We still meet GB teams where the consent management platform records a reject, ATT is not determined, and the MMP SDK has already queued a “session start” because the default was “fire until told otherwise.” Privacy-Safe Mobile Measurement is not only SKAN maps. It is the order of those three clocks.
Product owns the prompt. Legal owns the CMP text. Growth owns the MMP. The gap sits in engineering: a flag that must be false until both ATT (where relevant) and the CMP agree. When we audit, we ask for the commit that sets that flag, not the policy PDF.
A mismatch that lasted nine days
An audio app updated MMP versions and inherited a new default for “waiting for ATT.” Sessions during those nine days were not huge. They were enough to poison a conversion-value test, because trial starts from that window were mixed with later, cleaner traffic. The fix was a version pin and a note in the Monday pack, not a press statement.
Who replies when someone asks
If a regulator-shaped question arrives, “the vendor defaulted” is not an answer you want on letterhead. Name an owner for SDK defaults in the same document as the conversion-value map. We keep a one-line field for this in the Signal Desk worksheets.
Questions about a private audit can go to the studio.