A guest-analytics vendor asks a city museum to collect probe requests from visitor devices. What lifecycle action is most appropriate first?
Select an answer to reveal the explanation.
Short Explanation
Probe-request analytics is vacuuming breadcrumbs from every visitor phone that walks past. Before the city says yes, assess privacy and security—marketing urgency is not a free pass.
Full Explanation
When a guest-analytics vendor requests to collect probe requests from visitor devices at a city museum, the first lifecycle action must be to assess privacy and security requirements associated with this new data-collection technology before enabling it. Probe requests contain device identifiers and can potentially reveal visitor behavior patterns, raising privacy concerns governed by laws and municipal policies. Conducting this assessment ensures compliance with privacy regulations, defines data handling procedures, and establishes security controls to protect collected information. Approving collection immediately based on marketing analytics priorities disregards the necessity of privacy reviews and can lead to legal and reputational risks. Mirroring raw probe data to a public open-data portal without assessment exposes sensitive information to unauthorized parties and violates privacy principles. Disabling all museum SSIDs to avoid probe collection is an impractical solution that disrupts legitimate visitor connectivity and does not address the core privacy concerns. The caveat is that data collection must be transparent, consent-based, and secure. Practically, the museum’s IT and legal teams should collaborate to define data collection scopes, anonymization techniques, and retention policies before enabling probe request analytics.