, measurement, attribution).
2. For each activity, determine WP248 criteria met.
3. If C1 (evaluation/scoring) + any other criterion → DPIA required.
4. Proceed to full marketing analytics DPIA.

## Workflow 2: Cookie and Tracking Technology Audit
1. Scan all websites and apps for cookies, pixels, and tracking scripts.
2. Classify each technology: strictly necessary, functional, analytics, advertising.
3. Verify consent is obtained before non-essential technologies fire.
4. Verify consent mechanism meets GDPR/ePrivacy standards (no pre-ticked boxes, no dark patterns, equal accept/reject options).
5. Audit consent records for completeness and integrity.

## Workflow 3: Adtech Vendor Assessment
1. Identify all adtech vendors receiving personal data.
2. For each vendor: verify DPA in place, assess data processing purposes, check international transfers.
3. Assess whether vendor processes data as processor or independent controller.
4. Verify consent chain: can vendor demonstrate consent was obtained for its processing?
5. Assess real-time bidding data leakage: what data is included in bid requests? How many parties receive it?

## Workflow 4: Legitimate Interest Assessment for Direct Marketing
1. Identify the legitimate interest (e.g., marketing existing products to existing customers).
2. Assess necessity: is the processing necessary for the interest?
3. Balancing test: do data subject rights override the interest?
   - Consider: expectations of data subjects, nature of data, relationship with controller, impact of processing.
4. Document the LIA and make available on request.
5. Ensure opt-out mechanism is prominent and easily accessible.