Every grey-area question gets an answer, a number and a date. Rulings bind every future review. They are never edited, only replaced by a later ruling.
21 rulingsPublished September 2026Standard version 1.0
How the 21 rulings fall
6not allowed
12conditions
2allowed
1out of scope
AllAdvertisingAnalyticsEmail and CRMPaymentsEmbedsB2B
ID
Tool or practice
Ruling
Clause
R-001
Buying ads on Meta, TikTok, Google, LinkedIn and others
Allowed
Any targeting the platform offers from its own data, including interests and demographics. Nothing may flow back to the platform.
NFS-1.1
R-002
Custom audiences, lookalikes and suppression lists built from your customers
Not allowed
Deleting existing audiences is part of joining.
NFS-1.1
R-003
Conversion tags and pixels: Google Ads tag, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag
Hashed emails or phone numbers sent to any ad platform
Not allowed
Hashing is not anonymisation. The platform hashes its own users and matches them.
NFS-1.2
R-006
Google Analytics 4 and Firebase Analytics
Not allowed
They send every visitor’s identifiers to Google, and the settings can be changed after review.
NFS-1.1, 2.1
R-007
Cookieless analytics using a salted hash, such as Plausible, Fathom, Simple Analytics or cookieless Matomo
Conditions
Allowed if the salt rotates at least every 24 hours, no raw IP is stored, and nothing links days or sites. That is counting, not fingerprinting.
NFS-2.1
R-008
Klaviyo, Mailchimp, HubSpot, Brevo and similar
Conditions
Allowed as processors. Ad-audience syncs off. Per-person open and click tracking off where the tool allows it; where it doesn’t, never used for segments.
NFS-1.4, 2.2
R-009
Basket reminders, order-history segments and recommendations in your own tools
Conditions
Allowed, said in the privacy notice, never built on sensitive inferences.
NFS-3.1
R-010
Shopify
Conditions
Shopify Audiences off. Customer data sharing off in the Meta, Google and TikTok channel apps.
NFS-1.4
R-011
Stripe Radar and other fraud scoring
Conditions
For fraud and security only. Listed by category on the data map.
NFS-1.8
R-012
PayPal, Klarna and Shop Pay at checkout
Allowed
The customer chose them.
NFS-1.5
R-013
Payment-provider widgets and messaging on product pages
Conditions
Click-to-load, or remove.
NFS-2.3
R-014
Review platforms such as Trustpilot
Conditions
Invitations per order, under processor terms. No bulk uploads of customer lists.
NFS-1.4
R-015
Affiliate and cashback networks
Conditions
No tracking tags or click-ID postbacks. Voucher codes, or unique links you attribute yourself, sending only order value and a reference for commission. Most cashback sites can’t work this way.
NFS-1.2
R-016
Session replay and heatmaps such as Hotjar and FullStory
Conditions
Only sampled, with every input masked and the vendor barred from own use. Microsoft Clarity is not allowed.
NFS-1.1
R-017
A/B testing
Conditions
Allowed on anything except price.
P-1
R-018
YouTube, Maps and Instagram embeds; hosted Google Fonts; reCAPTCHA; social login
Conditions
Self-host, click-to-load, or use a provider that isn’t an advertising company. Social login buttons load nothing until clicked.
NFS-2.3
R-019
Marketplaces, delivery and booking apps
Out of scope
Where the customer chose the platform. You must not upload your own customer list to it.
NFS-1.5
R-020
WhatsApp Business, Instagram DMs, Messenger
Conditions
When the customer starts the conversation. No uploaded contact lists, no broadcasts to them.