The gap between what privacy policies promise and what tracking actually does is where regulatory exposure lives. This article examines three compliance risks hidden in marketing tracking and what governance adds that privacy reviews alone cannot.