Practice Test Geeks(MAC) Marketing Analytics Certification Practice Test
← All MAC Flashcard Decks

Regulatory Compliance Flashcards

7 cards from real MAC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Compliance flashcards as text

  1. Which US privacy regulation specifically requires a 'Do Not Sell or Share My Personal Information' link on a business's homepage?

    Answer: CPRA (California Privacy Rights Act)

    CPRA, which amended CCPA, requires businesses that sell or share personal information to provide a 'Do Not Sell or Share My Personal Information' link on their homepage.

  2. What is the maximum fine per violation under COPPA for companies that illegally collect data from children under 13 without parental consent?

    Answer: $51,744

    The FTC can impose civil penalties of up to $51,744 per COPPA violation (adjusted periodically for inflation), making violations extremely costly at scale.

  3. A brand's analytics platform automatically tracks users across multiple websites via third-party cookies. With the deprecation of third-party cookies, which compliance-friendly alternative preserves audience insights?

    Answer: Using a server-side first-party data strategy combined with privacy-preserving APIs like Google's Privacy Sandbox

    Server-side first-party data collection and privacy-preserving APIs offer audience insights while respecting user privacy and avoiding cross-site tracking without consent.

  4. In a marketing analytics context, what is a 'data subject access request' (DSAR) and what is the typical response timeframe under GDPR?

    Answer: A request by an individual to access their personal data held by an organization, responded to within one calendar month

    Under GDPR Article 15, individuals can request a copy of their personal data, and organizations must respond within one calendar month (extendable by two more months for complex requests).

  5. Which principle in the IAB's Transparency and Consent Framework (TCF) ensures that ad tech vendors can only process user data for purposes the user has explicitly agreed to?

    Answer: Purpose-based consent signaling

    The IAB TCF transmits user consent signals tied to specific purposes, ensuring each participating vendor can only process data for the purposes a user has consented to.

  6. A marketing analytics team segments customers using inferred health-related attributes derived from purchase behavior. Under HIPAA, when would this activity trigger compliance obligations?

    Answer: Only when the analytics team is a covered entity or business associate handling protected health information (PHI)

    HIPAA applies only to covered entities (healthcare providers, insurers) and their business associates; a general marketer inferring health attributes from purchase data is typically not subject to HIPAA.

  7. What is the primary risk of relying solely on 'implied consent' for email marketing list building in a GDPR-compliant program?

    Answer: GDPR generally requires freely given, specific, informed and unambiguous indication of agreement, which implied consent does not satisfy

    GDPR's definition of valid consent requires an unambiguous affirmative act; implied or pre-ticked consent does not meet this standard and can expose organizations to significant fines.