Data Privacy for SEO, AEO/GEO and AI: A Practical Checklist
Privacy management for SEO, AEO/GEO and AI begins with understanding what your website collects, why it collects it and who receives it. Teams can then configure measurement, permissions, retention and user-request handling according to verified requirements.
This checklist helps site owners, agencies, marketing teams and developers coordinate implementation. It is technical and operational guidance, not a compliance certification or a ready-made legal policy for every business.
1. Confirm scope before choosing tools
Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP took effect on January 1, 2026. Businesses should assess their actual activities against current requirements, including processing roles, purposes, data categories and overseas providers.
When serving other markets, determine whether additional rules apply, such as the GDPR or California privacy requirements where their conditions are met. A cookie banner or data processing agreement does not automatically satisfy every obligation.
Suggested ownership: legal specialists confirm applicable rules, the site owner approves scope, developers implement controls, marketing/SEO checks measurement, and administrators manage access and user requests.
2. Map website data flows
Include both information entered into forms and data collected automatically. Routine SEO work does not require unrestricted access to customer personal information.
| Data source | Examples | Confirm |
|---|---|---|
| Contact forms and CRM | Name, email, phone number, request details | Required fields, access and retention |
| Analytics and advertising | Events, identifiers, landing pages, sources | Purpose, processing basis and user choices |
| Operational logs | IP address, time, URL, user-agent | Security needs, filtering and permissions |
| Chatbot or AI service | Prompts, conversations, attachments | What the provider receives, retains and uses for training |
| SEO/AEO/GEO reports | Queries, evidence screenshots, aggregated metrics | Exposure of private information or client accounts |
A minimum inventory should record purpose, fields, source, recipients, owner, retention, verified processing basis and deletion procedure. Do not collect additional identifiers merely because a tool supports them.
3. Configure consent and your CMP by purpose
A consent management platform manages choices; it does not determine whether processing is lawful. Identify which activities require consent and which may rely on another applicable basis rather than applying one assumption to all processing.
- Explain each purpose clearly, separating necessary functions from analytics, advertising, personalization and AI use where relevant.
- Do not bundle a request for consultation with unrelated optional processing.
- Where prior consent is required, prevent the corresponding activity until a valid choice is recorded.
- Provide accessible privacy settings so users can review and change choices.
- Propagate choices to relevant tags, embedded services and server endpoints rather than changing only the banner interface.
- Keep proportionate evidence: notice version, selected purposes, timestamp and an appropriate reference. Consent records also need protection.
When consent is withdrawn, update relevant processing according to the applicable rules and procedure. Withdrawal does not automatically require immediate deletion of every record: distinguish purposes and any independently verified retention grounds.
Test actual network behavior
- Start a fresh session before interacting with the banner; inspect cookies, browser storage and outbound requests.
- Test rejection, acceptance by category, changed choices and page reloads.
- Check forms, embedded video, chat, checkout and different templates.
- Compare choices with actual browser and server payloads, and retain test evidence.
4. Server-side tracking is not a consent bypass
Routing events through a server can support field filtering and recipient control. However, data is still processed and may still be forwarded. Choose this architecture where it offers clear benefits and the team can maintain it.
- Allow only approved events, fields and recipients.
- Enforce relevant choices and processing rules at the endpoint, not only in the browser.
- Prevent unapproved emails, phone numbers, form text, tokens and private URL parameters from reaching analytics.
- Filter debug logs, queues, backups and error payloads as well as the main event stream.
- Test rejection/withdrawal behavior and event deduplication.
Understand basic and advanced Google Consent Mode
In basic implementations, Google tags are blocked when the relevant consent is absent. In advanced implementations, tags can load and send cookieless measurements while consent is denied. “No cookies” therefore does not mean “no data transmission.” Select a configuration according to verified requirements rather than treating a product mode as a legal conclusion.
5. Separate hashing, pseudonymization and anonymization
| Measure | Purpose | Limitation |
|---|---|---|
| Hashing or identifier substitution | Reduce direct identifier exposure | Matching or linkage may remain possible; not automatically anonymous |
| Encryption | Protect stored or transmitted data | Authorized key holders can read it; personal-data status does not disappear |
| Aggregation | Report at group level | Small groups or combined datasets can still reveal individuals |
| Anonymization | Meet the applicable standard for preventing identification | Requires re-identification risk assessment; removing names is insufficient |
European Commission GDPR guidance explains that pseudonymized data remains personal data when individuals can still be re-identified. Do not claim that hashing permits unrestricted sharing.
Set retention according to purpose and applicable obligations. Ninety days is not a universal legal standard for logs. Define deletion schedules, verification and backup handling, with documented exceptions and accountable approval where needed.
6. Distinguish AI inference, retrieval and training
Sending a prompt for an answer, indexing documents for retrieval and training or fine-tuning a model are different activities. Document each data flow rather than describing every AI interaction as training.
- Prefer synthetic or appropriately redacted data for testing.
- Do not upload entire CRMs, raw logs or customer conversations to unapproved AI tools.
- Verify whether data is used for model improvement or training under the exact product, plan and current terms.
- Review prompt/output retention, processing locations, subprocessors, access and deletion mechanisms.
- Agree appropriate processing terms, incident responsibilities and transfer safeguards where applicable. A DPA does not replace assessment of the complete data flow.
- For retrieval systems, enforce document permissions, test output access and plan deletion across indexes and related copies.
Data collected for consultation or a transaction is not automatically authorized for reuse in training. Confirm purpose, processing basis, notice coverage and risk before proceeding.
7. Measure conversions without circumventing choices
When a user rejects a processing purpose, do not use fingerprinting or probabilistic identity matching to reconstruct that person in order to replace the missing tracking. A server-side route does not turn rejected processing into permitted processing.
- Use transaction/CRM records within their verified scope, separately from advertising behavior that is not authorized.
- Prefer appropriately aggregated reports by period, source or sufficiently large cohort where suitable.
- Distinguish observed, modeled and unknown figures in reports.
- Do not label the entire analytics-versus-CRM gap as conversions lost because of consent.
- Use modeling only when product conditions and approved processing rules are met; do not attempt to reconstruct individuals from aggregate outputs.
8. Control access, email sharing and agency handover
Reports, email attachments and shared accounts can expose personal information even when tracking configuration is correct. Include daily operations in the privacy workflow.
- Use individual accounts, role-based access, multifactor authentication and periodic permission reviews.
- Restrict public sharing of customer files; assign owners and access expiry where appropriate.
- Do not circulate passwords or raw logs in group chats. Use approved channels and filtered data.
- During handover, transfer analytics, Search Console, CMP and related ownership/access, then revoke agency access on schedule.
- Document what is transferred, deleted or retained under verified requirements.
Access and sharing checks can be included in an SEO audit scope, while keeping technical testing distinct from a legal compliance assessment.
9. Prepare a privacy notice from actual operations
Do not publish a statement that you train AI on customer data if that activity is unconfirmed or does not occur. Instead of copying generic policy text, give the editor a verified information brief.
| Section | Information to confirm |
|---|---|
| Organization and contact | Legal entity, working contact channel and appropriate role |
| Data and purposes | Fields, sources, activities and applicable processing basis |
| Cookies and measurement | Purpose categories, recipients and choice management |
| Sharing and AI | Providers, processing flows, retention and transfers where relevant |
| Retention and user rights | Periods/criteria, request procedures and valid exceptions |
Use the title DPO only when the corresponding role and contact actually exist. Do not invent a nonfunctional DPO email address.
10. Pre-launch acceptance checklist
- Data categories, purposes, recipients and owners are documented.
- Consent/processing rules and market scope have been verified.
- Banner, tags, forms and endpoints have been tested before choice, after rejection, after acceptance and after withdrawal.
- Payloads, URLs, logs and reports exclude unapproved sensitive fields.
- Permissions, MFA, document sharing and secrets management have been checked.
- AI vendors have been reviewed for the exact product and terms used.
- Retention, deletion, backups and user-request handling are documented.
- Incident ownership, containment, evidence preservation and applicable notification procedures are assigned.
- Acceptance records state what was tested and what remains unresolved rather than simply claiming compliance.
Include these requirements in the website design brief so the work covers underlying data flows as well as the banner.
Frequently asked questions
Does a cookie banner establish privacy compliance?
No. Review actual data flows, tag behavior, purposes, notices, contracts and operating procedures.
Can a hashed email still be personal data?
Yes, where it can still be linked to or used to identify an individual. Hashing is not an anonymity guarantee.
Can server-side tracking bypass cookie choices?
No. Server-side architecture must still enforce applicable processing rules and user choices.
Does SEO or AEO/GEO require customer data for AI training?
No. Many content, crawling, site-structure and reporting tasks can use public information or minimal approved datasets.
Start with data flows, then choose tools
A practical privacy workflow combines minimal data, clear purposes, tested controls and accountable owners. To review tracking or website implementation requirements, contact Viet SEO to define the technical scope. Qualified specialists should confirm legal decisions for the actual situation.
Questions & Comments
You can ask a question about this article. Viet SEO will review and reply after moderation.