Regulatory Compliance Flashcards
7 cards from real MAC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance flashcards as text
An analytics team wants to use customer purchase data to train an AI model for predicting churn. Which GDPR principle requires them to inform customers about this new use before proceeding?
Answer: Purpose limitation
Purpose limitation means personal data collected for one purpose cannot be reused for a new, incompatible purpose without informing and, if needed, gaining new consent from data subjects.
Under TCPA (Telephone Consumer Protection Act), which type of marketing communication requires express written consent from the recipient?
Answer: Making a robocall or sending an autodialed text message for promotional purposes
TCPA requires prior express written consent before making autodialed or prerecorded promotional calls or texts to mobile phones.
What is the key distinction between a 'data controller' and a 'data processor' under GDPR as it applies to marketing analytics?
Answer: The controller determines the purposes and means of processing; the processor handles data on the controller's behalf
Under GDPR, the controller decides why and how data is processed, while the processor acts on the controller's documented instructions.
A US-based marketing company transfers EU customer data to servers in the United States. Which mechanism is MOST commonly used to ensure this transfer is GDPR-compliant?
Answer: Standard Contractual Clauses (SCCs) approved by the European Commission
Standard Contractual Clauses (SCCs) are the most widely used mechanism to lawfully transfer personal data from the EU to third countries lacking an adequacy decision.
Which of the following best describes 'consent fatigue' as a compliance risk in digital marketing analytics?
Answer: Users habitually clicking 'accept all' on cookie banners without reading them, undermining the validity of consent
Consent fatigue occurs when users automatically accept all cookies or data collection without meaningful choice, which regulators increasingly consider invalid consent.
A marketing analytics firm retains customer behavioral data for seven years 'just in case it's useful later.' Which GDPR principle does this most clearly violate?
Answer: Storage limitation
Storage limitation requires that personal data be kept no longer than necessary for the purpose for which it was collected; indefinite retention without justification violates this principle.
Under the FTC's Endorsement Guides, what must a marketing analytics report disclose if influencer data is used to measure campaign performance for paid partnerships?
Answer: That a material connection exists between the brand and influencer, such as payment or free products
FTC Endorsement Guides require clear and conspicuous disclosure of any material connection between a brand and an endorser that could affect how consumers evaluate the endorsement.