The words vendors use, and what each one means.
Google's measure of whether your ad can show at all and, if it can, where on the page. Google names six inputs: your bid, the quality of your ads and landing page, the Ad Rank thresholds, how competitive the auction is, the context of the search, and the expected impact of your assets.
Auto-applied recommendations let a platform change your ad account on a schedule once you turn the setting on. Google says the recommendations available are subject to change over time, so you are consenting to a category rather than a fixed list. Both platforms keep a history of what was applied.
Broad match is the widest keyword setting, and Google's default. Google says ads may show on searches related to your keyword, including ones that do not contain its direct meaning. Both platforms say it should be paired with automated bidding, because every query it matches is different.
Click-through rate is the share of people who saw your ad and clicked it, worked out as clicks divided by impressions. Google gives the example of 5 clicks from 100 impressions being a 5 percent rate. It measures interest in the ad, not whether the click was worth anything.
Conversion rate is the share of ad clicks that turned into something you count as a result, like a phone call or a filled in form. Google works it out as conversions divided by ad interactions. Microsoft divides by clicks. The two are not the same number, so compare platforms carefully.
Cost per click is what you pay each time someone clicks your ad. You set a maximum you are willing to pay, and the auction usually charges less: Google says advertisers are often charged less, sometimes much less, than that maximum. It is the unit your ad invoice is built from.
Cost per lead is what you paid to get one person to actually get in touch: ad spend divided by the calls, forms and bookings it produced. Cost per click counts everybody who clicked. Cost per lead counts only the ones who reached out, so it is the number to set against what a lead is worth.
A daily budget is an average, not a cap. Google says your daily spending limit is two times your average daily budget on any given day, and your monthly limit is 30.4 times it. So 10 dollars a day is about 304 a month, and a single day could reach 20.
Impression share is how often your ads appeared as a share of the times Google estimates they could have. The denominator is an estimate, not the whole market: Google excludes auctions where you would need a huge bid increase to appear. Microsoft measures against the market it targeted, so the two are not comparable.
Impression-based remarketing is a Microsoft Advertising audience made of people who saw your ads, whether or not they clicked. It lets you show a follow-up ad, or bid differently, to people your campaigns already reached, which only pays if the list grows big enough to serve and is attached to a campaign type that can use it.
The learning phase is the stretch after a change when an ad platform is still working out who to show your ads to, so results swing around. Meta reports it as learning, success or fail. Meta publishes no number of conversions needed to leave it. Google does state a figure for its own bid strategies.
Local Services Ads are Google ads for local service providers that charge for each valid lead, such as an answered call, a message or a booking request. How quickly the business responds affects where the ad ranks, and Google will not credit a valid lead that arrives outside the listed business hours.
The most you are willing to pay for one click, set by you on a keyword, an ad group or a campaign. It is a ceiling, not a price. What the auction actually charges is usually lower, though Enhanced CPC and bid adjustments can push a single click above it.
A negative keyword stops your ad from showing on searches that contain it. It is the main tool for cutting wasted spend. The catch is that negatives do not expand the way normal keywords do: Google says they will not match close variants, so plurals and misspellings need adding by hand.
Optimization score is a platform's estimate of how fully your account is set up, shown as 0 to 100 percent. Both Google and Microsoft say it rises when you apply a recommendation or dismiss one. So it measures how few recommendations are outstanding, not how the account performs.
Performance Max is a single campaign that buys across all of a platform's inventory. Google lists YouTube, Display, Search, Discover, Gmail and Maps from one campaign. Microsoft advises giving it two to three times the budget of a standalone campaign, because it serves across multiple formats and inventory.
Placement means where your ad appears, but the two big platforms mean different things by it. On Google a placement is somebody else's website, app or video. On Meta it is a surface inside Meta, like the Facebook feed or an Instagram story, plus its Audience Network of third party apps.
Quality Score is a 1 to 10 diagnostic number reported against each keyword, estimating how relevant your ad, keyword and landing page are. Both Google and Microsoft state plainly that the score itself is not used in the auction. Ad quality does affect what you pay. The number in your account does not.
The search terms report lists the actual things people typed before your ad appeared, next to what each one cost. It is where you find out whether you are paying for searches you would never want. Google omits low volume terms from it for privacy, so it is not a complete list.
Smart Bidding sets a bid for every individual auction rather than per keyword. Google calls this auction-time bidding and says some of its signals are exclusive to it. Microsoft is blunt about the trade: with auto-bidding you can only set a bid at campaign level, and the model computes the rest.
A special ad category is a label Meta makes you declare when your ad is about housing, employment, credit or politics. Declaring it removes most targeting: no lookalike audiences, a fixed 18 to 65 plus age range, no gender choice, and a radius of at least 15 miles. Google restricts the same areas by different rules.
The AI Assistant channel is a Google Analytics 4 traffic channel for visitors who arrive from AI tools such as ChatGPT, Gemini, Deepseek, Copilot or Grok. It excludes Google's own AI Overviews and AI Mode, which GA4 counts as Organic Search, so AI traffic is split across two channels.
An attribution model is the rule or algorithm that decides which clicks and visits get credit for a sale or lead. Google Ads defaults most conversions to data-driven attribution, and GA4 offers three models, so the same lead can be credited differently depending on the report.
A conversion is an action you told the ad platform to count as a result, like a form or a call. The number is not a headcount. Google's One conversion setting counts one per ad click, not per person, and Microsoft calls the same two settings All and Unique.
Conversion delay is the gap between the click and the sale. Microsoft states conversions are reported on the click date rather than the conversion date, so recent days are always incomplete, which temporarily inflates cost per acquisition and deflates return on ad spend.
Conversion value is the dollar figure a Google Ads account records for each conversion, either one fixed amount per action or a separate amount passed with each sale or lead. Value-based bid strategies such as Target ROAS chase the conversions carrying the highest figures, so those numbers steer where the budget goes.
A conversion window is how long after somebody clicks your ad a resulting action still gets counted. Google's default for click-through conversions is 30 days. Changing the window is not retroactive, so an action that fell outside the old window does not get counted later.
Data thresholds are rules Google Analytics 4 applies to withhold rows or numbers from a report when showing them could reveal something about individual visitors. A thresholded report shows less than the property collected, so it is easy to mistake for broken tracking or a slow week.
Engagement rate is the share of visits to your website that Google Analytics 4 counts as engaged. A visit qualifies when it passes a timer that starts at 10 seconds, reaches two page views, or records a key event. Bounce rate is everything else, so the two add up to 100%.
Enhanced conversions send a hashed version of your customer's email address or phone number to the ad platform, which matches it against its own signed-in account holders. Both platforms describe it as a replacement for third-party cookies, and both match against their own user base.
Enhanced measurement is a Google Analytics 4 setting that records page views, scrolls, outbound clicks, site search, video engagement, file downloads and form interactions with no code changes. It shapes lead counts, because a form_submit event records a submission and carries no confirmation that an inquiry reached the business.
Google signals is a Google Analytics 4 setting that enriches reporting with data from visitors signed in to a Google account who have turned on Ads Personalization. Since June 15, 2026, Google says the setting controls only the association of Analytics data with signed-in user information for behavioral reporting.
Incrementality testing is a controlled experiment that splits an audience into a group that can see the ads and a group held back from them, then compares their conversions. The difference estimates the sales or leads the ads caused, apart from the attribution rules behind the conversions an ad account reports.
Key event is the word Google Analytics uses for an action worth counting. Google calls it the umbrella term, and says conversions are specific to the context of ads and, unlike key events, are eligible for bidding and reporting in Google Ads. The two columns are not the same measurement.
Modeled conversions are Google's estimate of conversions it is unable to observe directly. Google says they can take up to 5 days to fully process and stabilize, and that conversion values are subject to retroactive increases for a period of several days while modeling finalizes. So a number can legitimately rise after you read it.
An offline conversion import tells the ad platform that a click became a sale somewhere it could not see. You store the click ID with the lead and hand it back when the deal closes. Microsoft states that anything uploaded more than 90 days after the click is not imported.
A phone call conversion is a call that Google Ads counts as a conversion, usually one that lasts at least a minimum length the advertiser sets. Two of Google's five tracking methods count taps or estimates instead of calls, so a report can show call conversions for calls that never happened.
A primary conversion action is one Google Ads reports in the Conversions column and uses for bidding. A secondary action is observation only: it shows in All conversions but, outside a custom goal, does not steer bids. Which actions are primary decides what the budget is spent chasing. Microsoft draws the same line with a property called ExcludeFromBidding.
UTM parameters are tags added to the end of a link so analytics can record where a visit came from. Google says to always use utm_source, utm_medium and utm_campaign. Values are case sensitive, so utm_source=Google and utm_source=google are counted as two different sources.
A view-through conversion credits an ad that was seen but never clicked. Google counts an impression as viewable when at least 50% of the ad is onscreen for at least 1 second, so the standard being met is lower than most people picture when they hear that someone saw the ad.
Average position is the topmost position your page reached, averaged only across searches where it appeared at all. Google counts result blocks rather than places on the screen, and says ads occupy none of them. In advertising the metric is gone: Microsoft deprecated it in 2021 and now reports zero.
A Business Profile suspension is Google restricting a business listing, or the Google Account that manages it, for breaking Business Profile policies. The way back is an appeal in Google's appeals tool, where evidence must go in within 60 minutes of opening the form and decisions can take up to 5 business days.
A canonical URL is the version of a page you want treated as the real one when several URLs show the same content. The standard calls it the author's preferred version. Google ranks it a strong signal, not an instruction, and says none of these methods are required because it will pick a version anyway.
Crawled, currently not indexed is a Search Console status meaning Google fetched a page and chose not to index it. Google says it may or may not be indexed later and that there is no need to resubmit the URL. Discovered, currently not indexed is different: Google has not fetched it yet.
Crawling is a search engine fetching your pages to see what is on them. MDN describes a crawler as a program that systematically browses the web to collect data. Google is blunt about the limit: it does not guarantee that it will crawl, index, or serve your page, even when everything is done correctly.
A Google Business Profile is the free listing that puts your business in Google Maps and in the local results beside search. Google's rule for qualifying is narrower than most people expect: the business must make in-person contact with customers during its stated hours, so online only businesses do not qualify.
An incentivized review is one a customer wrote after being offered something for it. The FTC rule does not ban that. It bans conditioning the incentive, expressly or by implication, on the review expressing a particular sentiment. Adding a disclosure does not fix a five-star requirement.
Indexing is a search engine storing information about your page in its database so the page can be found later. Cloudflare compares it to a library card catalog. Google is direct about the limit: indexing is not guaranteed, and a page can be indexed and still never appear.
A knowledge panel is the box of facts Google shows beside search results about a person, organization or thing. Google builds it automatically when enough information exists on the open web, so nobody can buy or request one, and businesses get a separate Business Profile panel instead.
Local SEO is the work of showing up when somebody nearby searches for what you sell. Google names three factors: relevance, distance and prominence. Distance is the one you cannot change, and Google states plainly that there is no way to request or pay for a better local ranking.
A manual action is a penalty Google applies when a human reviewer at Google finds pages on a site breaking its spam policies. Most manual actions make affected pages rank lower or drop out of search results, and Google lifts the action only after a review finds every affected page fixed.
A review snippet is the star rating Google can show beside a search result, drawn from structured data on the page. Local businesses cannot get one from reviews about themselves. Google says pages where the reviewed entity controls the reviews, including embedded review widgets, are ineligible.
Review suppression is hiding or removing customer reviews based on how negative they are. The FTC rule allows moderation as long as the criteria are applied equally regardless of sentiment. What it prohibits is implying the reviews you display represent all of them, and using false accusations or threats to get one taken down.
A robots.txt file tells crawlers which URLs they may fetch on your site. Google is explicit that it is not a way to keep a page out of search: a disallowed URL can still be indexed if other sites link to it. The convention dates to 1994 and became RFC 9309 in 2022.
Scaled content abuse is Google's name for generating many pages mainly to manipulate rankings rather than help people. Its definition says this applies no matter how the content is created, so using AI is not itself the violation. Google states it focuses on the quality of content rather than how it was produced.
A service-area business visits or delivers to customers and does not serve them at its own address, so its Google Business Profile hides the address and lists the areas it serves. The setting decides whether a home address is published, and a profile that breaks the rules risks suspension.
A sitemap is a file listing the URLs on your site so search engines can find them. Google says it ignores the priority and changefreq tags and uses lastmod only when the date is verifiably accurate. Bing calls lastmod a key freshness signal. A sitemap aids discovery and guarantees nothing.
Structured data is markup that describes your page in a shared vocabulary, founded by Google, Microsoft, Yahoo and Yandex. Google is explicit about the limit: using it enables a feature to be present and does not guarantee that it will be present, even when the markup is correct.
Ads in ChatGPT are paid placements that OpenAI shows below ChatGPT responses, labeled as sponsored, for users on its Free and Go plans. Advertisers pay for impressions or clicks, and OpenAI gives them aggregated results such as views and clicks while keeping the conversations themselves away from advertisers.
AI content disclosure is labeling material as machine-made where a platform requires it. Google's product listings require AI-generated images to carry a specific IPTC metadata code, and IPTC defines three different codes: created with generative AI, edited with it, and edited by a person.
An AI Overview is the summary Google sometimes places above the results, with links to sources. Google says they are only shown when its systems judge them additive to classic Search, so they often do not trigger. There is no special file or markup that gets you into them.
An AI performance report shows how often AI search features show or cite your site. Google's version counts impressions in AI Overviews and AI Mode. Bing's counts citations and states its numbers do not indicate ranking, authority or placement. Neither publishes a position inside an AI answer.
Google-Extended is a robots.txt token that controls whether content Google crawls from your site may be used to train Gemini models and ground Gemini apps. Google states it does not affect your inclusion in Search or your ranking. It is a training control, not a way to stay out of search results.
GPTBot is the web crawler OpenAI uses to collect pages that may be used to train its AI models. You allow or block it with a line in your robots.txt file. Blocking it is a separate decision from appearing in ChatGPT search, which a different crawler handles.
Grounding is tying an AI answer to retrieved sources rather than letting the model answer from memory. Google uses the word as a synonym for retrieval augmented generation. Microsoft treats groundedness as something you measure on a scale, which is the more useful way to think about it.
llms.txt is a proposed Markdown file, placed on a website, that gives AI agents a short summary of the site and links to its most useful pages. Google says Google Search ignores these files, so adding one neither helps nor harms how a site appears in Google, AI Overviews included.
Non-commodity content is Google's term for a page carrying something only you could write. Its test is a contrast: commodity content is common knowledge that could originate from anyone, while non-commodity content gives an expert or experienced take that goes beyond the ordinary. First-hand beats summarized.
Query fan-out is the model turning one question into several searches at once. Google describes it as a set of concurrent, related queries generated by the model to fetch additional relevant search results. The trap is the obvious response: Google names a page per fan-out query as scaled content abuse.
YouTube AI disclosure is the AI use setting a creator must turn on when a video contains realistic content made or meaningfully altered with AI. YouTube then labels the video, and says disclosure does not limit a video's audience or its eligibility to earn money.
A 301 redirect is a server instruction saying a page has permanently moved to a new address. Google treats it as a signal that the new address is the real one and should be the version shown in search results. A 302 says the move is temporary, so Google keeps showing the old address instead.
A 302 tells browsers and search engines that a page has moved for now, but the old address is coming back. Google follows it without treating the new address as the one to show in results. Using it for a permanent move is a common and quiet mistake.
A 404 means the server could not find the page. The standard adds a second meaning most people miss: it can also mean the server will not say whether the page exists. A soft 404 is worse, a page that tells visitors it is missing while still reporting success.
Core Web Vitals are three measurements Google uses for page experience: loading, responsiveness and visual stability. The current set is LCP under 2.5 seconds, INP under 200 milliseconds and CLS under 0.1. A page passes only if it hits all three at the 75th percentile of real visits.
Cumulative Layout Shift measures how much a page's visible content moves unexpectedly. Despite the name it is not a total: web.dev defines it as the largest burst of shifts within a five second window. Movement you caused, like clicking a button, does not count.
The Deceptive site ahead warning is a red alert Chrome can show when Google Safe Browsing detects social engineering content on a site, meaning content that tricks people into doing something dangerous. Chrome advises visitors against continuing, so traffic from Chrome can stop until the content is removed and a review is approved.
DNS is the system that turns a domain name into the address of the machine that answers for it. Your records live on an authoritative server named in the domain's NS record. Changes are not broadcast; old answers simply sit in caches until the TTL you set expires.
Interaction to Next Paint measures how long a page takes to respond visibly to a click, tap or key press. It reports the worst interaction of the visit rather than the average, ignoring outliers, and it breaks into three parts: input delay, processing duration and presentation delay.
Largest Contentful Paint is the render time of the largest image or block of text visible without scrolling, measured from when the page starts loading. web.dev breaks it into four parts that add up with no gaps, and says time to first byte and resource load duration are usually about 40 percent each.
A recovery point objective, or RPO, is the most data a business will accept losing after an outage, measured as time since the last point it can recover to. It sets how often backups must run, and how many hours of orders, bookings or form entries a failure could erase.
The redemption grace period is the 30 days after an expired domain name is deleted during which it can still be restored for the registrant who held it, usually for a restore fee. The registry switches off the domain's DNS during those days, so the website and email tied to it stop working.
A redirect chain is one address sending you to a second, which sends you to a third. Google says its crawler follows up to ten hops but advises going straight to the final destination, keeping any chain to fewer than five. Every extra hop is another request the visitor waits for.
An SSL or TLS certificate is the file that lets a browser confirm it is really connected to your domain, and it turns on encryption for the connection. It binds your keys to your domain name. It says nothing about whether the business behind the domain is trustworthy, and it is usually free.
The UDRP, or Uniform Domain Name Dispute Resolution Policy, is the ICANN process a trademark holder uses to have a domain name transferred or canceled when someone registered and is using it in bad faith. The complainant pays the fee, a WIPO case normally ends within 2 months, and no money damages are available.
A VPAT, or Voluntary Product Accessibility Template, is a free form from the Information Technology Industry Council for reporting how a product meets accessibility standards. Completed for one product, it becomes an Accessibility Conformance Report, or ACR. A federal agency may not buy without an ACR unless the agency claims a special use case exception.
Web accessibility means people with disabilities can use your site. The Department of Justice says the ADA's requirements apply to what a business offers online, while stating it has no regulation setting out detailed standards for how. A separate rule does set one, WCAG 2.1 Level AA, but it binds state and local government.
A web application firewall (WAF) is a filter that sits in front of or inside a website's server and applies rules to incoming HTTP requests, blocking those matching common attacks such as SQL injection. It can shield a known flaw quickly while a fix is written, but OWASP notes that the source code is left unchanged.
10DLC registration is the verification US carriers require before a business sends text messages through software from an ordinary 10-digit local number. The business is registered as a brand, and its messaging as a campaign, through its texting provider. Unregistered traffic faces more filtering and extra carrier fees.
An AI voice call uses a synthesized or cloned voice to speak to the person who answers. In February 2024 the FCC confirmed those voices fall under the existing rules on artificial or prerecorded voice, so the same consent requirements apply. The message must also identify your business and offer an automated way to opt out.
Call tracking replaces the phone number shown to a visitor with a substitute number that routes to your real one. Only calls dialed through that substitute are measured. Google assigns a forwarding number when call reporting is on, and Microsoft requires an ad group to have reached 10 clicks and 10 dollars of spend in 30 days.
Caller ID spoofing is sending a number other than the line you are calling from. The federal prohibition is not about the technique. It applies to transmitting misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value.
An entity-specific Do Not Call list is a business's own record of people who asked it to stop calling them. The Telemarketing Sales Rule forbids calling those people, separately from the National Do Not Call Registry, and each violation can bring a civil penalty of $53,088.
Kari's Law is the federal rule that lets anyone dial 911 from an office phone without pressing 9 or any other code first. It applies to phone systems installed or first sold after February 16, 2020. When a system breaks the rule, the business managing it is presumed responsible.
A letter of authorization is the signed form that lets a new phone provider request a business's existing numbers from the current provider, a move called porting. If its details do not match the old carrier's records, the port is usually rejected and the move is delayed.
The National Do Not Call Registry is the federal list of numbers telemarketers may not call. Sellers subscribe by area code, and FTC guidance says call lists must be scrubbed against it at least every 31 days. Business to business calls are largely outside the rule, with narrow exceptions.
The Reassigned Numbers Database is an FCC database that tells a caller whether a phone number has been permanently disconnected since a given date, which means it may now belong to someone else. Querying it before calling on old consent is how a caller qualifies for the FCC's safe harbor for reaching a reassigned number.
A robocall is an outbound call that plays a recorded message. The Telemarketing Sales Rule prohibits placing one to sell something unless the person gave express agreement in writing beforehand. The rule covers calls you place. A system that answers calls coming in to you is a different thing.
STIR/SHAKEN is how phone carriers sign outbound calls so the receiving network can tell the caller ID was not faked. The signature is your provider attesting to the accuracy of the number it is sending. Congress required it on internet protocol networks and asked only for reasonable measures elsewhere.
The Telemarketing Sales Rule is the FTC rule governing sales calls. Beyond the do not call list, it sets what a caller must say and when they may call: residential calls only between 8am and 9pm local time, and a prompt disclosure that the purpose of the call is to sell something.
The universal service fee is a line item on phone and VoIP bills that recovers what the carrier pays into the federal Universal Service Fund. Federal rules cap it at the interstate portion of the bill times a percentage the FCC resets every quarter, which was 38.8% for July to September 2026.
Consent mode is how an advertising tag is told whether a visitor agreed to be tracked. Both major platforms now require a consent signal, and the penalties differ in kind: Google's policy allows it to suspend or terminate your account, while Microsoft simply stops recording your conversions.
DKIM attaches a cryptographic signature to a message so a receiver can confirm the signed parts were not altered. The standard describes it as a domain claiming some responsibility for the message, and it separates the signer from the purported author. Modifying a message in transit breaks the signature.
DMARC is a DNS record that tells receiving mail systems what you think about messages using your domain that fail authentication. The current standard, RFC 9989, is explicit that receivers can honor your request but are not required to. It was revised in 2026, and the percentage rollout tag was removed.
Global Privacy Control is a signal a web browser sends to every site a person visits, saying they do not want their personal information sold or shared. California's CCPA counts it as a valid opt-out request, and Colorado recognizes it as a universal opt-out, so covered businesses must honor it automatically.
An MX record is the DNS record that names the mail servers accepting email for a domain, and senders try the lowest priority number first. If a DNS move drops it, senders try the domain's own A or AAAA address, often the website's server, and if nothing there accepts mail, may keep retrying for about a week.
A notice at collection is the disclosure California's privacy law requires before or as a covered business collects personal information. It says what is collected and why, whether it is sold or shared, and how long it is kept. So it belongs wherever the information is gathered, such as a website form.
Prior express written consent is the standard the FCC's rules require before a business sends marketing calls or texts using an autodialer or an artificial voice. It has to be a signed agreement naming the phone number, and the rule says a person cannot be required to sign it as a condition of buying anything.
The CCPA right to delete lets a California consumer ask a covered business to erase personal information collected from them. Unless an exception applies, the business deletes it within 45 days, extendable once by 45 when reasonably necessary with notice. It also notifies service providers, contractors and, unless impossible or disproportionate, third parties it sold or shared data with.
Under California's CCPA, a business sells personal information by passing it to a third party for money or other valuable consideration, and shares it by passing it on for cross-context behavioral advertising, paid or unpaid. Both trigger an opt-out right, so a pixel feeding ads on other sites can require a Do Not Sell or Share link.
Your spam complaint rate is how often recipients mark your mail as spam. Google publishes a target and a ceiling: keep it below 0.10% and avoid ever reaching 0.30%. Yahoo asks for below 0.3% and adds the detail that changes the arithmetic: it counts mail delivered to the inbox.
A spam trap is an email address kept to catch senders who mail people without permission. Nobody ever signed up with it, or its owner abandoned it long ago, so mail arriving there points to a problem with how a list was built. Hitting traps can get your email blocked.
SPF is a DNS record listing which servers may send mail using your domain in the envelope sender. The specification caps it at ten DNS-querying terms, and receivers must return permerror if that is exceeded, which means the check fails. It does not check the From address a recipient sees.
A transactional or relationship message is an email whose content fits one of five CAN-SPAM categories, such as a purchase confirmation or account statement. It is exempt from most of the law, but an ad-like subject line or a promotion leading the body makes it commercial email, with penalties up to $53,088 per violating email.
Unsubscribing has a legal shape and a technical one. The law allows a reply or a single web page, with no fee and no information beyond the address, honored within 10 business days. The one-click standard exists because automated scanners were unsubscribing people by accident.
An API is the way one piece of software talks to another without a person in the middle. MDN describes it as a contract between the application offering it and whatever uses it. The part that matters commercially is that the contract belongs to whoever publishes it, and it changes.
Broken access control is an application letting someone see or do something their account should not. OWASP ranks it first in its 2025 Top 10 and reports that 100 percent of applications tested had some form of it. The rule that matters: a check enforced only in the browser is not a check.
A definition of done is the written list of conditions every piece of work must meet before anyone calls it finished. The Scrum Guide treats it as a gate: work that misses it cannot be released or even shown at the review. Agile Alliance warns that an unwritten one loses most of its value.
Multi-factor authentication means proving who you are with two different kinds of evidence. NIST treats it as a level rather than a switch: at AAL2 two distinct factors are required and the application must offer a phishing-resistant option. Vendor lists run from text messages to passkeys, all labeled MFA.
The OWASP Top 10 is a standard awareness document naming the most common security risks in web applications. It is not a certification and not a checklist a supplier can pass. NIST built its own development framework partly on it, which is why it works better as a question than as a requirement.
A product backlog is the ordered list of everything a team might build next. The Scrum Guide calls it the single source of work for the team. Agile Alliance is explicit that including an item does not guarantee it will be delivered, so being in the backlog is not a commitment.
Security misconfiguration is software set up incorrectly rather than written incorrectly. OWASP ranks it second in its 2025 Top 10 and lists the usual causes: unnecessary features enabled, default accounts unchanged, and errors that show users a stack trace. The fix is a baseline somebody owns.
A service level objective is a target value for a measured part of a service, such as 99.9% of requests succeeding over four weeks. It sets the error budget, the failures it can absorb, which decides when new releases ship and when reliability work comes first.
Single sign-on is a sign-in setup where one account at an identity provider, with its authenticators, opens many separate applications. It shapes how fast a departed employee is locked out, because NIST notes that ending a session at the identity provider does not necessarily end sessions already open in each app.
A sprint is a fixed length block of development work, one month or less in the Scrum Guide and usually one to four weeks in practice. The fixed length is the point: it is what makes a completion estimate possible, and it decides what can be changed once the block has started.
A user story is a small slice of work written from the user's point of view, usually to a role, feature, reason template. The Agile Alliance defines it and offers INVEST as the quality test. The Scrum Guide, the framework most teams name, does not use the phrase at all.
Velocity is the total of the estimates a team finished in one iteration. Agile Alliance is blunt about what it is not: a measurement made after the fact, not a budget or a forecast, with no meaningful comparison between teams and no such thing as an individual velocity.
Version control is the permanent record of software as it changes. Microsoft describes it as taking a snapshot of the files and saving it so it can be recalled later. For a business paying for the work, it is where the asset lives, and access to it is a separate question from owning it.
Work made for hire is the legal category that decides who owns something you paid to have made. Copyright starts with whoever created the work. For commissioned work it only becomes yours through one of two narrow routes in the statute, and software fits neither by default.
An AI agent is a model that has been granted the ability to take actions, not just produce text. OWASP says the damage one can do comes from three grants: excessive functionality, excessive permissions and excessive autonomy. What it is allowed to do matters more than how good it is.
An automated employment decision tool is software that helps decide who gets hired or promoted, such as a system that scans resumes for key words. New York City's Local Law 144 bars employers from using one unless it had a bias audit within a year, the results are public, and candidates were notified.
A batch API lets software send a large group of AI model requests to be processed together within a set window, instead of waiting for each answer. OpenAI and Anthropic both charge half the normal price for batched requests, in exchange for results that can take up to 24 hours.
A context window is the maximum amount of text, counted in tokens, that an AI model can work with in one request, including its own reply. Everything counts toward it, from instructions to the conversation so far, and Anthropic notes that accuracy and recall degrade as it fills.
Explainability is being able to say how an AI system reached a decision. NIST separates three questions: transparency answers what happened, explainability answers how, and interpretability answers why it meant what it did. A global explanation describes the model. Only a local one answers a customer.
A hallucination is AI output that sounds right and is not. OWASP describes the model filling gaps in its training data using statistical patterns, without understanding the content, so the answer can be fluent and unfounded at once. Its own first example is an airline that was successfully sued over its chatbot.
The human authorship requirement is the US Copyright Office position that copyright protects only material made by a person, leaving AI output from prompts alone unprotected. It decides which parts of AI-assisted logos, images and website copy the business can register, and what the application must disclose.
The Model Context Protocol, or MCP, is an open-source standard for connecting AI applications such as Claude or ChatGPT to outside tools and data. Each connection can let an AI tool read data or act in another system. Its specification says MCP cannot enforce its security principles at the protocol level, leaving that to the applications built on it.
Model drift is an AI system getting worse without anyone changing it. Microsoft names the causes plainly: data distribution changes, training-serving skew, data quality problems, shifts in environments and consumer behavior changes can all make a model stale. NIST sets the bar over the entire lifetime of the system, not at launch.
Privacy-enhanced AI means an AI system built so your data is not exposed or quietly reused. NIST lists it as one of seven characteristics of trustworthy AI, and states the honest catch: privacy techniques can cost accuracy. The FTC has required firms to delete models built on unlawfully obtained data.
Prompt caching lets an AI provider reuse its work on the opening part of a prompt when the next request starts the same way. It lowers cost and speeds up replies. OpenAI applies it by default, while Anthropic charges extra to write a cache and a tenth of the normal price to read one.
Prompt injection is when text an AI system reads becomes an instruction it follows. OWASP notes the text does not have to be visible to a person, only parsed by the model, and that no fool-proof prevention is known. The UK's national cyber security body says the same.
Retrieval augmented generation is how an AI answers from your documents without being trained on them. OWASP describes it as combining a pre-trained model with external knowledge sources at answer time. So the documents sit in a store the system reads from, and who can read that store is the question.
Training data is what a model learned from. The question owners ask is whether their own data joins it, and there is no single answer: OWASP names three separate stages, pre-training, fine-tuning and embedding. A commitment worth having names the stage and comes in writing.
Access levels decide what somebody can do inside your advertising account. Google Ads has five: Email-only, Billing, Read-only, Standard and Admin. Only Admin can give account access, change access levels and cancel invitations. Microsoft uses different names for a similar ladder, topped by Super Admin.
Account ownership decides who keeps the advertising account and its history when an agency relationship ends. Google lets anyone with administrative access unlink from a manager account at any time. Microsoft names the fix when the account was created in the wrong place, and lists what cannot be moved.
The Consumer Review Fairness Act voids contract terms that stop customers reviewing you. A provision of a standard-form contract is void from the start if it bars a review, penalizes one, or takes the reviewer's intellectual property. Removing abusive or irrelevant content is still allowed.
A DMCA designated agent is the contact a website or online service registers with the US Copyright Office to receive copyright takedown notices. Sites that let users post material need one to qualify for the safe harbor from infringement liability. The registration expires after three years unless it is renewed.
A Google Partner badge is the logo Google lets an agency display once its manager account meets Google's performance, spend and certification requirements. When hiring an agency, it shows thresholds set at the level of the agency's manager account, such as $10,000 in combined client ad spend over 90 days, and Google bars using it to imply endorsement.
Google publishes its own advice on hiring an SEO, and it is blunter than most agency marketing. No one can guarantee a number one ranking, a claimed special relationship with Google is a warning sign, and you remain responsible for what anyone you hire does to your site.
A liquidated damages clause sets, in advance, the amount or formula one party owes the other if it breaks the contract. Courts generally enforce one only when the figure is a reasonable estimate of harm that is hard to prove, and refuse one that works as a penalty.
A manager account is the umbrella account an agency uses to run several advertising accounts from one login. Linking one to your account is normal. Giving it ownership is not the same thing: Google says a manager account can be given ownership of a client account, which lets it manage who has access.
Statutory damages are a copyright award a court sets within ranges fixed by law, without the owner proving any loss: $750 to $30,000 per work, and up to $150,000 if the infringement was willful. In federal court they generally apply only to works registered in time, so registration dates shape what one unlicensed website photo can cost.
A time and materials contract pays a supplier fixed hourly rates for the hours actually worked, plus the actual cost of materials. The buyer carries the risk of the work running long, so the total is open ended unless the contract sets a ceiling price that the supplier exceeds at its own risk.
A trademark is a word, phrase, symbol or design that identifies your goods or services and indicates where they come from. It is not ownership of the word itself. The USPTO is blunt about that: rights attach to how the word is used with your specific goods or services, not to the word in general.
Typical results is the standard a testimonial has to meet before it can be advertised. The FTC Endorsement Guides treat a specific result as a claim about what customers will generally achieve, and the Commission tested the usual disclaimers. Neither one reduced that impression, so a caveat does not fix an unrepresentative case study.
An uptime guarantee is a provider's promise that a service will be available for a stated share of each month, such as 99.9%. In the published terms of large cloud providers, the remedy for a miss is a credit on future bills that the customer has to claim, and that credit is the only remedy.
The break-even point is where total cost and total revenue are equal, so there is no loss or gain. The SBA states it plainly and then states the limit plainly too: it is an estimate for lender viability and a business plan, not an accounting result, and the formula assumes a single product or service.
Cost per acquisition is what you paid for each counted conversion, spend divided by conversions. Google expands the abbreviation as cost per action, not acquisition. It inherits whatever your conversion column counts, so two businesses can report the same figure and mean entirely different things.
Customer lifetime value is the dollar value of a customer relationship, based on the present value of projected future cash flows. The LTV column in your analytics is a different quantity: measured revenue from users the tool could identify, sampled above a limit, and often zero even at the 90th percentile.
Margin is the difference between selling price and cost, stated either as a percentage of the selling price or per unit. The standards board that defines it also records that managers differ widely in the assumptions they use. So the number only means something once you know which costs are inside it.
Return on ad spend compares what the advertising produced against what it cost. Google reports it as conversion value divided by cost and shows a percentage. Microsoft divides revenue by spend and shows a ratio. Neither is net of your own costs, so it is not profit.
Return on investment is profit measured against capital invested. The standards board that defines it says related measures differ mainly in how investment is defined, which is where most disagreements live. The tax code draws the sharper line: money you deduct this year is spent, money you capitalize is invested.
Send it over and we will tell you what it actually says. Thirty minutes, no follow-up sequence.
