[
  {
    "id": "A1",
    "group_id": "A",
    "group_name": "Data and identity",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Which of our data sources does the platform ingest, and at what grain: transaction, account, household or device?",
    "why_it_matters": "The grain decides which audiences and which measurements are possible later.",
    "good_answer": "A field-level schema per source, refresh frequency and retention per field.",
    "sources": []
  },
  {
    "id": "A2",
    "group_id": "A",
    "group_name": "Data and identity",
    "group_weight": 15,
    "gate": true,
    "na_allowed": false,
    "question": "Where is raw customer data processed and stored, and does any of it leave our environment?",
    "why_it_matters": "Banks and loyalty owners often contract on the condition that raw data stays inside. Cardlytics says its network works \"without any personal data leaving\" its bank partners (company statement) (10-K, 4 Mar 2026).",
    "good_answer": "A data-flow diagram naming every system, region and party, and exactly what leaves, at what level of aggregation.",
    "sources": [
      {
        "title": "Cardlytics, Inc., Form 10-K for fiscal year 2025",
        "url": "https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm",
        "date": "2026-03-04"
      }
    ]
  },
  {
    "id": "A3",
    "group_id": "A",
    "group_name": "Data and identity",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "How are identities matched across our systems and partners, and what match rates do you see?",
    "why_it_matters": "Match rates set reachable audience size and measurement sample size.",
    "good_answer": "Keys used (hashed email, phone, card token, account ID), hashing method, and dated match rates from comparable deployments.",
    "sources": []
  },
  {
    "id": "A4",
    "group_id": "A",
    "group_name": "Data and identity",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "How fast does an opt-out or consent change reach every audience and channel?",
    "why_it_matters": "An opt-out recorded in the core system must stop targeting everywhere.",
    "good_answer": "Propagation time in hours, an audit log, and a test you can run during the pilot.",
    "sources": []
  },
  {
    "id": "A5",
    "group_id": "A",
    "group_name": "Data and identity",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Can we see and export the rules behind every audience segment?",
    "why_it_matters": "Hidden segment logic blocks fair lending and privacy review.",
    "good_answer": "Versioned, readable rules with an approval workflow and export.",
    "sources": []
  },
  {
    "id": "B1",
    "group_id": "B",
    "group_name": "Privacy and legal basis",
    "group_weight": 15,
    "gate": true,
    "na_allowed": false,
    "question": "For each data use, which GLBA and Regulation P basis do you rely on, and who sends the notices?",
    "why_it_matters": "The service-provider and joint-marketing exception needs a contract limiting use (12 CFR 1016.13); a recipient may not pass the data on unless the bank could (15 U.S.C. 6802(c)).",
    "good_answer": "A use-by-use map, the draft contract clauses limiting use and reuse, and the notice owner.",
    "sources": [
      {
        "title": "Cornell LII, 12 CFR 1016.13, \"Exception to opt out requirements for service providers and joint marketing\"",
        "url": "https://www.law.cornell.edu/cfr/text/12/1016.13",
        "date": "n/d"
      },
      {
        "title": "Cornell LII, 15 U.S.C. 6802, \"Obligations with respect to disclosures of personal information\"",
        "url": "https://www.law.cornell.edu/uscode/text/15/6802",
        "date": "n/d"
      }
    ]
  },
  {
    "id": "B2",
    "group_id": "B",
    "group_name": "Privacy and legal basis",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Does any feature disclose account numbers or access codes to a third party for marketing?",
    "why_it_matters": "Regulation P prohibits it with two exceptions; an encrypted number counts only if the recipient cannot decode it (12 CFR 1016.12).",
    "good_answer": "A plain \"no\", backed by architecture showing tokens only, or the exception relied on.",
    "sources": [
      {
        "title": "Electronic Code of Federal Regulations via Cornell LII, 12 CFR 1016.12, \"Limits on sharing account number information for marketing purposes\"",
        "url": "https://www.law.cornell.edu/cfr/text/12/1016.12",
        "date": "n/d"
      }
    ]
  },
  {
    "id": "B3",
    "group_id": "B",
    "group_name": "Privacy and legal basis",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Will any audience use consumer report data, or support credit or insurance offers?",
    "why_it_matters": "Prescreened lists are allowed only for firm offers of credit or insurance (15 U.S.C. 1681b(c)); affiliate data used for solicitations needs notice and opt-out (12 CFR 1022.21).",
    "good_answer": "Which features touch consumer reports, the prescreen workflow, or a clear statement that none do.",
    "sources": [
      {
        "title": "Cornell LII, 15 U.S.C. 1681b, \"Permissible purposes of consumer reports\"",
        "url": "https://www.law.cornell.edu/uscode/text/15/1681b",
        "date": "n/d"
      },
      {
        "title": "Cornell LII, 12 CFR 1022.21, \"Use of eligibility information by affiliates for marketing purposes\"",
        "url": "https://www.law.cornell.edu/cfr/text/12/1022.21",
        "date": "n/d"
      }
    ]
  },
  {
    "id": "B4",
    "group_id": "B",
    "group_name": "Privacy and legal basis",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Which state privacy laws do you treat as applying, and how do you handle data outside the GLBA exemption?",
    "why_it_matters": "California exempts data collected subject to GLBA, not the company (Cal. Civ. Code 1798.145(e)); Virginia exempts GLBA institutions and data (Va. Code 59.1-576).",
    "good_answer": "A state-by-state matrix and how sale and sharing opt-outs work for web and app data.",
    "sources": [
      {
        "title": "California Privacy Protection Agency, California Consumer Privacy Act statute text, effective 1 January 2026, section 1798.145(e)",
        "url": "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf",
        "date": "n/d"
      },
      {
        "title": "Virginia Code, section 59.1-576, \"Scope; exemptions\"",
        "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/",
        "date": "n/d"
      }
    ]
  },
  {
    "id": "B5",
    "group_id": "B",
    "group_name": "Privacy and legal basis",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "How do you stop sensitive inferences, such as health, from entering audiences?",
    "why_it_matters": "Pharmacy and clinic purchases can reveal health conditions, and state health data laws apply to such data.",
    "good_answer": "Merchant-category and keyword blocklists, tests, and a named policy owner.",
    "sources": []
  },
  {
    "id": "C1",
    "group_id": "C",
    "group_name": "Clean room and activation",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "Which clean room or privacy-enhancing technology do you use, and who approves queries?",
    "why_it_matters": "Whoever controls the query templates controls what can leak.",
    "good_answer": "The named technology, the approval workflow and who holds the keys.",
    "sources": []
  },
  {
    "id": "C2",
    "group_id": "C",
    "group_name": "Clean room and activation",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "What are the minimum aggregation thresholds, and can you change them without our approval?",
    "why_it_matters": "Low or vendor-controlled thresholds allow re-identification by comparing overlapping results.",
    "good_answer": "Thresholds stored as our configuration, with a change log.",
    "sources": []
  },
  {
    "id": "C3",
    "group_id": "C",
    "group_name": "Clean room and activation",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "How do audiences reach offsite channels, and which identifier leaves our perimeter?",
    "why_it_matters": "Offsite activation is where data most often leaves.",
    "good_answer": "Each destination, the identifier type, contract terms with each and deletion at campaign end.",
    "sources": []
  },
  {
    "id": "C4",
    "group_id": "C",
    "group_name": "Clean room and activation",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "What can an advertiser bring into the clean room, and what can it take out?",
    "why_it_matters": "Two-way flows create new disclosures on both sides.",
    "good_answer": "Input and output policies, export limits and query logs we can read.",
    "sources": []
  },
  {
    "id": "C5",
    "group_id": "C",
    "group_name": "Clean room and activation",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "How is matching to third-party data done, and is it disclosed?",
    "why_it_matters": "The IAB/MRC guidelines require transparency in how third-party matching is conducted (January 2024).",
    "good_answer": "Method, partners and match rates, written into reporting.",
    "sources": [
      {
        "title": "IAB and MRC, \"Retail Media Measurement Guidelines\"",
        "url": "https://www.iab.com/wp-content/uploads/2024/01/IAB_Retail_Media_Measurement_Guidelines_January2024.pdf",
        "date": "2024-01"
      }
    ]
  },
  {
    "id": "D1",
    "group_id": "D",
    "group_name": "Measurement and incrementality",
    "group_weight": 15,
    "gate": true,
    "na_allowed": false,
    "question": "Do you run randomised holdouts or other controlled tests, and can we see the control design?",
    "why_it_matters": "Without a credible counterfactual, measured differences \"may reflect correlation\" rather than impact (IAB and IAB Europe, 2025).",
    "good_answer": "Holdout or randomised design by default, control size, power calculation and confidence intervals.",
    "sources": [
      {
        "title": "IAB and IAB Europe, \"Guidelines for Incremental Measurement in Commerce Media\"",
        "url": "https://www.iab.com/wp-content/uploads/2026/01/IAB_and_IAB_Europe_Guidelines_Incremental_Measurement_Commerce_Media_November_2025.pdf",
        "date": "2025-11-03"
      }
    ]
  },
  {
    "id": "D2",
    "group_id": "D",
    "group_name": "Measurement and incrementality",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Which attribution windows do you use, and are they disclosed before each campaign?",
    "why_it_matters": "The IAB/MRC guidelines require disclosure before execution; typical windows run 3, 7, 14, 28 or 30 days (January 2024).",
    "good_answer": "Window per objective, written into the insertion order.",
    "sources": [
      {
        "title": "IAB and MRC, \"Retail Media Measurement Guidelines\"",
        "url": "https://www.iab.com/wp-content/uploads/2024/01/IAB_Retail_Media_Measurement_Guidelines_January2024.pdf",
        "date": "2024-01"
      }
    ]
  },
  {
    "id": "D3",
    "group_id": "D",
    "group_name": "Measurement and incrementality",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "What share of customers' spending does your data see, and how do you treat the rest?",
    "why_it_matters": "Cards carried 79% of US noncash payments by number but 8% by value in 2024 (Federal Reserve, 1 July 2026).",
    "good_answer": "A coverage estimate with method, and how results are scaled or caveated.",
    "sources": [
      {
        "title": "Federal Reserve, \"The 2025 Federal Reserve Payments Study: national payment volumes, top-line data, CY 2015-24\"",
        "url": "https://www.federalreserve.gov/paymentsystems/frps_cy2015_24_topline.htm",
        "date": "2026-07-01"
      }
    ]
  },
  {
    "id": "D4",
    "group_id": "D",
    "group_name": "Measurement and incrementality",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "How do returns, chargebacks and late clearing change reported sales?",
    "why_it_matters": "Rewards and partner payments can trail the purchase by months; Cardlytics pays incentives one to four months after redemption (10-K).",
    "good_answer": "A restatement policy, preliminary and final flags, and typical lag in days.",
    "sources": [
      {
        "title": "Cardlytics, Inc., Form 10-K for fiscal year 2025",
        "url": "https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm",
        "date": "2026-03-04"
      }
    ]
  },
  {
    "id": "D5",
    "group_id": "D",
    "group_name": "Measurement and incrementality",
    "group_weight": 15,
    "gate": false,
    "na_allowed": true,
    "question": "Which independent partners can validate results with their own data?",
    "why_it_matters": "PayPal launched its program with 20 certified third-party measurement partners (PayPal, 6 Jan 2026).",
    "good_answer": "Named partners, what data each receives and a past joint study.",
    "sources": [
      {
        "title": "PayPal, \"CES 2026: PayPal Ads Unveils Transaction Graph Insights and Measurement Partnership Program\"",
        "url": "https://newsroom.paypal-corp.com/2026-01-06-PayPal-Ads-Unveils-Transaction-Graph-Insights-and-Measurement-Partnership-Program",
        "date": "2026-01-06"
      }
    ]
  },
  {
    "id": "E1",
    "group_id": "E",
    "group_name": "Ad serving and formats",
    "group_weight": 8,
    "gate": false,
    "na_allowed": true,
    "question": "Which surfaces and formats are live, and which are planned, with dates?",
    "why_it_matters": "Offers, display, email, push and in-branch or in-store screens need different tooling.",
    "good_answer": "A format list with specifications, live versus planned.",
    "sources": []
  },
  {
    "id": "E2",
    "group_id": "E",
    "group_name": "Ad serving and formats",
    "group_weight": 8,
    "gate": false,
    "na_allowed": true,
    "question": "How are frequency and pacing controlled across surfaces?",
    "why_it_matters": "Customers see the same brand in app, email and offers.",
    "good_answer": "Cross-surface caps, pacing logic and reporting by surface.",
    "sources": []
  },
  {
    "id": "E3",
    "group_id": "E",
    "group_name": "Ad serving and formats",
    "group_weight": 8,
    "gate": false,
    "na_allowed": true,
    "question": "What creative review applies to regulated advertisers and categories?",
    "why_it_matters": "Bank and credit ads carry disclosure rules; see bank advertising rules.",
    "good_answer": "A review workflow, category blocks and an audit trail.",
    "sources": []
  },
  {
    "id": "E4",
    "group_id": "E",
    "group_name": "Ad serving and formats",
    "group_weight": 8,
    "gate": false,
    "na_allowed": true,
    "question": "Do you measure viewability and invalid traffic on owned surfaces, to which standard?",
    "why_it_matters": "MRC counts a display ad viewable at 50% of pixels for one second (MRC, 2015).",
    "good_answer": "The vendor used, the standard followed and IVT filtering.",
    "sources": [
      {
        "title": "Media Rating Council, \"Viewable Ad Impression Measurement Guidelines\", Version 2.0",
        "url": "https://mediaratingcouncil.org/sites/default/files/Standards/081815%20Viewable%20Ad%20Impression%20Guideline_v2.0_Final.pdf",
        "date": "2015-08-18"
      }
    ]
  },
  {
    "id": "E5",
    "group_id": "E",
    "group_name": "Ad serving and formats",
    "group_weight": 8,
    "gate": false,
    "na_allowed": true,
    "question": "Can buyers reach inventory programmatically, and through which protocol and DSPs?",
    "why_it_matters": "Programmatic access widens demand beyond managed sales.",
    "good_answer": "OpenRTB 2.6 support, deal IDs and a list of connected DSPs.",
    "sources": []
  },
  {
    "id": "F1",
    "group_id": "F",
    "group_name": "Pricing and contract",
    "group_weight": 12,
    "gate": true,
    "na_allowed": false,
    "question": "List every fee: platform, data, media, revenue share, measurement and minimums.",
    "why_it_matters": "Fees hidden in media rates are hard to audit later.",
    "good_answer": "A fee schedule and a sample invoice.",
    "sources": []
  },
  {
    "id": "F2",
    "group_id": "F",
    "group_name": "Pricing and contract",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "Is pricing tied to impressions, engagements or attributed sales, and how is an attributed sale defined?",
    "why_it_matters": "Cardlytics' main model charges a share of all purchases by served customers during the campaign, \"regardless of whether\" they engage (10-K).",
    "good_answer": "The definition, the window and a worked invoice.",
    "sources": [
      {
        "title": "Cardlytics, Inc., Form 10-K for fiscal year 2025",
        "url": "https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm",
        "date": "2026-03-04"
      }
    ]
  },
  {
    "id": "F3",
    "group_id": "F",
    "group_name": "Pricing and contract",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "How is the revenue share to us calculated, and can we audit it?",
    "why_it_matters": "Partner share drives the business case.",
    "good_answer": "The formula, the inputs and audit rights.",
    "sources": []
  },
  {
    "id": "F4",
    "group_id": "F",
    "group_name": "Pricing and contract",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "What service levels apply to uptime, support and reporting, with what credits?",
    "why_it_matters": "Late reports delay billing and optimisation.",
    "good_answer": "Service levels with measurable credits.",
    "sources": []
  },
  {
    "id": "F5",
    "group_id": "F",
    "group_name": "Pricing and contract",
    "group_weight": 12,
    "gate": false,
    "na_allowed": true,
    "question": "Which terms stop you using our data for your own products or other clients?",
    "why_it_matters": "Reuse is restricted by law for GLBA data (15 U.S.C. 6802(c)) and should be restricted by contract for the rest.",
    "good_answer": "A purpose-limitation clause covering model training.",
    "sources": [
      {
        "title": "Cornell LII, 15 U.S.C. 6802, \"Obligations with respect to disclosures of personal information\"",
        "url": "https://www.law.cornell.edu/uscode/text/15/6802",
        "date": "n/d"
      }
    ]
  },
  {
    "id": "G1",
    "group_id": "G",
    "group_name": "Security and SOC 2",
    "group_weight": 13,
    "gate": true,
    "na_allowed": false,
    "question": "Provide your latest SOC 2 Type 2 report: period, auditor, scope and exceptions.",
    "why_it_matters": "The AICPA is looking into allegations about one SOC services provider, and its journal has covered the risks of quick-turn SOC engagements (AICPA, accessed 9 Nov 2026).",
    "good_answer": "A Type 2 report covering the systems in scope, a recent period, a named CPA firm and remediation of exceptions.",
    "sources": [
      {
        "title": "AICPA and CIMA, \"SOC 2\" topic page with the notice on SOC services and the exposure drafts for proposed 2027 SOC 2 Trust Services Criteria",
        "url": "https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2",
        "date": "2026-10-26"
      }
    ]
  },
  {
    "id": "G2",
    "group_id": "G",
    "group_name": "Security and SOC 2",
    "group_weight": 13,
    "gate": false,
    "na_allowed": true,
    "question": "Which Trust Services Criteria are in scope, and how will you move to the 2027 criteria?",
    "why_it_matters": "SOC 2 can cover security, availability, processing integrity, confidentiality and privacy; the 2027 criteria are in draft (AICPA).",
    "good_answer": "The categories covered and a transition plan.",
    "sources": [
      {
        "title": "AICPA and CIMA, \"SOC 2\" topic page with the notice on SOC services and the exposure drafts for proposed 2027 SOC 2 Trust Services Criteria",
        "url": "https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2",
        "date": "2026-10-26"
      }
    ]
  },
  {
    "id": "G3",
    "group_id": "G",
    "group_name": "Security and SOC 2",
    "group_weight": 13,
    "gate": false,
    "na_allowed": true,
    "question": "Who manages encryption keys, and can we hold our own?",
    "why_it_matters": "Customer-held keys limit what the vendor can read.",
    "good_answer": "Key management design and customer-managed key support.",
    "sources": []
  },
  {
    "id": "G4",
    "group_id": "G",
    "group_name": "Security and SOC 2",
    "group_weight": 13,
    "gate": false,
    "na_allowed": true,
    "question": "Which subprocessors and regions handle our data?",
    "why_it_matters": "Each subprocessor is another party to assess.",
    "good_answer": "A current list and advance notice of changes.",
    "sources": []
  },
  {
    "id": "G5",
    "group_id": "G",
    "group_name": "Security and SOC 2",
    "group_weight": 13,
    "gate": false,
    "na_allowed": true,
    "question": "What are your incident response and notification commitments?",
    "why_it_matters": "Banks have their own notification duties to meet.",
    "good_answer": "Notification time in hours, named contacts and recent exercise results.",
    "sources": []
  },
  {
    "id": "H1",
    "group_id": "H",
    "group_name": "Exit and data portability",
    "group_weight": 10,
    "gate": true,
    "na_allowed": false,
    "question": "At exit, can we export all our data, configurations, audiences and logs in documented formats, and at what cost?",
    "why_it_matters": "Without an export, the next platform starts from zero.",
    "good_answer": "Formats (CSV or Parquet), schema documentation and the fee, ideally none.",
    "sources": []
  },
  {
    "id": "H2",
    "group_id": "H",
    "group_name": "Exit and data portability",
    "group_weight": 10,
    "gate": false,
    "na_allowed": true,
    "question": "What happens to our data and derived models after termination, and how is deletion certified?",
    "why_it_matters": "Derived models can carry our data forward.",
    "good_answer": "A deletion timeline and a certificate.",
    "sources": []
  },
  {
    "id": "H3",
    "group_id": "H",
    "group_name": "Exit and data portability",
    "group_weight": 10,
    "gate": false,
    "na_allowed": true,
    "question": "How long will you run in parallel while we migrate?",
    "why_it_matters": "Bank of America's exit from Cardlytics ran almost seven months past expiry (10-K).",
    "good_answer": "A transition-assistance period and its rates.",
    "sources": [
      {
        "title": "Cardlytics, Inc., Form 10-K for fiscal year 2025",
        "url": "https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm",
        "date": "2026-03-04"
      }
    ]
  },
  {
    "id": "H4",
    "group_id": "H",
    "group_name": "Exit and data portability",
    "group_weight": 10,
    "gate": false,
    "na_allowed": true,
    "question": "Can segments and measurement history move to another platform?",
    "why_it_matters": "History is what makes year-on-year comparison possible.",
    "good_answer": "Portable identifiers and a history export.",
    "sources": []
  },
  {
    "id": "H5",
    "group_id": "H",
    "group_name": "Exit and data portability",
    "group_weight": 10,
    "gate": false,
    "na_allowed": true,
    "question": "Who owns code, models and configurations built for us?",
    "why_it_matters": "Ownership decides what you can take with you.",
    "good_answer": "An intellectual property clause naming each.",
    "sources": []
  }
]