18 07 17 Changes to Our Types of Data Collected Section: A Practical GDPR Compliance Guide

Introduction

*Updated for 2026 compliance practices.*

Updating your privacy disclosures is critical. One often overlooked step is accurately reflecting changes in the “types of data collected” section. The phrase **18 07 17 changes to our types of data collected section** refers to a compliance checkpoint. It ensures that any modifications to data collection practices—such as adding new analytics tags, integrating a consent management platform (CMP), or adjusting cookie behaviors—are properly documented and verifiable. This guide provides a technical, step-by-step approach to implementing and validating these changes. It focuses on practical verification using GDPRChecker’s scanning capabilities.

**Important**: This guide offers technical implementation guidance, not legal advice. Always consult a qualified privacy professional for jurisdiction-specific requirements.

What Is 18 07 17 Changes to Our Types of Data Collected Section?

In the context of GDPR compliance, “18 07 17 changes to our types of data collected section” is a practical topic for website owners. They need to validate that their public-facing privacy disclosures match the actual data flows on their site. It is not a regulatory article number but a shorthand for a compliance review process triggered by a change date (e.g., July 17, 2018, or a similar milestone). The core idea is that whenever you modify what personal data you collect—whether through new cookies, tracking scripts, or form fields—you must update your privacy policy’s “types of data collected” section. Then verify that the live site behaves as disclosed.

This verification is essential. Discrepancies between stated data collection and actual practices are a common source of GDPR non-compliance. For example, if your policy says you only use “strictly necessary cookies” but a marketing pixel fires before consent, you are in violation. The 18 07 17 changes checkpoint helps you systematically close gaps in consent, disclosure, and tag management.

Requirements and Compliance Expectations

Under the GDPR, transparency is a fundamental principle (Article 5). You must inform users about what personal data you collect, for what purposes, and on what legal basis. When you change your data collection practices, you must update your privacy notice accordingly. The “types of data collected” section is a key part of that notice.

Key compliance expectations include:

• **Accuracy**: The list of data types must reflect current collection methods. If you add a new analytics tool that collects IP addresses, you must disclose it.
• **Granularity**: Vague terms like “usage data” are often insufficient. Specify categories such as “device information,” “browsing behavior,” or “location data.”
• **Consistency with consent mechanisms**: If you rely on consent for certain cookies, your policy must align with the consent banner’s choices. For instance, if you offer a “Reject All” button, the policy should explain that non-essential cookies are only set after consent.
• **Timeliness**: Changes should be communicated before they take effect, where feasible. A dated changelog or “last updated” notice is a common practice.

Regulatory guidance from the European Data Protection Board (EDPB) emphasizes that consent must be informed, specific, and freely given. This means your disclosures must be clear enough for users to understand what they are agreeing to. The EDPB guidelines provide detailed recommendations on transparency. For organizations operating outside the EU, similar principles apply under laws like the UK GDPR, Brazil’s LGPD, and California’s CPRA. While specifics vary, the core requirement of accurate, transparent disclosures is universal.

How to Implement Step by Step

Implementing 18 07 17 changes to your types of data collected section involves both documentation and technical configuration. Follow these steps:

1. Audit Current Data Collection

Start by identifying all cookies, trackers, and data collection points on your website. Use a scanner like GDPRChecker to get an inventory of: - First-party and third-party cookies - Local storage objects - Network requests to tracking domains - Form inputs and hidden fields

Document the purpose, legal basis, and data types for each. This audit forms the baseline for your updated disclosure.

2. Update the Privacy Policy Section

Revise the “types of data collected” section to match the audit. Be specific. For example:

• **Before**: “We collect usage data.”
• **After**: “We collect information about your device (IP address, browser type, operating system), browsing actions (pages visited, time spent), and interactions with our content (clicks, scrolls).”

If you use Google Analytics 4 (GA4) with Consent Mode, note that data collection behavior changes based on consent state. Your policy should explain this, referencing Google’s Consent Mode documentation.

3. Align Consent Banner and Tag Triggers

Your consent banner must control the actual firing of tags. If your policy says marketing cookies are only set with consent, configure your tag manager (e.g., Google Tag Manager) to fire those tags only when consent is granted. For Consent Mode v2, implement the appropriate consent signals (`ad_storage`, `analytics_storage`, etc.) and ensure they default to denied until the user interacts with the banner.

Test the following scenarios: - User lands on the site (pre-consent): No non-essential network requests should fire. - User clicks “Accept All”: All consented tags fire. - User clicks “Reject All”: Only essential tags fire; Consent Mode signals remain denied. - User customizes preferences: Only selected categories fire.

4. Test Pre-Consent Behavior

A common mistake is allowing tags to fire before the consent banner appears. Use GDPRChecker’s scanner to check for pre-consent network requests. The scanner will flag any requests to known tracking domains that occur before user interaction. If you find any, adjust your tag manager triggers to delay firing until consent is obtained.

5. Verify Disclosure Accuracy with a Post-Change Scan

After updating your policy and configurations, run a full GDPRChecker scan. The scanner checks: - Whether the privacy policy link is present and accessible - If the consent banner appears and functions correctly - What cookies and trackers are set before and after consent - Whether the disclosed data types match the observed collection

Review the scan report for discrepancies. For example, if the scanner detects a Facebook pixel but your policy doesn’t mention social media tracking, you need to update the disclosure or remove the pixel.

Common Mistakes and How to Avoid Them

Even experienced teams make errors when updating data collection disclosures. Here are the most frequent pitfalls:

1. Incomplete Cookie Inventories

Many websites rely on manual audits or outdated cookie lists. This leads to missing trackers in the policy. **Solution**: Use an automated scanner like GDPRChecker to maintain a dynamic inventory. Schedule regular scans (e.g., monthly) to catch new cookies added by plugins or third-party scripts.

2. Generic or Vague Descriptions

Phrases like “we collect data to improve our services” are insufficient under GDPR. **Solution**: Break down data types into clear categories. For each category, state the specific data points, purpose, and legal basis. Refer to the GDPR.eu overview for guidance on lawful bases.

3. Mismatch Between Banner and Policy

If your consent banner offers a “Reject All” option but your policy implies that some non-essential cookies are always set, you create a transparency gap. **Solution**: Ensure the policy reflects the actual consent flow. If you implement Google Consent Mode v2, explain how it adjusts data collection based on consent. See our Google Consent Mode v2 guide for technical details.

4. Ignoring Third-Party Dependencies

Embedded content (videos, social widgets) often sets its own cookies. Your policy must cover these if they collect personal data. **Solution**: Identify all third-party services and either obtain their privacy disclosures or list them in your policy. Use GDPRChecker to scan for unknown third-party requests.

5. Failing to Test the Reject Flow

Many teams test only the “Accept All” path. The “Reject All” flow is equally important for compliance. **Solution**: After implementing changes, use GDPRChecker to simulate a user who rejects all non-essential cookies. Verify that no marketing or analytics tags fire, and that Consent Mode signals are set to denied.

How to Validate with GDPRChecker

GDPRChecker provides a practical way to verify that your 18 07 17 changes are correctly implemented. Here’s how to use it effectively:

1. **Run a baseline scan** before making changes to document the current state. 2. **Implement your updates** (policy text, consent banner, tag triggers). 3. **Run a post-change scan** and compare the results. Look for: - **Pre-consent requests**: Any trackers firing before consent indicate a configuration error. - **Banner behavior**: Does the banner appear on all pages? Does it block scripts until interaction? - **Disclosure gaps**: Does the scanner find cookies not listed in your policy? 4. **Use the detailed report** to fix issues. For example, if the scanner flags a missing privacy policy link on a subpage, add it to your footer template. 5. **Schedule recurring scans** to monitor ongoing compliance. Websites change frequently, and new trackers can appear without notice.

For advanced verification, GDPRChecker’s paid plans offer runtime protection and monitoring, consent records, and page-coverage checks. These features help you maintain compliance at scale. Note that GDPRChecker is not a Google Certified CMP or an IAB TCF CMP; it is a scanning and verification tool that works alongside your chosen consent platform.

Comparison: Manual Audits vs. Automated Scanning

| Aspect | Manual Audit | GDPRChecker Automated Scan | |--------|--------------|----------------------------| | **Coverage** | Prone to missing third-party requests | Detects all network requests, cookies, and local storage | | **Frequency** | Typically done once or sporadically | Can be scheduled daily, weekly, or on-demand | | **Pre-consent detection** | Difficult to test consistently | Automatically flags pre-consent trackers | | **Banner testing** | Requires manual interaction | Simulates user journeys and checks banner behavior | | **Evidence for DPA** | Manual screenshots and logs | Generates timestamped reports suitable for accountability | | **Scalability** | Time-consuming for large sites | Scans multiple pages and subdomains efficiently |

Automated scanning is not a replacement for legal review, but it significantly reduces the risk of oversight. For SaaS companies managing multiple client sites, the efficiency gains are substantial. Learn more about tailored compliance in our GDPR compliance for SaaS companies guide.

Real-World Examples

Example 1: Adding Google Analytics 4 with Consent Mode

A marketing site previously used an older analytics tool that collected only anonymized page views. The team switched to GA4 with Consent Mode v2. They updated the “types of data collected” section to include: - Device and browser information - Interaction events (clicks, scrolls, video engagement) - Consent state signals

They configured GTM to fire GA4 tags only after consent, with default consent signals set to denied. A GDPRChecker scan confirmed no GA4 requests before consent, and the policy accurately reflected the new data types.

Example 2: Implementing a Reject All Button

An e-commerce site had a consent banner with only an “Accept” button. After an EDPB recommendation, they added a “Reject All” option. They updated their policy to state that non-essential cookies are not set unless the user accepts. Post-change, a GDPRChecker scan verified that rejecting all prevented marketing pixels from loading, but essential session cookies still functioned.

Example 3: Third-Party Chat Widget

A B2B site added a live chat widget that set cookies for functionality and analytics. The initial policy only mentioned “strictly necessary cookies.” After an audit, they updated the policy to include “chat interaction data” and “third-party service cookies.” They also configured the chat widget to load only after consent. GDPRChecker’s scan confirmed the widget was blocked pre-consent and appeared only after acceptance.

Implementation Checklist

1. Run a full GDPRChecker scan to inventory all current cookies and trackers.
2. Document the purpose, legal basis, and data types for each tracker.
3. Update the “types of data collected” section in your privacy policy with specific categories.
4. Add a “last updated” date and changelog entry for the 18 07 17 changes.
5. Configure your consent banner to block non-essential tags until consent is given.
6. Implement Google Consent Mode v2 if using Google services; set default consent to denied.
7. Test the pre-consent state: verify no non-essential network requests fire.
8. Test the “Accept All” flow: confirm all consented tags load.
9. Test the “Reject All” flow: confirm only essential tags load.
10. Run a post-change GDPRChecker scan and review for disclosure gaps.
11. Fix any discrepancies and rescan until clean.
12. Schedule recurring scans (e.g., monthly) to maintain compliance.

FAQ

What is 18 07 17 changes to our types of data collected section? It refers to a compliance checkpoint where website owners verify that updates to data collection practices are accurately reflected in their privacy policy’s “types of data collected” section. The date (July 17, 2018) is often used as a placeholder for a change milestone, emphasizing the need for ongoing transparency and verification.

Do I need 18 07 17 changes to our types of data collected section for GDPR? Yes, if you have modified your data collection methods since your last policy update. GDPR requires that privacy notices be accurate and up-to-date. Failing to disclose new data types or trackers can lead to non-compliance, even if your consent banner is correctly configured.

How do I implement 18 07 17 changes to our types of data collected section? Start with a full data collection audit using a scanner like GDPRChecker. Update your privacy policy to list all data types specifically. Align your consent banner and tag manager triggers so that data collection matches the disclosed purposes. Finally, test pre- and post-consent behavior to verify accuracy.

How can I verify 18 07 17 changes to our types of data collected section with a scanner? Use GDPRChecker to run a post-change scan. The scanner checks for pre-consent network requests, banner functionality, and discrepancies between disclosed data types and actual cookies/trackers. It provides a report highlighting gaps, such as unlisted trackers or missing policy links.

What are common 18 07 17 changes to our types of data collected section mistakes? Common mistakes include incomplete cookie inventories, vague policy descriptions, mismatches between the consent banner and policy, ignoring third-party trackers, and failing to test the “Reject All” flow. These errors can lead to transparency violations and regulatory risk.

Which cookies and trackers should I check for 18 07 17 changes to our types of data collected section? Check all first-party and third-party cookies, local storage objects, and network requests to tracking domains. Pay special attention to analytics (e.g., GA4), marketing (e.g., Facebook pixel), and functional cookies. Use GDPRChecker to identify any trackers not covered by your policy.

How often should I review 18 07 17 changes to our types of data collected section? Review your data collection disclosures at least quarterly, or whenever you add new tools, update your consent banner, or change tag configurations. Regular GDPRChecker scans can alert you to unexpected changes, such as new cookies from plugin updates.

What evidence should I keep for 18 07 17 changes to our types of data collected section? Maintain dated records of your privacy policy versions, consent banner configurations, and scan reports. GDPRChecker provides timestamped reports that serve as evidence of your verification efforts. This documentation demonstrates accountability to supervisory authorities if questioned.

Next Steps

Ensuring your “types of data collected” section is accurate is a continuous process. Start by running a GDPRChecker scan today to identify any gaps. For deeper guidance on related topics, explore our guides on Google Consent Mode v2, GDPR requirements for websites, and what constitutes personal data under GDPR. Use the GDPRChecker scanner to verify your implementation and maintain ongoing compliance.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "18 07 17 Changes to Our Types of Data Collected Section: A Practical GDPR Compliance Guide", "description": "Learn what 18 07 17 changes to our types of data collected section means for GDPR compliance. Step-by-step implementation, common mistakes, and how to verify with GDPRChecker scanner.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/18-07-17-changes-to-our-types-of-data-collected-section" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice