Retail Media Ninety-Day Plan: Which Sources to Check Before Live Delivery

A retail media ninety-day plan sequences source checks before any live delivery. CMA, ICO, CAP, National Cyber Security Centre and Magenta Book material each answer different questions at each stage. The day windows are a planning convention, not a launch-duration promise or revenue forecast. Production delivery stays disabled unless a separately authorised launch process passes its own reviews.

Start with the question each source can answer

These sources are not interchangeable. Consumer presentation guidance does not answer whether an advert is recognisable as advertising; privacy guidance does not establish that a measurement method proves causation; and security guidance does not show that a campaign will be effective.

Source register: what to check

Keep the source's purpose beside the question being investigated, rather than treating a reference to a source as approval of the whole proposal. The Retail media strategy framework: six records to a decision shows where each finding goes.

A source check is useful only against a defined exchange and customer journey. Specify whether the investigation concerns an on-site, off-site or in-store placement, and which product and customer task are in scope. If the team is still deciding whether a proposition belongs in the investigation at all, the Retail media market entry checklist: evidence template covers that different task.

Days 1 to 15: bound the proposed exchange

Name the retailer or marketplace, the advertising space under consideration, the product scope and the journey a customer would take. Record what the advert is expected to say and where a customer would see it.

The blank retail media planning template covering parties, claims, data, gates and exit can hold that description. It helps identify which source questions are relevant; it is not evidence that the claims or placement are acceptable.

At this point, note whether the proposition makes a product, price or charge claim that will need checking against the customer-facing presentation. Do not fill gaps with assumed prices or invented campaign details. The aim is to make the proposed exchange sufficiently concrete to ask the right questions of the guidance in the next window.

By day 15, the campaign lead should produce a dated scope brief naming the retailer or marketplace, placement, product, customer journey and proposed claims. Record unknowns rather than filling them with assumptions; this brief is the input for the later source checks.

Days 16 to 30: examine the customer-facing presentation and data operations

Use the CMA's final price transparency guidance as the starting point for consumer presentation questions. Examine the product information, total price, mandatory charges and optional choices in the actual proposed journey. The question is what a customer would be shown, not whether a planning document contains a field labelled "price".

In parallel, trace the proposed data operations: identifiers, storage or access operations, audience instructions, recipients, exposure records and outcome records. The ICO's final storage and access technologies guidance should be applied by a privacy specialist to those actual operations. Include the refusal path and consider whether necessary shopping functions remain separate from advertising measurement; a generic statement about privacy cannot settle how a particular operation works.

Use this window to identify where the team lacks enough detail to apply the guidance. For example, an unnamed recipient or unclear storage operation leaves the relevant privacy question unresolved. Keep that distinction visible: a source can guide the review, but it cannot supply missing facts about the proposed exchange.

By day 30, the ecommerce owner and privacy specialist should record the customer-facing price and charge findings alongside a map of the proposed data operations. The output is a list of answered questions, missing facts and issues requiring specialist review—not a general approval.

Days 31 to 50: check recognition and the claims made about results

Assess advertising recognition against the rendered communication and its context. CAP's ad-recognition rules are relevant to what the customer actually encounters, not simply to the name given to a placement in a booking system. If creative or context changes, the earlier assessment may no longer describe the same communication.

Separate what a delivery record shows from what an outcome record appears to show, and keep both separate from a causal claim. HM Treasury's Magenta Book provides methodological guidance for counterfactual thinking, while its remit is public policy. It can inform the question of how to reason about an effect; it does not turn an observed attributed outcome into proof that advertising caused it.

For measurement definitions and source-version questions, see the publication's retail media metrics, data and sources guide. Use the source review here to establish whether the available records can answer the question being asked, not to borrow a target from an unrelated benchmark or claim that a metric has been validated merely because it has a name.

By day 50, the creative owner should save the exact rendered advert and record the decision against CAP Code rules 2.1 and 2.4. The measurement owner should document the outcome question, the records available to answer it and whether a causal claim is supported; unresolved points stay open.

Days 51 to 70: review the online service's security surface

Where the proposed operation uses an online service, consult the National Cyber Security Centre's secure online-service guidance. It is intended for organisations that use, own or operate an online service and offers a starting point for security considerations.

The NCSC notes that online services are exposed to internet risks and are sociotechnical systems involving people, technology, business processes and supply chains.

Use that guidance to ask who is authorised to access the service and how access is controlled. Consider whether data and information could be accessed, changed or deleted without authorisation, including personal or other sensitive information. Include the people and supplier relationships involved, rather than treating security as a product setting alone.

These are questions for reviewing the proposed service and its operation; consulting the guidance is not a security certification. Keep the conclusion within what has actually been examined. A limited review does not prove that every component, supplier or future configuration is secure.

By day 70, the online-service owner and a security specialist should record the service and suppliers examined, the access and information risks reviewed, and any limits to that review. Keep unresolved risks and required follow-up actions in the same review record.

Days 71 to 85: reconcile the source findings

Bring the source-specific conclusions together without collapsing them into one general "approved" status. A customer-facing price issue, an unresolved privacy operation, an unclear advertising disclosure and an unexamined service-access question are different gaps and call for different expertise. Note which underlying facts or configuration each conclusion depends on.

Check that the presentation reviewed under the CMA and CAP material is the same proposition as the data operations reviewed with the privacy specialist. Compare the measurement question with what the available records actually represent, using the Magenta Book only for the methodological point it can support. Where the source material does not resolve the case, leave that question open for the relevant specialist rather than extending a source's scope by assumption.

By day 85, the campaign lead should reconcile the scope brief with the presentation, data, creative, measurement and security records. For each finding, record its source, the facts it depends on, an owner for any open question and whether a change to the proposal requires a fresh review.

Days 86 to 90: preserve the boundaries before any live stage

Before the investigation closes, check that the source versions and interpretations still match the proposed exchange. A change to creative, product scope, data recipient, channel, measurement or customer journey can make an earlier source review incomplete; reopen the affected question rather than carrying its conclusion forward automatically.

Keep production delivery disabled during this investigation. The outcome is a set of source-informed findings and unresolved questions for a later, separately authorised process, not permission to target customers, run a campaign or claim effectiveness.

By day 90, preserve a dated source register, the review records from each window, and a list of unresolved questions with owners. This is an investigation record for a later decision, not a release approval.

Set review dates for the sources, contracts and controls that may change, and have named UK specialists examine the current records and precise proposed exchange before any live delivery is considered. The A retail media plan for 2027 with evidence gates, named owners and practical stop rules sets out evidence gates and named owners.