The $275,000 settlement between Connecticut's Attorney General and TaxAct wasn't just about penalizing past actions. It required a comprehensive governance program for third-party tracking technologies, including two independent audits. If you're using analytics pixels, marketing tags, or conversion trackers on sites handling sensitive data, you need similar controls, regardless of regulatory attention.
This guide helps you build a third-party tracking governance program that aligns with the standards now required of TaxAct.
The Problem: Your Marketing Stack Is a Data Disclosure Channel
Third-party tracking technologies execute code on your web properties, accessing DOM elements, form fields, URL parameters, and session data. By embedding a Facebook pixel, Google Analytics tag, or attribution tracker, you're allowing vendors to observe user interactions in real time.
The TaxAct case shows the risks when tracking technologies access more data than disclosed in your privacy notice. From January 2018 to December 2022, TaxAct's tracking technologies allegedly captured sensitive financial data. The settlement noted that TaxAct's agreement with its advertising partner didn't limit the use or sharing of this information.
Your marketing team can deploy a tag manager update that creates regulatory exposure faster than your legal team can review a contract amendment. You need governance to prevent this.
What You Need Before Starting
Inventory access: Ensure read access to your tag management platforms (Google Tag Manager, Tealium, Adobe Launch, Segment), analytics configurations, and any hard-coded tracking scripts.
Stakeholder alignment: Marketing, product, legal, and engineering must agree on who approves new tracking technologies. The TaxAct settlement requires a review committee. Identify yours now.
Documentation repository: Maintain records of approved tracking technologies, data points collected, vendor agreements, and audit findings. A shared drive is sufficient, but a GRC platform is better.
Technical scanning capability: Use tools like OneTrust, Osano, or custom scripts to inventory active tracking technologies on your domains.
Step-by-Step Implementation
1. Establish Your Review Committee
Form a cross-functional group with authority to approve or reject tracking technology deployments. Include:
- Privacy or compliance officer (chair)
- Marketing operations representative
- Web engineering lead
- Legal counsel (for vendor agreement review)
Document the committee's charter, meeting schedule (at least monthly), and decision-making process. The TaxAct settlement requires this governance layer.
2. Document Current State
Run a technical scan of every customer-facing web property to find:
- All active tracking domains
- Tag manager containers and their published tags
- Hard-coded tracking scripts
- Data layer variables and custom JavaScript
Document each tracking technology's vendor name, purpose, data access, contractual data use restrictions, deployment date, and approver. This becomes your tracking technology register.
3. Write Your Approval Policy
Define the process for deploying new tracking technologies or modifying existing ones. Include:
- Submission requirements: Marketing or product submits a request form specifying the vendor, business purpose, data points needed, and vendor agreement terms.
- Technical review: Engineering verifies the tag configuration only accesses approved data points.
- Privacy assessment: Legal or privacy ensures data collection aligns with your privacy notice and vendor agreement.
- Committee approval: The review committee approves or rejects based on assessments.
- Deployment controls: Only approved individuals can publish changes to production tag managers. Use role-based access and change logs.
The TaxAct settlement requires written policies governing approval of new tracking technologies and modifications.
4. Deploy Continuous Monitoring
Implement a tag-monitoring system that regularly scans your web properties. It should:
- Identify all active tracking domains
- Compare the current state against your approved tracking register
- Flag unauthorized tags
- Detect configuration changes to approved tags
- Alert your review committee to discrepancies
The TaxAct settlement mandates a tag-monitoring system. Options include OneTrust, Osano, and Admiral. Custom monitoring can be built using Puppeteer or Playwright.
5. Lock Down Tag Manager Access
Restrict who can publish tag manager changes to production. In Google Tag Manager:
- Assign "Publish" permission only to approved individuals
- Require container version descriptions documenting changes and approval ticket numbers
- Enable container notifications for your committee
- Review version history monthly for unauthorized changes
Apply equivalent access controls and audit logging in Tealium, Adobe Launch, or Segment.
Validation: How to Verify It Works
Test your approval workflow: Have a team member submit a request to add a new marketing pixel. Verify the request routes through technical review, privacy assessment, and committee approval before deployment.
Run an unauthorized tag test: In a non-production environment, have an engineer publish an unapproved tracking tag. Verify your monitoring system detects it and sends alerts.
Audit your tracking register: Compare your documented tracking technologies against a live technical scan. Ensure every active tracker appears in your register with current approval status.
Review vendor agreements: Confirm your agreements with vendors restrict their ability to use the data for their purposes or share it with third parties.
Maintenance and Ongoing Tasks
Monthly committee meetings: Review new tracking requests, monitoring alerts, and vendor agreement changes. Document decisions.
Quarterly register updates: Re-scan all web properties and reconcile against your tracking register. Archive deprecated trackers.
Annual vendor agreement review: Confirm agreements with vendors still restrict data use and sharing. Renegotiate or terminate vendors that won't commit to these terms.
Independent audits: Schedule an independent audit annually. Engage a firm with expertise in privacy engineering and web tracking technologies. Provide them with your tracking register, approval policy, monitoring reports, and committee meeting minutes.
Privacy notice alignment: Verify your privacy notice accurately describes what you're collecting and sharing. Update it before deployment.
Incident response: Treat unauthorized tags as potential data disclosure incidents. Determine what data was accessed, how long it was active, and whether you need to notify affected individuals or regulators.
Your marketing team may resist approval delays. Your executive team might question the cost of monitoring tools and audits. The TaxAct settlement provides your answer: $275,000 plus mandatory governance controls is more expensive than building the controls proactively.
