Cookie & Script Governance Sprint

Five to six weeks for one web property. Week one is a runtime baseline in a fresh browser: what fires before consent, after reject, and after accept. Then a three-way diff of observed, declared, and intended tracking, classification and an owner hunt for every item, and approve, gate, or remove decisions with the consent platform and cookie policy synced to the register on the same change.

Three things. A named program owner on your side, named before the sprint starts, because the register and the monthly cadence transfer to that person at handover. Access to your consent platform and tag manager. And business owners who can answer three questions about their tags: what is it, why is it used, and who uses it. If nobody can be named as owner, the sprint is not a fit yet.

No. The sprint works with the platform you already run. Platforms classify cookies by the domain that set them, which is how a Google Analytics cookie ends up labelled first-party. The sprint adds the layer platforms do not provide: runtime verification, classification by the organisation that receives the data, ownership, and documented approval decisions.

Your team runs a monthly runtime audit and a quarterly register review using the templates and cadence from the engagement, and every approval expires within 12 months unless it is re-approved. An optional quarterly retainer covers the register review, annual re-approval, and review of high-risk vendor changes. Scope, timing, and commercial terms are confirmed in the proposal after a short discovery call; no pricing is published.

No. The sprint produces technical and governance evidence: what fires, who receives it, who owns it, and what was decided. Final legal interpretation stays with your counsel or data protection officer, and the register records who decided each item and on what basis.