[Back to the blog](/blog)

- **02 / Article** — Engineering

# Code review is becoming privacy review

The pull request is the last place where a new data flow still has an author, a reason, and enough context to fix it cleanly\.

- **July 2, 2026** — Published
- **6 min read** — Reading time

On this page

- The pull request still has context
- Look for behavior, not keywords
- Keep judgment visible

- **Inth engineering** — Written by — Code audit

Privacy review works better when it begins in the delivery workflow—before a new tracker, SDK, or vendor call becomes anonymous production behavior\.

01 / Section

## The pull request still has context

By the time a new data flow is discovered in production, the person who introduced it may already be working on something else\. The pull request is different\. The diff, dependency, owner, stated intent, and test surface are all present at once\.

That makes code review the natural moment to explain privacy impact without asking engineers to complete a separate abstract assessment\.

02 / Section

## Look for behavior, not keywords

A useful code audit does more than search for words such as cookie or email\. It follows where data is collected, transformed, stored, logged, and sent\. It notices a new analytics client, an identity field added to an event, or a vendor endpoint introduced through configuration\.

- **Collection** — New fields, events, forms, and device signals\.
- **Movement** — APIs, logs, queues, SDKs, and vendor destinations\.
- **Control** — Consent gates, retention rules, and deletion paths\.

03 / Section

## Keep judgment visible

Automation should identify the change and assemble evidence\. It should not pretend every finding has one universal answer\. The reviewer still needs product intent, legal context, risk tolerance, and the ability to record a reasoned exception\.

> **Automate discovery\. Preserve human judgment\.**
> A finding is useful when another reviewer can see the source, the decision, and the evidence that closed it\.

- **Your consent banner can be correct while your product drifts** — 

## Turn the next privacy question into evidence

Connect the product record and give engineering, privacy, security, and legal the same source of truth\.

[Start for free](/dashboard/sign-up) · [Talk to us](https://booking.inth.com/talk-to-inth)

**Inbox**

Privacy changes that need review