Data Governance, Privacy, Security, and Compliance
Governance in Target means controlling what data enters the profile, who can see it, and how long it's kept. Key concepts: profile attributes vs mbox parameters (transient), data retention settings, PII minimization, consent (Opt-In), and the Adobe Experience Platform privacy framework (Privacy Service) for access/deletion requests.
Security: role-based access control (product profiles, admin vs editor vs approver), SSO, and audit logs. Understand that Target decisions should not leak sensitive data in response tokens or client-side payloads.
Compliance: GDPR/CCPA deletion requests flow through Privacy Service; Target honors consent via Experience Cloud Opt-In or the Web SDK consent object. Know that deleting a profile requires the correct identity (ECID or customer ID) and that deletion is not instantaneous across all systems.
Traps: assuming mbox parameters are stored in the profile (they aren't by default); forgetting that consent must gate the Target request, not just Analytics; assuming deletion in Target removes data from Analytics too (it doesn't - each system must be handled).
Rule of thumb: collect the minimum attribute needed for personalization, document its purpose and retention, and gate the request on consent.
Worked example: a healthcare client must honor deletion requests. Map ECID and customer ID in Privacy Service, submit a delete request, and verify removal in Target profile and Analytics separately.