{
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "checkpoints": [
    {
      "id": "CP-01",
      "url": "/blog/baa-vs-hipaa-authorization-ad-platforms",
      "area": "US health privacy",
      "jurisdictions": [
        "US federal"
      ],
      "question": "BAA, authorization, or both: what covers an ad platform that receives PHI?",
      "why_open": "Business associate status follows what a recipient does, not what it signs. An authorization can permit a disclosure to a recipient acting for itself. Lawyers differ on platforms that do both.",
      "ask": [
        "Is each recipient acting for us or for itself, function by function?",
        "Does our authorization form meet 45 CFR 164.508, including the marketing and remuneration statements?",
        "How does a revocation reach every recipient?"
      ],
      "appears_on": [
        "/blog/hipaa-compliant-programmatic-advertising",
        "/blog/pixel-problem-healthcare-marketing"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-02",
      "url": "/blog/hipaa-de-identification-ad-audiences",
      "area": "US health privacy",
      "jurisdictions": [
        "US federal",
        "US states",
        "EU and UK"
      ],
      "question": "Is a hashed, cohort or clean-room audience de-identified?",
      "why_open": "HIPAA has two de-identification methods, and state laws and GDPR use different tests. Hashing or a large cohort does not by itself meet any of them. Experts and lawyers differ on releases that keep a join key.",
      "ask": [
        "Which method covers this exact release and this recipient?",
        "Is any key in the release a listed identifier or derived from one?",
        "Which state or EU test also applies to the same data?"
      ],
      "appears_on": [
        "/blog/hipaa-compliant-programmatic-advertising",
        "/blog/state-health-privacy-laws-ad-tech-tracker",
        "/blog/pixel-problem-healthcare-marketing"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-03",
      "url": "/blog/modpa-strictly-necessary-advertising",
      "area": "US state privacy",
      "jurisdictions": [
        "Maryland"
      ],
      "question": "Can health data be used for advertising under Maryland's \"strictly necessary\" rule?",
      "why_open": "Maryland limits sensitive data to what is strictly necessary for a product or service the consumer requested and bans its sale. Consent is not an exception. How the test applies depends on the service the consumer requested and the data each step uses.",
      "ask": [
        "Does the Act reach this data after its exemptions and thresholds?",
        "What did the consumer request, and is each processing step needed for it?",
        "Is any transfer in the flow a sale?"
      ],
      "appears_on": [
        "/blog/hipaa-compliant-programmatic-advertising",
        "/blog/state-health-privacy-laws-ad-tech-tracker"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-04",
      "url": "/blog/tracking-pixel-wiretap-party-exception",
      "area": "US litigation",
      "jurisdictions": [
        "US federal",
        "California",
        "other states"
      ],
      "question": "Is a healthcare site's tracking pixel an unlawful interception?",
      "why_open": "Federal and state wiretap laws are worded differently, and courts apply the party exception and its crime-or-tort limit in different ways. Results turn on the forum, the defendant's role and the record.",
      "ask": [
        "Which statutes and forums are realistic for our sites and users?",
        "What evidence shows consent before the first transmission?",
        "Does any vendor use the data for its own purposes?"
      ],
      "appears_on": [
        "/blog/hipaa-compliant-programmatic-advertising",
        "/blog/pixel-problem-healthcare-marketing"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-05",
      "url": "/blog/glba-service-provider-exception-advertising",
      "area": "US financial privacy",
      "jurisdictions": [
        "US federal",
        "California",
        "Vermont"
      ],
      "question": "Which Regulation P route covers an advertiser, a DSP or a clean room?",
      "why_open": "The service provider exception needs a vendor that works for the institution under a contract limiting use. Lawyers differ on merchant-funded and offsite campaigns, where the ad promotes the merchant's brand.",
      "ask": [
        "Which route covers each recipient in the flow?",
        "Does any merchant-facing output contain nonpublic personal information?",
        "Do state rules require opt-in for this sharing?"
      ],
      "appears_on": [
        "/blog/glba-advertising-bank-data",
        "/blog/bank-media-network-without-moving-customer-data"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-06",
      "url": "/blog/card-networks-glba-coverage",
      "area": "US financial privacy",
      "jurisdictions": [
        "US federal",
        "US states"
      ],
      "question": "Does GLBA reach a card network directly, or only through issuer contracts?",
      "why_open": "GLBA defines financial institutions by activity. Lawyers differ on how that applies to a network entity, and on what a network may do with payment data in a media business.",
      "ask": [
        "Which legal entity and which activity are we dealing with?",
        "Under which route did the data reach it, and what reuse does that route allow?",
        "What standard do its \"aggregated\" outputs meet, and who tested it?"
      ],
      "appears_on": [
        "/blog/glba-advertising-bank-data",
        "/blog/bank-media-network-without-moving-customer-data"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-07",
      "url": "/blog/bank-transaction-data-advertising-gdpr-psd2",
      "area": "EU and UK data protection",
      "jurisdictions": [
        "EU",
        "UK"
      ],
      "question": "Can bank transaction data drive advertising in the EU and UK?",
      "why_open": "GDPR, PSD2, ePrivacy and UK law each ask a different question, and a US disclosure route answers none of them. Authorities and lawyers differ on legitimate interests, sensitive inferences and data about the other party to a payment.",
      "ask": [
        "Which lawful basis covers each purpose?",
        "How are silent-party and special-category data kept out of advertising uses?",
        "What differs for the same campaign in the UK?"
      ],
      "appears_on": [
        "/blog/gdpr-eprivacy-bidstream-tcf",
        "/blog/glba-advertising-bank-data",
        "/blog/bank-media-network-without-moving-customer-data"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-08",
      "url": "/blog/privacy-settlement-status-how-to-read",
      "area": "US litigation",
      "jurisdictions": [
        "US federal and state courts"
      ],
      "question": "What does a pixel settlement prove?",
      "why_open": "A settlement notice states proposed terms and a hearing date. It is not a finding of liability, and the amount paid can differ from the fund. Lawyers weigh settlements differently when they estimate exposure.",
      "ask": [
        "Which cases resemble our facts?",
        "What do they show about claims and forums, and what do they not show?",
        "How should reserves and insurance respond?"
      ],
      "appears_on": [
        "/blog/pixel-problem-healthcare-marketing"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-09",
      "url": "/blog/contextual-advertising-personal-data-gdpr",
      "area": "EU and UK data protection",
      "jurisdictions": [
        "EU",
        "UK"
      ],
      "question": "Is a context-only ad request outside GDPR and ePrivacy?",
      "why_open": "A URL, an IP address or a user-agent string can identify a person or reveal sensitive context. Authorities and lawyers differ on truncated data and on requests sent without reading the device.",
      "ask": [
        "Which fields are personal data, for us and for each recipient?",
        "Does any step read from or store on the device?",
        "What do we send when no valid choice is recorded?"
      ],
      "appears_on": [
        "/blog/gdpr-eprivacy-bidstream-tcf",
        "/blog/bank-media-network-without-moving-customer-data"
      ],
      "status_checked": "2026-11-10"
    },
    {
      "id": "CP-10",
      "url": "/blog/tcf-consent-string-lawful-basis",
      "area": "EU and UK data protection",
      "jurisdictions": [
        "EU",
        "UK"
      ],
      "question": "Is a TCF consent string enough for GDPR?",
      "why_open": "The framework records and passes signals under contractual policies. It does not create a legal basis. Regulators and industry differ on legitimate interests for advertising and on what a string proves.",
      "ask": [
        "Which legal basis covers each purpose we use?",
        "Does our consent interface meet the standard in each country we serve?",
        "What evidence exists beyond the string?"
      ],
      "appears_on": [
        "/blog/gdpr-eprivacy-bidstream-tcf",
        "/blog/bank-media-network-without-moving-customer-data"
      ],
      "status_checked": "2026-11-10"
    }
  ]
}