Reviewing measurement products and agencies without manufacturing a ranking

What to take away

Scope and testing limits

A privacy-first measurement review should tell a buyer what the evidence supports and where it stops.

A product page can establish that a supplier publishes an export route, but it cannot prove the export is complete for a particular account. A public agency page can describe an audit service. It cannot establish the quality of work that is not commissioned or inspected.

This method is for organisations in England planning a 2027 purchase or renewal. ICO privacy and PECR material applies across the UK.

Global supplier documentation covers only the named product. The research desk checked the cited pages on 5 September 2026. Nothing was tested: no account, code, contract, support exchange or accessibility interface. No security control, export or agency deliverable was tested.

No supplier funded the work. There are no affiliate links, referral payments, free licences or undisclosed demonstrations. The author and fact-checker remain unassigned.

A named privacy professional, PECR adviser and security specialist must assess the buyer's real proposal. An accessibility practitioner, statistician and contracts or procurement reviewer must also sign off before publication or purchase.

State the review decision first

A review needs one decision. Examples include whether to invite a supplier to a controlled trial, whether an agency may receive limited discovery data, or whether a renewal should pause until export evidence is available. "Which is best?" is not a usable decision, because the answer changes with the service, people, data and exit requirement.

Write five fields before searching:

Set the verdict vocabulary in advance. "Evidence shortlist" means public records justify asking the supplier for buyer-specific proof. "Trial with restrictions" permits only the named test data and period.

"Hold" means a material question is unanswered. "Reject for this use" is a decision about the buyer's stated requirement, not a general judgment on quality.

Publish who reviewed what

Readers should not have to infer whether a review came from product use or desk research. Record the review owner, date, materials, search route and last page check. List every supplier contacted and every incentive, including an unsuccessful offer. Explain who paid for the work and whether links can generate commission.

The review record should separate:

Do not write "we tested" after watching a vendor demonstration. Observation and operation are different evidence.

A hands-on claim needs the account type, version, region, settings and test data. It also needs the task script, expected result, actual result and date. Preserve screenshots or logs where the contract permits. A result in a sandbox does not automatically describe production.

Discover candidates without manufacturing a ranking

Use a reproducible discovery route. Search the buyer's existing contracts, directly responsible regulators, relevant standards owners and first-party supplier records. Record the terms used and closing date. Invite candidates under the same evidence request where procurement rules allow. Remove options that fail declared eligibility rather than silently dropping inconvenient results.

An inclusion rule might require service availability for an England organisation, a live legal entity, published terms, a response route, an export mechanism and acceptance of a controlled trial. Exclusions might cover abandoned products, resellers without authority to answer the evidence request, or services that cannot meet a mandatory deployment boundary.

Companies House can support an identity check, but its register disclaimer says that filing on the public record does not mean the information has been verified or validated. Registration is not evidence of capability, solvency, data protection compliance or service quality.

Certification also has a defined boundary. The ICO says on its certification guide that a certificate can support due diligence for the processing activity covered, while wider responsibilities remain. Record the scheme, certificate holder, scope and version. Record the expiry and current register status. Never turn a badge into an overall approval.

Compare on one set of criteria

Apply the same evidence question to every candidate. A useful comparison register has eight columns.

Measurement fit

Define the events, calculations, populations, reporting delay and decisions required. Ask how the candidate handles exclusions, duplicate events, time zones, late arrivals and definition changes. A dashboard resemblance is not evidence that two tools calculate the same measure.

Collection and PECR

Map every storage or access operation, purpose and party. Record behaviour after acceptance, refusal and withdrawal. The ICO's final April 2026 storage and access guidance covers cookies, pixels, scripts and other technologies. A label such as first party, cookieless or server side does not decide the rule.

UK GDPR roles and privacy

Identify purposes and actual decision-making before assigning controller, processor or joint-controller roles. Then inspect lawful basis, transparency, minimisation and retention. Check rights handling and data-protection impact assessment needs. Keep this review separate from PECR, because a permitted device operation does not settle later personal-data processing.

Where a processor relationship exists, compare the proposed document with the ICO's controller and processor contract guidance. That page is under review following legislative change and recommends professional advice for commercial terms. A published data processing agreement is evidence to inspect, not proof that the parties have the right roles or an adequate negotiated contract.

Security

Ask for architecture, tenant separation, authentication, privileged access and encryption. Ask for secure development, incident notification, logging and resilience. Ask for subcontractor details and deletion evidence.

The NCSC's cloud security principles apply to SaaS and place secure configuration responsibilities on customers as well as providers. A certification can inform this work but cannot replace threat-led testing or continuing assurance.

Accessibility

Define the user tasks that must work with keyboard, screen magnification, screen readers and other relevant assistive technology. Ask for a current accessibility statement, known issues, remediation process and product-specific test evidence.

The normative WCAG 2.2 recommendation contains testable success criteria. A supplier's general claim does not prove that the chosen interface, embedded report or exported file conforms.

Contract and service operation

Compare service definition, support route, response and restoration measures, and planned changes. Compare audit rights, subcontractor change, liability, intellectual property and termination help. Do not infer these terms from a feature page. Record the controlling contract version and any negotiated order form.

Portability and exit

Test export format, detail level, definitions, identifiers, time zone. Test date range, filters, row limits, imported-data treatment, access after notice.

Reconcile the export to a known report, then restore it into a buyer-controlled environment. Where personal information crosses a UK boundary, use the ICO's January 2026 international transfers guide to identify responsibilities and the relevant transfer route, because hosting location alone does not resolve every access or onward-transfer question.

Evidence quality

Tag each claim as observed, supplier-asserted, contractually committed, independently assessed or buyer-tested. Give it a date and configuration. Marketing copy may be useful for discovery, but it should not score like a completed test or signed obligation.

Score evidence, not prestige

Use an ordinal evidence state rather than fabricated precision:

These values show maturity of evidence, not product performance. Do not add them into a league table unless the buyer has justified weights, minimum gates and treatment of missing evidence before results are known. A product with more documentation may score higher than a simpler service without being more suitable.

Apply mandatory gates before preferences. A missing export for a hard exit requirement is not cancelled out by a polished interface. A failed permission-state test is not offset by a favourable service reference. Keep red lines visible instead of averaging them away.

Read product evidence narrowly

First-party documentation can create useful, testable propositions. Matomo Cloud's current data processing agreement describes processing terms, export timing and deletion after termination. A buyer still needs to check the applicable service, configuration, agreement and UK transfer position.

Plausible Analytics publishes several export routes in its product documentation, with different limits and treatment of imported data. That supports a trial script, not a claim that every required field will be portable.

Fathom Analytics describes configurable CSV exports on its export page. The account, entitlement, contents and reconciliation were not tested for this guide.

Simple Analytics publishes EU data hosting and a no-cookie default, with paid plans and a free trial. A buyer should verify the current plan limits, retention terms and export route before a trial.

Umami Cloud offers a free cloud tier and paid plans, while the open-source Umami software can be self-hosted. A buyer should check the cloud region, data processing terms and export format before relying on either route.

For any named supplier, re-open its service page, legal terms, subprocessors, security record and export instructions on the decision date. Product documentation can change without the buyer's comparison changing automatically.

Handle reviews and testimonials carefully

Separate editorial assessment from customer reviews. Do not scrape praise into a performance score. Record whether a reviewer was verified, incentivised, selected or moderated, and whether negative submissions were excluded. The CMA's fake reviews guidance explains the UK consumer-law provisions introduced in April 2025 for businesses that publish consumer reviews.

If a review becomes marketing content, CAP's July 2026 testimonial advice says marketers should hold documentary evidence that a testimonial is genuine and should not conceal a material commercial interest. Its remit and legal status are limited, so a qualified advertising or consumer-law reviewer must assess the final publication.

Case studies belong in a separate evidence column. Confirm the named client, original scope, period and baseline. Check exclusions and permission to publish. A supplier-written case study is first-party evidence of what the supplier says happened. It is not independent reproduction and rarely establishes what another buyer will achieve.

Review agencies through deliverables

An agency review should begin with an anonymised task and evidence request, not with logos. Ask each candidate to map a supplied data flow, identify unresolved questions, propose a verification plan, define handover artefacts and show how it would manage a failed privacy or quality gate. Score the response against the same rubric.

The same method applies to named measurement and research agencies. Ipsos runs polling and market research across many countries, including the UK. Kantar publishes brand, media and audience measurement work. Nielsen provides audience measurement, including television ratings panels. Comscore measures cross-platform audiences. YouGov runs panel-based surveys and polling.

Their public pages describe services, not fitness for a particular buyer.

Require named delivery roles, substitution rules, conflicts, subcontractors and quality assurance. Test a small paid discovery phase with non-production or minimised data. Inspect the actual output: inventory, decision log, test evidence, issue severity and remediation owner. Also check code or configuration ownership and the exit pack.

References can confirm that a person gave a view about a particular engagement. They do not prove causation, universal competence or fitness for the buyer's different system. Obtain permission, ask the same questions and record the relationship between referee and supplier.

Make the 2027 decision reversible

Current documentation supports a decision now, not a prediction that a service will remain unchanged through 2027. Put a recheck date against product scope, terms, subprocessors and prices. Do the same for certifications, support routes and regulatory guidance. State which change reopens the comparison.

Use a controlled trial with synthetic or minimised data, a fixed test script and an exit rehearsal. Stop if collection differs from the approved map, a required contract term is absent or an unexplained transfer appears. Stop if access controls fail, a critical task is inaccessible, exports cannot be reconciled or the provider refuses necessary evidence.

The final record should show one bounded verdict, dissent, unresolved items, approvers and expiry. A review that ends in "hold" has succeeded when it prevents a weakly evidenced purchase. Publication must remain on hold until the named editorial and specialist reviewers sign their parts and every current claim is checked again.

Before you act

Common questions

What should a review record separate?

It should separate public first-party pages and terms, regulator or standards material, and documents supplied privately during procurement. It should also separate demonstrations observed, hands-on tasks completed with a stated configuration, and areas left untested. This keeps the reader from confusing a vendor demonstration with actual operation of the product.

Why is a certification badge not an overall approval?

The ICO says a certificate can support due diligence for the processing activity covered, while wider responsibilities remain. Record the scheme, certificate holder, scope and version. Record the expiry and current register status. A badge does not settle capability, security or every processing purpose the buyer may need.

How should a buyer approach portability and exit?

Test export format, level of detail, definitions, identifiers and time zone. Test date range, filters, row limits, imported-data treatment and access after notice. Reconcile the export to a known report and restore it into a buyer-controlled environment. Where personal information crosses a UK boundary, use the ICO international transfers guide.