Code review is becoming privacy review
The pull request is the last place where a new data flow still has an author, a reason, and enough context to fix it cleanly.
Privacy review works better when it begins in the delivery workflow—before a new tracker, SDK, or vendor call becomes anonymous production behavior.
The pull request still has context
By the time a new data flow is discovered in production, the person who introduced it may already be working on something else. The pull request is different. The diff, dependency, owner, stated intent, and test surface are all present at once.
That makes code review the natural moment to explain privacy impact without asking engineers to complete a separate abstract assessment.
Look for behavior, not keywords
A useful code audit does more than search for words such as cookie or email. It follows where data is collected, transformed, stored, logged, and sent. It notices a new analytics client, an identity field added to an event, or a vendor endpoint introduced through configuration.
- Collection
- New fields, events, forms, and device signals.
- Movement
- APIs, logs, queues, SDKs, and vendor destinations.
- Control
- Consent gates, retention rules, and deletion paths.
Keep judgment visible
Automation should identify the change and assemble evidence. It should not pretend every finding has one universal answer. The reviewer still needs product intent, legal context, risk tolerance, and the ability to record a reasoned exception.