How we review measurement suppliers, grading the evidence state rather than the claim

A privacy first measurement review methodology needs an audit trail before it needs a score. The reviewer should be able to show which claim came from marketing copy, which term appears in a contract and which result the buyer reproduced.

What to take away

Scope and disclosure

The privacymeasurement.co.uk research desk prepared this method on 5 September 2026 for buyers in England and inspected cited public regulator and standards pages only.

No provider was contacted, paid or given editorial control; no affiliate scheme, referral payment, free account, demonstration or trial was used, so hands-on testing was none. Untested: collection behaviour, report accuracy, security controls, accessibility and support. Untested: exports, deletion and contractual performance.

The bounded verdict is methodological: use the process for a controlled shortlist, but do not issue a provider approval from desk evidence. Named privacy, PECR, security, accessibility and contracts reviewers must sign their own gates.

Fix the decision and candidates

Write the buyer decision, service, users, England or UK population, data categories and required date. Discover candidates through existing contracts, regulator material, standards owners, first-party supplier pages and a documented market search. Record search terms and closing date.

Inclusion requires a live service record, an accountable contracting entity, published or supplied terms, a response route and willingness to support the buyer's evidence request. Exclude abandoned offers, unauthorised resellers and services that miss a non-negotiable deployment boundary. Keep an exclusion log.

Apply one criterion register

Ask every candidate the same questions about:

The ICO's processor-contract guidance lists required contract topics but says commercial terms may need professional advice. Do not award privacy points simply because a supplier calls itself a processor.

For security, use the NCSC cloud principles to turn broad claims into questions about tenant separation, identity, operations, supply chain, interfaces and audit information. The principles do not certify a service.

Accessibility needs task evidence against the chosen standard and interface. WCAG 2.2 is a normative technical recommendation, while its supporting techniques are informative, as W3C explains in its WCAG document guide. Record browsers, assistive technologies, users, defects and retest date.

Grade the evidence state

Mark each answer absent, asserted, specified, demonstrated or buyer-tested. Preserve the page, document version, date, configuration and reviewer. A supplier assertion can justify another question. It should not equal a reproduced test.

Sample evidence across the risky path, not only the easiest screen. Include a refused permission state, a changed metric definition, a failed login, an inaccessible task and an attempted full exit. Record expected behaviour before execution so a surprising result cannot be explained away afterwards.

Do not average mandatory failures into a total. Use hold when a required contract clause, transfer record, permission test, critical accessibility task or reconciled export is missing. Recheck after changes to product version, region, terms, subprocessors, collection design or buyer purpose.

If the review is published as consumer-facing commercial content, check how incentives and review information are presented. The CMA's fake reviews publication links the guidance for provisions introduced in April 2025. Qualified consumer-law review is still needed for the actual page.

The final review record names the decision owner, each specialist approver, dissent, unresolved evidence, verdict and expiry date. That record makes a cautious result useful without pretending the desk inspected a live service.

Before you act

Common questions

What does the research desk say it did and did not inspect?

It inspected cited public regulator and standards pages only, on 5 September 2026 for buyers in England. No provider was contacted, paid or given editorial control, and no affiliate scheme, referral payment, free account, demonstration or trial was used. Hands-on testing was therefore none.

Which areas remain untested under this method?

Untested areas include collection behaviour, report accuracy, security controls, accessibility, support, exports, deletion and contractual performance. The bounded verdict is methodological, so the process suits a controlled shortlist but cannot support a provider approval from desk evidence alone.

How should a reviewer handle a mandatory failure?

Do not average mandatory failures into a total. Use hold when a required contract clause, transfer record, permission test, critical accessibility task or reconciled export is missing. Recheck after changes to product version, region, terms, subprocessors, collection design or buyer purpose.