2,014 domains, one consent gate

Years of acquisitions had left the group with more domains than anyone could account for. Trackers were loading on sites without a consent mechanism, and a lead-attribution tool ran on every page regardless of consent. The group needed an inventory and a way to gate tracking while retaining attribution for visitors who agreed to it.

I probed 2,014 domains, recording DNS, redirects, parked sites and matches against 70+ tracker signatures. Then I checked apparent live sites in a headless browser to catch tags injected by JavaScript. A slower retry of timed-out domains recovered 189 and found 3 live sites with tracking and no consent controls. I prioritized the redirect hubs; the largest received 419 forwards. I also changed the attribution connector to wait for analytics consent and check saved consent on return visits.

The audit identified 27 live sites, with 22 needing consent management. The triage was 14 critical, 7 upgrade, 1 verify and 5 no-action. Each finding names the gap. I delivered 22 draft privacy policies for counsel to review, along with the probe pipeline and severity matrix. The revised connector retains first-touch attribution for consented traffic and does not track visitors who decline. The audit is delivered; rollout is still in progress.