Analytics and privacy

Collection is scoped to questions somebody has actually asked. A field with no named use is not gathered, because data held without a purpose has all of the exposure and none of the value, and it is precisely what makes a breach notification longer than it needed to be.

The number of third parties is kept small and is counted. Each tag is an origin outside the business's control executing code with full access to the page, able to read what a visitor types, and installed in most cases by someone who has since left. A tag manager nobody has audited is not one dependency; it is however many the person with access has added.

First-party and server-side collection is preferred where it is workable. It survives browser restrictions that are tightening instead of loosening, it keeps visitor data out of an additional intermediary, and it produces a record the business owns rather than rents.

Consent is honored before collection rather than after. A banner that sets cookies while asking permission is worse than no banner at all, because it produces a durable record of the business asking and then not waiting for the answer. Where consent is declined, the tags do not fire and the reporting reflects that instead of routing around it.

Personal data is kept out of event parameters. Email addresses, order contents and account identifiers passed into analytics as properties end up in a third-party system with its own retention, its own access model and its own jurisdiction — usually because a URL carried them in a query string and nobody stripped it.

Retention is set deliberately. Every platform has a default, most defaults are long, and a default is a decision made by not making one. The period is chosen against how far back anyone genuinely looks, which is rarely as far as the default assumes.

The published privacy policy is written from what the systems actually do, read out of the same configuration that installs the tags, rather than adapted from a template describing a business that collects different things. A policy that overstates collection is a needless liability; one that understates it is a false statement.

Third parties receiving visitor data are named. A business should be able to answer which companies its data reaches and what each one does with it, and assembling that list after the question arrives is materially harder than maintaining it, because by then the answer has to be reconstructed from a tag configuration nobody wrote down.