Verify your site — BRSG Compliance

BRSG Compliance Program · Self-Audit Checklist · standards v1.x Download PDF All standards Always-current at standards.billricestrategy.com

A BRSG STANDARD · Our professional opinion & operating standard · NOT legal or compliance advice

How to use this. This is a manual self-audit — the same checklist BRSG runs against its own owned properties. Open the site you're reviewing in another tab and work top to bottom. Items marked Critical are the ones that draw real regulatory exposure if missing. (An automated scan that runs these checks for you is on the roadmap.)

1 · Affiliate & Sponsorship Disclosure

FTC 16 CFR Part 255 · FTC § 5 · Affiliate & Sponsorship Disclosure Standard →

Every page that carries affiliate links shows a clear, conspicuous, proximate disclosure near the links — not footer-only, not below the fold, not hover-only. Critical
A dedicated /affiliate-disclosure page exists and is linked from the footer site-wide.
Material connections — common ownership, a founder/operator role, or any commercial relationship with a recommended brand — are disclosed in plain language. Critical
Comparison pages and "best of" tables carry a table-level advertising disclosure.
For mortgage/settlement-service links, RESPA § 8 is considered (no disguised referral fees on consumer transactions).

2 · Privacy Policy & CCPA/CPRA

CCPA/CPRA · CAN-SPAM · Privacy Policy & CCPA/CPRA Standard →

A working privacy policy is published and linked in the footer on every page that collects personal information. Critical
The policy states what is collected, how it is used, and how/with whom it is shared.
A notice-at-collection appears at each collection point (lead forms, newsletter signups). Critical
If the site shares data for cross-context behavioral advertising or routes leads to third parties, a "Do Not Sell or Share My Personal Information" mechanism is present. Critical
Consumer rights (know, delete, correct, opt-out) are described, with a working contact method.
Data-retention and children's (under-16) clauses are present.
The published privacy contact address is real and monitored.

3 · AI Content Disclosure

FTC AI guidance · CA SB 942 · AI Content Disclosure Protocol →

AI-generated standalone content and AI features (chatbots, generators) are labeled.
AI-assisted content has cleared the accuracy / human-review gate before publishing. Critical
No fabricated personas, first-person experiences, statistics, or citations appear anywhere on the site. Critical
AI-generated imagery that could be mistaken for a real person, place, or event is labeled.

4 · Authorized Security Testing & Scanning

CFAA authorization boundary · Authorized Security Testing & Scanning Standard →

Any scanning or testing is limited to BRSG-owned assets and @billricestrategy.com infrastructure.
Client systems and third-party platforms are excluded unless covered by written authorization. Critical
The authorization scope is documented before any test runs (CFAA boundary).

5 · Cross-cutting

Program hygiene · Standards library →

Footer carries the privacy policy, affiliate disclosure, and terms links.
When a standard is referenced in a contract or vendor agreement, it is cited by version (e.g. "Affiliate & Sponsorship Disclosure Standard v1.1").
noindex is applied only to genuinely internal surfaces — never to public content that should rank.

Anything left unchecked is a finding. Map it back to the linked standard for the exact requirement and remediation, then re-run this checklist after the fix.