Not every Penn website requires immediate action, and not every tool on a website creates equal risk. Understanding what's in scope and how to think about your own web presence is the first step toward knowing what your unit needs to do.
 

The consent management program applies to Penn-affiliated websites that use tracking technologies: scripts, pixels, tags, or other mechanisms that collect data about visitor behavior and share it with third parties.

Common examples of tracking technologies are:

• Analytics platforms, such as Google Analytics 4, Adobe Analytics, or similar tools that track page views, session behavior, or visitor demographics.
• Advertising and retargeting pixels, such as Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tracking, or any tag that connects your site activity to an ad platform.
• Social media embeds that load third-party scripts, including share buttons, embedded feeds, or login widgets from platforms like Facebook, Instagram, LinkedIn, or X.
• Session recording and behavioral tools, such as Hotjar, FullStory, or similar platforms that record or replay visitor interactions.
• Form, survey, and event tools that include their own tracking or analytics components beyond simple form submission.
  If you're not sure whether a tool on your site qualifies, surface it during your onboarding or at ISC office hours. The answer is rarely complicated once someone looks at the tool.
   

You may find that sites in your ecosystem are running tracking tools that their current administrators didn't install and aren't actively aware of. Scripts added during a past campaign, vendor tags that were never removed, third-party embeds that carry their own tracking logic. These accumulate over time.

ISC will provide you with a Little Forest-generated inventory of your unit's web properties during onboarding. Review it with that in mind. The goal isn't to assign blame for what's there. It’s to get a clear picture of what needs to be governed.

 

Not all sites are treated with equal urgency. Penn has defined Tier 1 criteria to identify the web properties that require priority attention: those with the broadest public reach, the most sensitive data-collection activities, or both.

If your unit has Tier 1 properties, those are your first implementation targets. Other properties follow in subsequent phases. ISC will identify which of your sites meet Tier 1 criteria when it provides your inventory.

What’s not in scope 

Internal tools and systems (applications that require Penn login, administrative platforms, and course management systems accessed through authentication) are generally outside the scope of this program as it currently applies. The consent requirement primarily applies to publicly accessible websites where anonymous or unauthenticated visitors can be tracked without their knowledge.

If you have a site that sits on the boundary (partially public, partially authenticated) flag it with ISC. These cases have answers; they just need a conversation.