What separates the strong marketing data governance examples from the weak

What to take away

Marketing data governance separates into two visible groups. One group can show a named owner, a stated purpose and a test result for any audience in its stack. The other has a catalog, a policy PDF and no evidence that either works. The gap is not tooling. It is whether the program produces artifacts a reviewer can check.

Strong marketing data governance examples by name

Collibra runs a governance catalog built around business glossary terms, data stewardship workflows and policy approval chains.

A marketing ops team using it can attach a purpose statement and an owner to a customer segment, then route changes through an approval step. It suits organizations with a dedicated governance function and a compliance driver. Pricing is quote-based; check Collibra's published pricing page for current terms.

Alation leans on behavioral metadata: it tracks who queries what, then uses that usage signal to suggest stewardship priorities. That fits marketing ops teams that cannot staff a full governance office and need the tool to surface which datasets matter most. Pricing is also quote-based.

Informatica covers lineage and quality at enterprise scale, including column-level lineage across ETL and CDP pipelines. It suits shops with existing Informatica infrastructure. Pricing is not published.

Atlan is built for collaboration, with a Slack-style interface for stewardship requests and a focus on modern data stack integrations. It suits mid-market teams that want governance to feel like a workflow, not a ticket queue. Pricing is quote-based.

Segment and RudderStack sit at the identity layer rather than the catalog layer. Segment's identity resolution and RudderStack's Profiles feature both let you inspect how identifiers merge and split. Neither is a governance tool, but both expose the match rules a governance review needs to see. Segment publishes tiered pricing; RudderStack publishes a free tier and usage-based pricing.

Apple requires apps to ask permission before tracking users across other apps and websites through App Tracking Transparency, introduced in iOS 14.5 in April 2021. Its SKAdNetwork returns ad attribution in aggregate, so marketers lose user-level tracing but keep campaign measurement. The rule is enforced at the platform level.

Amazon Marketing Cloud is a clean room for advertisers. It uses pseudonymous identifiers and returns aggregated query results, so brands can analyze campaign overlap without exporting user-level data.

Snowflake Data Clean Rooms let two parties join data inside a governed environment and control what the other side can query. It suits retail media and agency collaborations where raw records cannot leave the account.

Weak marketing data governance examples by name

Sephora agreed to a $1.2 million settlement with the California Attorney General in 2022. The state alleged Sephora failed to disclose that it sold personal information, failed to honor opt-out requests and did not treat Global Privacy Control signals as valid opt-outs. The marketing stack kept selling data after consumers opted out.

DoorDash agreed to pay $375,000 in a 2024 California Attorney General settlement. The state alleged DoorDash sold personal information through marketing partnerships without proper notice and failed to honor opt-outs, including Global Privacy Control.

Honda agreed to pay $632,500 in a 2023 California Attorney General settlement over CCPA violations. The state alleged Honda failed to provide notice and opt-out mechanisms before selling personal information.

Google agreed to pay $391.5 million to 40 state attorneys general in 2022 over location tracking. The states said Google misled users about location data used for advertising.

Meta agreed to a $5 billion FTC settlement in 2019 after the Cambridge Analytica scandal. The order required new privacy governance, including an independent assessor and quarterly certifications. That is a weak program forced into a stronger structure.

A weak program usually has a catalog and nothing else. The catalog lists 400 tables. No entry names an owner. The retention field says "TBD." When an auditor asks who approved the purchase of a third-party enrichment file, nobody can produce the contract.

The UK Government's AI-ready dataset guidance names the categories that weak programs skip: provenance, contracts, observability and sustainable ownership. Its public-sector context needs adapting, but the evidence categories transfer directly to marketing models.

W3C's Data on the Web Best Practices makes the same point from the publishing side. Metadata, provenance, versioning and licensing are not optional annotations. They are what makes a dataset reusable without re-interviewing the person who built it.

What to test before you trust a pattern

Pick one audience or metric. Introduce a wrong value, a duplicate identity, a late preference change and a deletion request. Confirm the system detects each one, routes it to a named owner, corrects it downstream and records the evidence.

The NIST Privacy Framework starting guide offers a voluntary process for assigning data and response owners. It is not legal clearance, and it does not replace counsel on CCPA, CPRA or state privacy statutes. Treat it as a structure for the questions you bring to your DPO.

The W3C information and relationships explanation adds a check most governance reviews miss: if your governance dashboard shows a relationship visually, confirm it is also available programmatically. Then test the page with the users and assistive technology in scope.

Common questions

Are these governance examples templates I can copy?

No. Collibra, Alation, Informatica and Atlan each ship a default model, and each one assumes a different operating structure. Apple, Amazon Marketing Cloud and Snowflake clean rooms are platform rules or products you configure, not templates. Rewrite the model for your approved purpose, your data, your contracts and your review capacity.

What belongs in a minimum evidence pack?

Purpose decision, data map, glossary definition, contract and owner. Add classification, access rule, quality result and vendor terms. Add retention period and review date. Keep test results and incident notes with the same record.

Which pattern should we pilot first?

Choose a dataset with a visible customer consequence, a cooperative owner and enough records to test. A suppression list or a conversion event usually qualifies. A propensity model rarely does, because the failure path is hard to rehearse safely.

How do we know the program is working?

You can answer three questions without research: who owns this audience, what purpose permits its use, and what happens when someone asks for deletion. If any answer takes more than a day, the program is still weak. For the questions teams raise most often, see what teams ask about marketing data governance.