# A new tracking script requires a standing review process ## Claim Adding a new tracking pixel or embed to a site is a compliance event, not a drop-in convenience — it has to be manually reflected in the site's consent configuration, because automated consent-tool scans are a backup safety net, not a substitute for deliberate review. ## Evidence **Source**: [[3. Resources/Literature Notes/3 Things All Website Owners Need to Check for Privacy Compliance Hans Skillrud]] ## Scope & conditions - Holds when: multiple people touch a site over time (marketing adds an ad pixel, a developer adds an analytics script) without a shared checklist — the most common failure mode named in the talk's Q&A. - Breaks when: a solo owner already treats every script addition as a one-person checklist item; the process still has to exist, but it doesn't need to be a team artifact. ## Links - [[3. Resources/Permanent Notes/Consent Gating Must Be Verified Not Assumed]] — extends: verifying the gate once isn't enough if new scripts keep entering the site without being wired into it <!-- atomicity: 1 idea ✓ --> - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: Closest fit: a site-compliance and privacy-risk note beside the WordPress security and hosting material.