Privacy integrations: what counts as real enforcement versus theater?

TL;DR: Privacy platform “integrations” often conceal manual work, with many vendors only blocking tags, forwarding webhooks, or handing API work to customer engineers instead of enforcing downstream opt-outs, deletions, and consent choices across processing systems, according to Ketch. The real test is whether the integration changes what happens to data already held in downstream systems, not just what fires in a browser.

Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “The 5 questions that expose fake privacy integrations”.

Key questions

Q: What breaks when privacy integrations only capture requests and do not enforce them downstream?

A: The privacy right is captured but not honoured.

Q: When should teams prioritise downstream enforcement over easy DSR workflows?

A: Teams should prioritise downstream enforcement whenever the article claims consent, sell or share opt-out, or deletion coverage across processing systems.

Q: What are the signs that a privacy interface is failing users in practice?

A: Common warning signs include too many options, repeated prompts, preselected invasive settings, misleading wording, hidden privacy controls, inconsistent navigation, and information that is hard to find or understand.

Practitioner guidance

• Demand a setup walkthrough that exposes customer work Ask the vendor to show the full integration setup step by step and identify every place your team must write code, maintain scripts, or log into the destination system.
• Test downstream enforcement, not just tag blocking Run a live opt-out or deletion request into an actual downstream system and verify that the data already held there changes processing state.
• Verify identifier coverage across your stack Map which identifiers each downstream platform uses, including device IDs, anonymous IDs, and vendor-specific customer keys.

Bottom line: Privacy integrations often fail when vendors stop at intake, because capturing a request is not the same as enforcing it in downstream systems.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →