Privacy-first measurement guide
Privacy-first measurement means deciding deliberately what leaves your infrastructure rather than accepting what tags send by default — and the default is generous. The URL, the page title and the referrer travel with every event automatically, which is how a healthcare booking page ends up telling Meta the condition. The only real control boundary is a server container, because client-side filtering runs after the data is already inside a third party's script. This is a technical control, not a compliance certificate.
Free30 minutesNo obligation
Privacy-first measurement · what breaks
Where teams get this wrong — Privacy-first measurement
- 01
Assuming you chose what gets sent
The URL, title and referrer travel by default. Nobody decided that; it's just what tags do.
- 02
Treating client-side filtering as a boundary
It runs inside a third-party script that already has the data.
- 03
Confusing this with compliance
It's a technical control supporting a position your counsel defines.
Privacy-first measurement · the fix
What a correct implementation looks like — Privacy-first measurement
An inventory of every dispatched parameter
Written down and reviewable.
Stripping at the server container
Where you actually control the boundary.
Generic event names and paths
Where the specific one is sensitive.
Recording tools scoped deliberately
Form fields excluded.
Privacy-first measurement · architecture
What travels by default, and where to stop it — Privacy-first measurement
Six things most events carry without anyone choosing them.
- 1
The page URL
Sent with every event. If your path describes a condition, product or circumstance, you're dispatching that.
- 2
The page title
Same problem, and frequently overlooked because it's less visible than the URL.
- 3
The referrer
Carries the previous page. A confirmation reached from a sensitive landing page carries it along.
- 4
Form field values
Where recording tools or poorly scoped tags capture them. The largest unnoticed exposure in most audits.
- 5
Customer identifiers
Email and phone, hashed or not. Deliberate in many setups, accidental in others.
- 6
The control point
A server container, where you can strip before dispatch. Client-side filtering is not a boundary.
Privacy-first measurement · diagnose
Common mistakes and how to validate each — Privacy-first measurement
Ordered by how often we find them. Each one has a specific check rather than a general instruction to be careful.
- 01
Sensitive detail in the URL
Read a live payload from your most sensitive page. It's usually right there.
- 02
Page title overlooked
Check it separately. Teams fix the URL and leave the title describing the same thing.
- 03
Session recording capturing everything
Review what your recording tool masks by default. It's usually less than assumed.
- 04
Filtering client-side
Ask where the filter runs. If it's in the browser, the third-party script already had the data.
- 05
Consent assumed
Deny it and capture. Configuration is not evidence.
Privacy-first measurement · prove
How to prove your implementation is right — Privacy-first measurement
Against your own records and a live payload, not against a preview screen.
Source of truth
outbound network requests captured on your most sensitive pages
- A written inventory of every dispatched parameter.
- No sensitive detail present in any dispatched event, verified by capture.
- Recording tool scope reviewed and documented.
- Consent denial verified by capture.
- Checked on a live conversion, not in preview mode.
- Reconciled over a fully closed window, matched per record.
- Re-checked 30 days later.
Privacy-first measurement · free audit
What we check in the free audit
- Sensitive detail in the URL
- Page title overlooked
- Session recording capturing everything
- Filtering client-side
- Consent assumed
Checked against
outbound network requests captured on your most sensitive pages
Free30 minutesNo obligation
Privacy-first measurement · when not to buy
What this reference deliberately leaves out — Privacy-first measurement
Stated openly, because a reference that's silent about its own gaps is the dangerous kind.
- This is not legal advice and does not make you compliant with anything. It's a technical control supporting a position your counsel defines.
- Jurisdiction-specific obligations — CCPA, CPRA, GDPR, HIPAA and the rest — are outside our scope and require actual legal expertise.
- Data retention and subject access requests are adjacent obligations this doesn't address.
- Vendor documentation is the authority, not this page. Where the two disagree, the vendor is right and we'd like to know so we can correct it.
- Parameter names and behaviour change. Anything here is accurate as we last verified it; verify against the current documentation before you rely on it for a build.
Privacy-first measurement · what we deliver
The checklist — Privacy-first measurement
Every outbound parameter inventoried
URL, referrer, title, form fields, custom parameters.
Sensitive values stripped server-side
Before dispatch, verified by capture.
Page paths generalized where they're descriptive
A condition or product in the path travels with everything.
Session recording and heatmaps audited
Usually the largest unnoticed exposure.
Consent verified by denial, not configuration
Capture the traffic.
Pricing
Pick the package that fits your ad spend
Browser-side starter
$400One-time fee · lifetime ownership
Repairs and verifies your existing browser-side setup against this reference, on a live conversion.
- Implementation checked against the spec
- Verified on a live conversion
- Reconciled against your own records
- Written handover
1st-party server-side
Recommended$800One-time fee · most popular
Money events sent from your own records through a first-party container on your subdomain, built to this specification.
- First-party server container on your own subdomain
- Events from your records, not the browser
- Deduplicated on a shared event ID at every destination
- First-party cookies beyond Safari's 7-day cap
- 95%+ accuracy and 8+ Meta EMQ, guaranteed in writing
Full 1st-party stack
$1,800One-time fee · lifetime ownership
Every paid channel server-side plus the offline loop, documented to this standard.
- Everything in 1st-party server-side
- Pinterest, Snapchat, Reddit and LinkedIn CAPI
- CRM and offline conversion loop
- Refunds and cancellations corrected wherever each platform allows it
- Monitoring so the next break surfaces in days
FAQ
Privacy-first measurement questions, answered
No. It's a technical control that supports a compliance position someone qualified has to define. We reduce and document what leaves; we don't certify anything.
Session recording and heatmap tools capturing form fields. Most teams have never audited what those record by default.
Not meaningfully. Client-side filtering runs inside a script that already has the data. Only a server container is an actual boundary.
With every event, automatically. If your path describes a condition or circumstance, that's being dispatched whether or not anyone chose it.
Free · 30 min
Find out what your pages are actually sending
WhatsAppFree30 minutesNo obligation
