Visible on the site
What the technical review can observe.
- Cookies and local storage before and after a user action.
- Network recipients, request parameters, and third-party embeds.
- Whether analytics exists and loading changes after the user choice.
Outside the scan
Where manual review is required.
- Contractual roles and legal grounds for recipients.
- Whether a browser identifier is matched with other datasets.
- Hidden server-side transfers without integration access.
Next step
Keep evidence separate from decisions.
Remove unused scripts, classify what remains, and design controls from the confirmed data flow.
Sources
Review forms against primary sources.
Tell us what the site needs.
A goal, the current difficulty, and an optional website address are enough. Do not send passwords, keys, or private exports.