Identifying privacy risk is only the first step—translating that risk into specific platform changes is where compliance is either built or lost. This module moves from analysis to action, focusing on the configuration decisions that determine whether privacy protections hold up under regulatory scrutiny or subscriber complaints. Learners work through the four settings that carry the most compliance weight: consent capture and timestamp recording, suppression list management, data retention rules, and integration permissions. Using Klaviyo as the working environment, the module covers not only what to configure but how to distinguish nonnegotiable compliance requirements from best practices and how to document changes in a way that is defensible. By the end of this module, you will be able to configure your email marketing platform's core privacy settings, restrict integration permissions to the minimum necessary access, and produce a documented record of configuration decisions with their compliance rationale.

Accurate platform configuration protects a brand operationally; accurate documentation makes those protections visible, defensible, and trustworthy. This module addresses the gap that most marketing teams carry: practices that are largely sound but nowhere clearly written down. Learners work through the essential components of a marketing privacy statement—data use disclosures, subscriber rights language, opt-out instructions, and retention terms—understanding how each element serves both a regulatory obligation and a subscriber trust function. The module then applies this foundation to the two disclosure surfaces subscribers actually encounter: email footers and preference centers. A culminating lab brings all three modules together as learners produce a complete privacy strategy document capturing their data collection rationale, handling procedures, and subscriber-facing disclosure language. By the end of this module, you will be able to draft compliant, readable privacy documentation for marketing operations, including a privacy statement, email footer, and preference center, that accurately reflects your current data practices and meets the disclosure obligations of GDPR and CCPA.