# Tracking audit scope: <site or app>

Fill this in with the user before any capture. No capture, test lead or test order starts until the approvals below carry a name and a date. File it as evidence E-00 in the project's audit folder: <tracking-audit/YYYY-MM-DD/>.

## Business context

- The question the audit must answer, in one sentence: <for example: can we trust conversions before doubling the paid search budget?>
- Tier-1 conversions and the system that commits each: <demo request: Forms API success; paid plan: billing webhook>
- Decisions that rely on the data: <bidding, budget allocation, board reporting>

## Hosts, journeys and page types

- Hosts in scope: <www.example.com, app.example.com>, plus third-party hosts in the journey and whether each can be tagged: <pay.example.net, cannot be tagged>
- Journeys: <ad landing to demo form; signup; upgrade, hosted checkout and return>
- Landing routes, from the Google Ads landing page read: <final URLs with most paid clicks, every distinct host, the tracking template and final URL suffix each uses>
- Embedded schedulers or forms and their hosts (passed to har-audit as --form-hosts): <booking.example.org on /demo>
- Page types to capture: <landing, pricing, form, checkout, confirmation, app entry>
- SPA route fixture: <host and path prefix>, <steps>, expected page views written before the run: <n>

## Regions and consent model

- Regions served, and how each is reached (IP egress, never geolocation emulation alone): <UK through egress X>
- Consent model per region from the privacy owner: <opt-in or opt-out; basic or advanced for Google tags; which vendor sits in which CMP category>
- Microsoft UET: <basic (loads only after a grant) or advanced (fires before a choice with ad_storage denied)>; OpenAI Ads pixel: <consent false before init, or loaded only after a grant>
- URL passthrough: <on | off>. Ads data redaction: <on | off>
- Signals granted by default per region: <none in opt-in regions>
- Opt-out regions: <the CMP's opt-out of sale or sharing, and whether Global Privacy Control is honoured>
- How the CMP records a choice: <POST to the CMP host (passed as --cmp-hosts) | GET | not logged: the auditor notes the seconds to the click for --choice-at>
- Essential hosts and cookies allowed before a choice: <hosts for --allow-hosts; cookie names or prefixes for --essential-cookies>
- Decision owner and date: <privacy owner, YYYY-MM-DD>. Without this line consent checks cannot pass or fail: stop and ask.

## Destinations

- Expected IDs: <G-XXXXXXXXXX, AW-123456789, pixel, partner and portal IDs>
- Retired IDs: <IDs that must receive nothing>
- Routes per event and destination: <purchase: Meta browser plus Conversions API, key event_id = order reference>
- First-party collection endpoints (passed to har-audit as --collector-hosts): <server container clients and paths, tag gateway path, proxies, CNAME collectors, or none>
- Destinations approved for hashed match data, and after which signal: <google-ads after ad_user_data granted>
- Value rule per destination: <net of tax and shipping, currency>

## Access level and read routes

- Level reached: <L1 public evidence | L2 read access | L3 approved test transactions>
- Browser evidence: <HAR files exported from DevTools or Playwright recordHar, by whom> plus <agent-owned isolated browser for cookie names, data layer and request lists>
- GA4: <GA4 MCP server without --allow-write | Admin API read-only client | Viewer access | screenshots>
- Google Ads: <Google Ads MCP server with labels and assets set false, Read-only user | Read-only user in the UI>
- Offline conversion upload route: <native CRM integration | Data Manager connection | Data Manager API | Google Ads API uploader with an allowlisted developer token>
- Meta: <Meta Ads MCP read tools | Events Manager read by the paid social owner>
- GTM: <export of the live version | gtm-container-audit report | published gtm.js only>
- CRM export columns: record ID, create date, source fields, click ID and UTM fields only (in HubSpot both the hidden-field properties and HubSpot's own click ID properties; a consent-at-submission column where the decision needs it)
- Order export columns: order ID, placed and paid time with time zone, status, net and gross value, currency, test flag
- Server container: <Preview by its owner | log reader role | no access>

## Approvals (each a named yes with a date)

- Consent banner clicks on the live site: <name, date>
- Synthetic click IDs on live landing pages: <name, date>
- Test leads (where, how many, cleanup owner): <name, date>
- Test signups or accounts (where, how many, cleanup owner): <name, date>
- Test orders (staging or test payment method, agreed references, cleanup owner): <name, date>
- Platform test events (GA4 debug mode, Meta test event code): <name, date>
- Blocking ad conversion hosts in the test browser while ads are not under test: <name, date>

## Markers and test data

- gclid=TeSter-123 exactly. Other click IDs (fbclid, msclkid, ttclid, li_fat_id, oppref) and utm_campaign use the TeSter-123- prefix; utm_source and utm_medium use tester.
- Test identities: qa-audit-NN@example.com and phone +15555550100.
- Test order references: <ACME-TEST-NNNN style, agreed with billing>
- Never a real click ID, a real customer record or a real payment card.

## Owners

- Business: <role>. Implementation: <role>. Privacy: <role>. CRM: <role>. Paid media: <role>. Data: <role>.

## Stop rules

- The container, property or account you can read is not the one named here.
- A test would touch a real customer, a real payment or a live campaign without approval.
- Real personal data appears in a vendor request: stop, restrict the evidence, and tell the user the same day with a draft note for the privacy owner. The agent never sends it.
- The consent model for a region in scope is not documented.