Practice Test Geeks(MAC) Marketing Analytics Certification Practice Test
← All MAC Flashcard Decks

Regulatory Compliance Flashcards

7 cards from real MAC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Compliance flashcards as text

  1. Under CAN-SPAM Act, within how many business days must a sender honor an opt-out request from an email recipient?

    Answer: 10 business days

    CAN-SPAM requires senders to process opt-out requests within 10 business days of receipt and stop sending to that address.

  2. Which of the following scenarios would most likely constitute a GDPR data breach requiring notification to the supervisory authority?

    Answer: An encrypted laptop containing customer email addresses is stolen

    Loss of a device containing personal data—even encrypted—may qualify as a breach requiring assessment and potential supervisory authority notification within 72 hours.

  3. What is the primary purpose of a Data Processing Agreement (DPA) between a marketing platform and its analytics vendor?

    Answer: To define how the vendor processes personal data on behalf of the controller, ensuring GDPR compliance

    A DPA legally binds the processor to handle personal data only as instructed by the controller, a requirement under GDPR Article 28.

  4. A marketer uses lookalike audience modeling by sharing hashed email lists with a social media platform. Which compliance consideration is most critical?

    Answer: Verifying that users consented to their data being shared with third-party platforms for advertising

    Sharing hashed emails with third parties for ad targeting requires a valid legal basis—typically consent—especially under GDPR and CCPA.

  5. Which US state law introduced the concept of 'sensitive personal information' with additional restrictions, including data about precise geolocation?

    Answer: California Privacy Rights Act (CPRA)

    CPRA, which amended CCPA, created a new category of 'sensitive personal information' with heightened protections including precise geolocation data.

  6. In marketing analytics, what is a 'legitimate interest' assessment (LIA) used for?

    Answer: Evaluating whether an organization's interest in processing personal data overrides the individual's privacy rights

    An LIA is a three-part test under GDPR that weighs the business purpose, necessity of processing, and impact on individual rights before relying on legitimate interest.

  7. Which regulation requires companies to disclose the categories of personal information collected and the purposes for which it is used, specifically in the context of US marketing analytics?

    Answer: California Consumer Privacy Act (CCPA)

    CCPA requires businesses to disclose at or before data collection what categories of personal information are collected and the business purposes for collection.