A Consent Banner Is Not an International Privacy Review

List what is collected before choice, after choice, on form submission, during enrichment, inside the CRM, through advertising integrations, and in sales follow-up. For each flow, record purpose, fields, recipient, location, retention, access, and deletion path. A banner cannot govern a flow nobody has documented.

NIST’s Privacy Framework treats privacy as an organization-wide risk-management problem. That framing is useful for marketing teams: acquisition, analytics, sales, vendors, and security all shape what happens to a lead after the page loads.

European transparency guidance emphasizes clear and plain language. The practical test is not whether the notice contains every internal term. It is whether a person can understand what will happen, who is responsible, what choice exists, and how to exercise it without decoding a legal department’s vocabulary.

Localization means more than translating the privacy-policy page. Review the banner, form labels, validation, confirmation, unsubscribe path, preference center, sales script, and help response in the languages actually offered. Keep the interface consistent: an easy accept and hidden refusal undermines informed choice.

A requested proposal, account notice, newsletter, nurture sequence, and targeted advertising are not one undifferentiated communication. Map the purpose and rule for each channel and market. The UK ICO’s direct-marketing guidance is one authoritative reference for UK operations, but it should not be treated as a universal global rule.

Propagate consent and suppression state through forms, CRM, email, calling, audience syncs, and data warehouses. A person who opts out should not re-enter a campaign because a nightly import omitted the suppression field.

Record the market, product surface, processing purpose, applicable review, configuration, approver, test evidence, and next review date. Keep screenshots and version identifiers. When a vendor or campaign changes, the team can see which decision must be reopened.

This checklist is operational guidance, not a legal conclusion. Laws, regulator positions, contracts, and cross-border transfer requirements vary. Use qualified counsel or privacy professionals for the jurisdictions and processing in scope, then translate their decision into testable product and marketing controls.