Should the register have one record per tool?

Use one row for each proposed tool. Record its purpose, information handled, recipients, delivery paths, controls, visitor disclosures, decision owner, implementation owner, review owner and unresolved questions.

What happens if a vendor cannot answer a field?

Mark the uncertainty clearly and pause installation if it concerns a material data flow, recipient, delivery route, control or disclosure. Assign the question to a suitable technical or legal reviewer.

Does a completed intake register prove compliance?

No. The register is an intake and accountability record. Verify deployed browser behaviour separately and seek advice suited to the applicable circumstances where legal questions remain.

When should the intake record be updated?

Update the record when the tool’s purpose, data handling, recipients, delivery path, controls, disclosure or ownership changes. Retest the published implementation when the change could affect visitor-facing behaviour.

Website Tool Privacy Intake Register for Analytics, Advertising and Chat

Patrick HallermannNovember 14, 20265 min read

What should a small business record before installing an analytics, advertising or chat tool?

Create one record for each proposed tool before installation. Capture its business purpose, the information it handles, who receives or processes that information, where its code will be added, whether it uses cookies or another transfer method, which controls can govern it, what visitors will be told, and who owns approval and future changes. Mark uncertain answers explicitly and send legal or technical questions to the appropriate reviewer. Do not install a tool while a material data flow or control remains unexplained.

Record the purpose, data and recipients

CBIA describes a privacy audit as an assessment of website data collection, storage, processing and security practices. A 2026 background checklist recommends listing external page-load requests such as advertising pixels, analytics, chat widgets, session replay, heatmaps, embedded forms, calendars and video players.

Sources: Marketing Guide: Creating a Website Privacy Policy Checklist » CBIA; CIPA Compliance Checklist for Business Websites (2026).

Use one row per proposed tool and record its business purpose, information handled, recipients, processing or sharing, and observed or documented external requests. Use Approve AI Tools and Vendors when an AI-enabled tool also needs broader supplier, access and accountability checks. Mark a material answer as unknown rather than converting a marketing description into an assumed data-flow fact.

Record the business purpose.
Describe the information handled.
Name recipients and processing activities.
List external requests and sharing routes.

Identify how the tool reaches the website and sends data

CBIA notes that plug-ins can add functions ranging from contact forms and social sharing to analytics tracking. The New York Attorney General reported that tag-management tools could still allow marketing tags to fire after visitors disabled marketing cookies through privacy controls on investigated sites. The New York Attorney General described a company sending visitor information directly to advertising companies outside its consent-management tool, without third-party tags or cookies.

Sources: Marketing Guide: Creating a Website Privacy Policy Checklist » CBIA; Website Privacy Controls | New York Attorney General.

For each tool row, record every delivery path: plug-in, tag-manager rule, embedded code, hardcoded script and any other transfer route you can identify. Use Prepare Before Adding AI to check wider operational dependencies before connecting the tool. Before changing a live configuration, confirm the provider’s current prerequisites in its own documentation and identify who can reverse the change if required.

Name each installation route.
Record plug-ins and tag-manager rules.
Identify embedded or hardcoded code.
Note transfers outside cookie controls.

Document choices, controls and disclosures

The European Union’s Your Europe guidance states that some cookies require users’ consent before their data can be collected through those cookies. The same European Union guidance says that whether prior consent is required can depend on the purpose of the cookie. CBIA says that consent options let users choose which types of cookies they want to accept and give them control of privacy preferences.

Sources: Online privacy: How to use cookies on your website - Your Europe; Marketing Guide: Creating a Website Privacy Policy Checklist » CBIA.

Record the stated purpose, visitor choices, expected control, visitor-facing disclosure and any unresolved jurisdiction-specific question for each tool. Do not assume that one category or banner wording suits every tool, because applicable duties can vary with jurisdiction, purpose, technology and data use. Send unresolved legal questions to a qualified adviser rather than treating the register as a legal conclusion.

State the intended purpose.
List the visitor choices presented.
Name the expected technical control.
Record disclosure and legal-review questions.

Assign ownership and stop on material unknowns

Assign a decision owner, implementation owner and future review owner in every tool record, with a named next reviewer for each material unknown.

Adapt AI Website Training, Roles and Approval Boundaries so the appropriate person resolves privacy, technical or business uncertainty before installation. Use Manage Each Recurring Small-Business Website Task to assign maintenance and future register updates to a capable team member or provider. Pause installation when a material data flow, recipient, delivery path, control or disclosure remains unexplained; do not guess merely to complete the record.

Name a decision owner.
Name an implementation owner.
Name a future review owner.
Pause material unknowns and escalate them.