Why a privacy assessment should come before the campaign brief, not after

The usual order — and why it fails

In many teams the sequence is: brief, creative, list pull, schedule, then a compliance review a day or two before launch. By then the list is built, the creative assumes a channel, and the date is promised. A review at that point has two outcomes: wave it through, or cause a delay nobody planned for. Neither is good governance.

What changes when the assessment comes first

• The list is built from usable records. Contacts with unknown or missing consent for a channel are separated before segmentation, not discovered at QA.
• The channel follows the consent. If most of an audience is opted in for email but not for texts, that shapes the plan — not the other way around.
• The rules are known up front. Audience location and channel decide which laws apply — the TCPA and state rules like Texas SB 140 for texts, CAN-SPAM for email, state privacy laws for targeting.
• AI use is scoped early. If a model will draft or score, the assessment sets what data it may see before anyone connects it.

Five questions to answer before writing the brief

1. Where did each record in this audience come from?
2. For each planned channel, what is each contact's consent and opt-out status?
3. Which states and countries are the recipients in, and which rules follow from that?
4. Does our privacy notice cover this use of the data?
5. Which vendors and AI tools will touch the data, and are they allowed to?

How Zielit runs it

Every Zielit campaign is checked against consent status before launch, and the privacy assessment happens at the discovery stage — before strategy, before the list. Keeping it true over time is the job of privacy governance.