Scott Steinberg · Consultant, Analyst and Business Strategist
Privacy disputes usually come down to a gap: what a platform policy said the organisation did, and what its actual configuration did. Closing or defending that gap requires someone who understands both how these systems are built commercially and what the industry treated as ordinary at the time. A consultant to 3000+ brands, Scott Steinberg works on both sides of that question and more.
Expert reports, declarations, deposition and trial testimony on data collection practice, AI, online identity, platform policy, consent design, tracking technology, policy-to-practice comparison, vendor data handling, etc.
Most of these matters turn on comparing three things: what was disclosed, what was configured, and what the market treated as standard on the relevant date. The areas below break that down.
Pixels, tags, SDKs, fingerprinting techniques and server-side collection each capture different things and send them to different places, often without the deploying organisation holding a complete inventory.
This work establishes things like what a specific implementation actually collected and transmitted during the period at issue, which is frequently different from what anyone internally believed.
Consent interfaces vary enormously in how much friction they place on refusal versus acceptance: default states, button prominence, layered disclosure and the number of steps to decline all shape outcomes.
Testimony addresses how the interface was constructed, what an ordinary user would understand from it, and how the design compared to conventions at the time it was deployed.
The recurring finding in these matters is divergence: a policy describing limited first-party analytics while the site loads a dozen third-party tags sharing identifiers with advertising networks.
The analysis documents both sides of that comparison for the relevant period and characterises the size and nature of the gap.
Data reaches third parties through tag partners, analytics providers, advertising platforms, embedded widgets and processors, each governed by terms the deploying organisation may never have examined closely.
Testimony addresses what the arrangement permitted, what actually flowed, and what diligence practice expected of an organisation in that position.
Session replay, heatmapping and behavioural analytics capture interaction detail that users rarely anticipate, and the masking configuration determines whether sensitive field entries are captured along with it.
This work examines what the tool was configured to record, what masking was applied, and how that compared to the vendor's own recommended defaults.
Services that attract younger users raise questions about age assurance, what the operator knew or should have known about its audience, and what collection and advertising practice applied to those users.
Testimony addresses audience composition evidence, age gating design and what the sector treated as adequate practice at the relevant time.
Where an incident occurred, questions arise about detection timelines, escalation, scope assessment, notification timing and content, and whether the response matched what peer organisations do.
Testimony describes sector practice for incidents of that type and size, and where the response at issue departed from it.
Audience building, custom and lookalike targeting, identity resolution, hashed identifier matching and data onboarding all move personal data through the advertising supply chain in ways disclosures often understate.
Testimony addresses how these systems work commercially, what data they require, and what the practice was in that vertical during the relevant period.
Tag configurations, consent platform settings and vendor agreements change continuously and are rarely versioned, so capturing the state at the relevant time is an early priority.
Written opinions on things like what a given implementation collected and transmitted, and how that compared to prevailing practice.
Testimony explaining items such as tracking and consent mechanics in terms a non-technical fact-finder can follow.
Responsive analysis of scanning methodology, data flow claims and assumptions about industry norms.
Non-testifying review of tag configurations, vendor agreements and disclosure documentation, plus discovery scoping.
Scott Steinberg is an analyst, consultant and business trends expert with over 25 years of experience providing management and strategic consulting services to more than 3,000 businesses and brands ranging from startups to government agencies and Fortune 500 firms.
He has testified in sample areas including intellectual property — copyrights, trademarks and patents — patent infringement, marketing, branding, video games, mobile applications, consumer product development, and the growth and monetization of online distribution platforms.
He is the author of over 30 books and has published more than five thousand articles addressing areas including but not limited to marketing, technology, leadership, innovation, advertising, digital transformation, data privacy and social networks. He appears regularly on ABC, CBS, CNN and NBC, and has led seminars and training programs for organizations including Wells Fargo, the PGA Tour, Century 21, Ford, Dell and Procter & Gamble.
His consulting work has been broadly recognized. He has served as a thought leader for the American Bar Association and Corporate Counsel magazine, and has received honors from the International Association for Scholastic Excellence, Fortune, and the 21st Century Icon Awards, among others.
A privacy expert witness addresses things like what an organization's systems actually collected, transmitted and shared during a period, how that compared to what was disclosed, and what practice in that sector treated as ordinary at the time. Whether the gap amounts to a violation is for the court.
A security or forensic expert typically investigates an intrusion, examines systems for evidence of compromise, and reconstructs attacker activity. Certain SMEs cover that, while others address commercial data handling: tag and SDK configuration, consent interface design, vendor arrangements, disclosure accuracy and industry practice. Matters sometimes need both.
Generally speaking, by establishing the site or app configuration during the relevant period from available evidence such as archived pages, tag manager history, vendor records and internal documentation, then setting that against the policy versions in force at the same time. Both halves have to be pinned to the same dates for the comparison to hold.
Practice in this area has moved substantially and repeatedly. Consent interface conventions, tag governance expectations, session replay masking defaults and vendor diligence norms have all shifted within a few years. Establishing the standard applicable at the relevant time is usually the first task.
Yes. Consulting-only engagements cover case assessment, review of tag configurations and vendor documentation, discovery scoping for the technical records that matter, deposition question preparation and critique of an opposing expert's scanning methodology, without a disclosed report or testimony.
Initial conversations about scope, timing and conflicts are without charge. Helpful detail includes the properties and period at issue, the data practices alleged and any expert disclosure deadline already set.
A conflicts check is run before any substantive discussion. An initial note listing the party names and a one-line description of the dispute is enough to start; please hold privileged or confidential material until the check clears.