Overview
This check flags any tag, data layer variable, or query string value that appears to capture Article 9 special category data health conditions, biometric or genetic data, sexual orientation, religious belief, political opinion, or trade union membership) outside of a validated explicit-consent flow, regardless of whether the general CMP shows the visitor as opted in under the ordinary Article 6/7 consent standard.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR compliance obligations.
Why it is important
Article 9 sets a materially higher bar than the ordinary consent standard governing routine tracking: it requires explicit consent specifically for this class of data, meaning a visitor's general "Accept All" click on a standard cookie banner does not, on its own, satisfy the Article 9 standard for a page that happens to expose health, biometric, or similarly sensitive information through its tracking implementation. A site can pass every ordinary consent check in this framework and still carry an Article 9 violation if a health-condition value ends up in an analytics payload without a separate, explicit consent capture specific to that data category.
Implementation
Create an authenticated Audit and Run it. Also, create Journeys covering forms likely to expose health, biometric, or belief-based data.
Connect an AI agent to the ObservePoint MCP Server. Any agentic harness that supports MCP will work e.g. ChatGPT, Claude, Microsoft Co-Pilot Agents, Cursor, etc.
Ask the agent to flag any tag variable, data layer value, or query string that appears to contain special category data, such as health conditions, biometric data, or religious beliefs.
For each flagged item, confirm a separate, explicit consent was recorded before the value appeared in a tag payload.
Remediation
Where special category data is confirmed present in a tag payload without a validated explicit-consent capture, the priority remediation is to stop the transmission immediately (remove the data-layer binding or block the tag on the affected page pending a proper consent-capture mechanism) rather than treating it as a lower-urgency finding to schedule for a future release.
Work with your DPO and legal counsel to determine whether the underlying business purpose genuinely requires processing this data at all, and if so, design a distinct, explicit consent capture (separate from the general cookie banner) specific to that use case, consistent with Article 4(11)'s definition of explicit consent.
Document the remediation and the DPO's review in your DPIA record (see Documentation & Processes), since an Article 9 finding is exactly the kind of event a Data Protection Impact Assessment is meant to evaluate and record.
Re-run the Audit and Journeys after remediation to confirm the special-category indicator no longer appears outside a validated explicit-consent state.
Conclusion
This check sits apart from the rest of the framework because it tests a substantively different legal standard than ordinary tracking consent, treat any confirmed finding as a DPO-level event requiring documented review, not just a technical fix to close out on the same timeline as a routine tag leak.