Governance, Privacy, and Data Quality
Collect only what you can govern
Governance spans what you collect, how you classify it, how long you keep it, and who can see it. Privacy regulations (GDPR, CCPA/CPRA) require consent management, data subject access/deletion, and minimization. In Adobe, this means consent gating in the SDK (Consent extension or Web SDK consent), data retention settings, IP obfuscation, and the Privacy Service for deletion/access requests. Data quality means consistent naming conventions, documented variable usage, controlled change management, and monitoring for anomalies.
Concepts you must know
Understand consent states (in/out/pending) and how they gate beacons. Know data retention and its effect on reporting windows. Know that the Privacy Service uses identifiers (ECID, hashed email) to process requests and that data must be labeled for governance. Know classification and sensitive-data labeling, access controls by report suite, and the audit trail of changes. Know naming conventions for variables, events, and data elements, and the role of the SDR as the governance record.
Traps in questions
- Sending PII (email, name) in props or eVars without labeling and consent.
- Assuming deletion is instant; Privacy Service requests are asynchronous and must propagate to downstream systems.
- Ignoring consent state so beacons fire before the user agrees.
- Letting variable usage drift from the SDR, causing collisions and misinterpretation.
- Forgetting retention limits when promising long-term trend reports.
Rule of thumb
If you would not want a value surfaced in a data subject access request, do not collect it in an analytics variable. Minimize, label, and gate at the source.