United Kingdom product teams often split the work: legal writes a notice, product writes events, a vendor ships a snippet. The Packet Ledger refuses that split for the identity module. You cannot design a join in the morning and “add GDPR” in the afternoon as if they were unrelated crafts.
The practical questions are blunt. Is this property personal data. Is this replay capturing fields we promised not to see. Does logged-out measurement rely on a device ID we would not want to explain to a person who asked. If the answer is awkward, the chart is not a victory.
What changes in the dictionary
We mark properties that should never have been events’ companions: email in plaintext, precise location on a loop that does not need it, free-text that people type into search. Those marks annoy teams who wanted “richer analytics.” They are still marks.
International transfers sit in our privacy notice because teaching tools often live outside the United Kingdom. Students should know that a clinic recording and a vendor SaaS are different processors with different stories. We are not your counsel; we are the studio that will not pretend a banner solved the join.
The public-sector companion app in our reviews page left with a darker logged-out map. That is an acceptable cost. A bright map built on an identifier they could not stand behind would have been a prettier failure.