Yes or no answers about the tools most businesses use, the paperwork a reviewer asks for and the five pledges a director signs. Every answer that needs work comes with the change to make, how long it usually takes and the ruling behind it.
About five minutes16 to 31 questions“Not sure” is a fine answerNothing stored or sent
01Tell us what you runSo we only ask what applies to you.
02Answer yes, no or not sureEach answer shows what it means, right beside it.
03Get your listWhat to change, how long it takes, your route and your fee.
01What you run
What do you run?
Pick everything that applies. 16 questions are for everyone. The other 15 appear only if you need them.
How many staff?
Sets your fee and your review route. Nothing else.
How to find out. Open your site in a private window with the network tab open. Anything from google.com, youtube.com or facebook.com on first load counts.
Still not sure? Ask us, then come back and answer yes or no.
{{b5Num}}
Do pay-later banners or payment widgets load on your product pages?
Why we ask
On a product page the customer hasn’t chosen that provider yet.
Clear
On a product page the customer hasn’t chosen that provider yet.
Change neededMajor
Make them click-to-load, or remove them. At checkout they’re fine.
Ad pixels and tagsIs there a Google, Meta, TikTok or LinkedIn ad pixel or tag on any page, including ones that only fire after “Accept”?
Paste your address into Blacklight, or search your page source for fbq, gtag, ttq or insight.min.js.
Conversions sent backDo you send sales or conversions back to an ad platform, from a server or by upload?
Google Ads: Goals, then Conversions. Meta: Events Manager. If events are arriving, something is sending them.
Uploaded audiencesHave you uploaded a customer list to an ad platform, or do you use lookalike or suppression audiences?
Google Ads: Audience manager. Meta: Audiences. Both need to be empty of your own lists.
Shopify data sharingIs Shopify Audiences on, or customer data sharing on in the Meta, Google or TikTok channel apps?
In your Shopify admin, look at the customer privacy settings and at the data sharing setting inside each sales channel app.
Affiliate trackingDoes your affiliate or cashback network use a tracking tag or a click-ID postback?
Ask the network whether it needs a tag on your confirmation page. If it does, this is a yes.
B2B tracking and enrichmentDo you use the LinkedIn Insight Tag, matched audiences, contact enrichment, intent data or reverse-IP lookup?
Look for Clearbit, ZoomInfo or Apollo in your tool list, and for the Insight Tag in your page source.
Google Analytics 4Do you use Google Analytics 4 or Firebase Analytics?
Search your page source for gtag, or for an ID that starts with G-.
Analytics that recognise peopleDoes any other analytics tool recognise a returning visitor, with a cookie, a user ID or a fingerprint?
Open your site in a private window and look at the cookies it sets. An analytics cookie that lasts longer than a day is a yes.
Session replayDo you record sessions or heatmaps with Hotjar, FullStory or Microsoft Clarity?
Search your page source for hotjar, fullstory or clarity.ms.
Embeds that load earlyDo YouTube, Maps, Google Fonts, reCAPTCHA or social login load before a visitor clicks?
Open your site in a private window with the network tab open. Anything from google.com, youtube.com or facebook.com on first load counts.
Pay-later widgetsDo pay-later banners or payment widgets load on your product pages?
Look for Klarna or PayPal messaging under the price on a product page.
App tracking toolsDoes your app include third-party tracking or advertising tools, or collect advertising IDs?
Look your app up on Exodus Privacy, or read its Apple privacy label.
Ad-audience syncsDoes your email or CRM tool sync audiences to an ad platform?
Look in the tool’s integrations or ads settings for Google, Meta or TikTok audiences.
Per-person open logsDo you keep per-person open and click records, or build segments from them?
Open one subscriber’s profile in your email tool. If it lists what they opened and clicked, this is a yes.
Sensitive segmentsDo any of your segments or recommendations rest on sensitive guesses: health, pregnancy, children, money trouble, religion, politics?
Read the names of your segments out loud. If one would embarrass you in front of the customer, this is a yes.
Review invitationsDo you upload customer lists in bulk to a review platform such as Trustpilot?
Check how invitations are triggered: by each order, or by a file someone uploads.
Message broadcastsDo you send WhatsApp, Instagram or Messenger broadcasts to contact lists you uploaded?
Ask whoever runs your messaging whether contacts were ever imported.
Selling or pooling dataDo you sell, rent, swap or pool customer data with anyone: partner brands, co-marketing deals, a data clean room?
Ask finance whether any partner pays for, or is paid with, customer lists.
Bought or enriched dataDo you buy data about people, or have your records enriched from outside sources?
Look through your invoices for list brokers, “data append” or enrichment services.
Personal AI accountsDo staff paste customer data into personal AI accounts?
Ask the team. Most people answer straight when it’s a question and not an accusation.
AI training termsDo any of your AI tools, plugins or integrations keep the right to train on, pool or reuse your customers’ data?
Ask each vendor the five questions on the Where data goes page.
Agency instructionsHave you told your agency or freelancer, in writing, not to install tags or upload customer data?
Ask them which audiences and conversion actions exist in your accounts today.
Processor contractsDo you have a written contract with every service that handles customer data, barring it from using the data for itself?
Search each provider’s site for “DPA” or “data processing agreement”. None on offer is a warning in itself.
Data mapCould you list, today, every service that receives customer data, what it gets and why?
Start from your invoices: every tool you pay for is a candidate.
Director’s declarationWill a director sign the declaration, and sign it again every year?
Send them the plain version of the Standard. It takes ten minutes to read.
Audit accessWould you allow an audit on 14 days’ notice, including a read-only look inside your ad accounts?
Ask whoever owns the ad accounts whether they can add a read-only user.
Pricing pledgeDo your prices and offers follow rules you could publish, never a guess at what one person would pay?
Ask whoever runs pricing whether any tool uses browsing, device or purchase history to set a price.
Leaving pledgeCan customers cancel online, in two steps, without a call or a chat?
Sign up with a test account, then try to leave. Count the steps.
Retention scheduleDo you have a written retention schedule, and does deletion actually run?
Look for a customer who closed their account a year ago. If they’re still there, this is a no.
Every channelDo your apps, emails, loyalty scheme and in-store systems follow the same rules as your website?
List every place a customer meets you, then ask who else receives data from each one.
Incident planDo you have a written plan to tell customers within 72 hours if someone gets into their data?
If nobody can find the plan in five minutes, this is a no.
Nothing you answer here is stored or sent anywhere. “Email this list” opens your own email app, and we never see it. A self-check isn’t a review: it tells you what we would ask about, and a review checks the same things with evidence.
All clear?
You’re ready. Under 50 staff with no ad-account integrations means the fast lane: about a week.
A tool that isn’t listed?
Check the rulings register, or ask us at hello@nullwareproject.org.