Explaining Tracking to a Customer Who Asks

The question is a good sign

Somebody asking what happens to their information is engaged rather than hostile, and the question is increasingly ordinary rather than unusual.

The instinct is defensive: to send a link to the privacy policy, or to escalate it as though a complaint has been received.

Neither is right. A plain answer, given quickly by whoever received the question, reflects better on a business than any document, and takes about two minutes.

It also frequently ends the matter, where a policy link tends to produce a second and more pointed question.

Answer the question they asked

Most such enquiries are narrower than they sound.

Somebody asking why they are seeing your adverts after visiting your site wants to know how that works, not a complete account of your data practices.

Somebody asking whether you sell their details wants a yes or a no, first, before any explanation.

Answer the actual question in the first sentence, then add the context. The reverse order reads as evasion even when the eventual answer is fine.

The five things worth having ready

• What you collect, in ordinary words.
• Why, stated as a purpose rather than a legal formula.
• Who else sees it, named.
• How long you keep it.
• How to ask for a copy or deletion.

Write these once, in plain language, and keep them where whoever answers the phone can reach them. The question does not usually arrive at a convenient moment.

Plain language, not policy language

The difference in practice is substantial.

We process personal data in accordance with our legitimate interests is accurate and tells a person nothing.

We keep your name, address and phone number so we can do the job and contact you about it, and we keep it for seven years because our accountant needs the records is the same information in a form somebody can evaluate.

Name the third parties rather than referring to trusted partners, which reads as concealment even when it is not meant that way.

And avoid reassurance that does not say anything. We take your privacy seriously is what every organisation says immediately before explaining what it collects.

The advertising question

The most common version by far, and it deserves a straight answer.

Somebody visited your site, then saw your advert elsewhere, and finds it unsettling.

The honest explanation is short: a piece of code on the site tells an advertising platform that a visit happened, and the platform can then show adverts to people who have visited. It does not tell you who they are, and you cannot see individuals in it.

Then tell them how to stop it: the platform's own settings, and your consent options if you have them.

People respond well to this. The discomfort usually comes from not understanding the mechanism, and a plain description removes most of it.

A worked example

A retailer received an email asking, fairly bluntly, whether they were selling customer email addresses because the customer had started receiving unrelated marketing.

The temptation was to send the privacy policy and a general denial.

Instead they replied with four sentences: no, they had never sold or shared customer details; the address was held in their order system and their email tool, which they named; it was used for order updates and for a monthly email the customer had opted into; and it could be deleted on request.

They added that they could not account for the unrelated marketing and suggested where else the address might have been given.

The customer replied thanking them and remained a customer.

The whole exchange took ten minutes and the answer was available because somebody had written those five points down the previous year.

If you cannot answer, that is the finding

The uncomfortable and useful outcome.

A business unable to say what it collects, who receives it, or how long it is kept has discovered something more important than the answer to one customer's question.

The right response is to say honestly that you will find out and come back to them, then actually do it within a few days.

That is a better answer than a confident guess, which risks being wrong in writing, and it is a better answer than silence, which turns a question into a complaint.

Then fix the underlying gap, because the next person will ask the same thing.

Requests to see or delete

A step beyond a question, and worth being ready for rather than surprised by.

People generally have the right to ask what you hold about them and to ask for it to be corrected or deleted, with limits where you need it for other obligations such as tax records or an ongoing contract.

Have a route: who receives such a request, where the information is held, and roughly how long a response takes.

Acknowledge quickly even if the answer takes longer, since delay is what escalates these.

This is a general description rather than legal advice, and the specific rights and timeframes depend on where you and the person are.

Train whoever answers first

The practical failure point in almost every business.

These questions arrive by phone, at a counter, or in a reply to an ordinary email, and reach whoever happens to be there.

If that person's only options are to guess or to promise a call back that nobody makes, an easy conversation becomes a difficult one.

Give them the five points on one page and permission to say plainly that they will find out and respond by a stated day.

Twenty minutes of briefing prevents the two situations that actually cause trouble: an incorrect confident answer, and no answer at all.

The counter-case

Openness has limits, and a few are worth observing.

Do not discuss another customer's information with anybody, including somebody who believes they are entitled to it, without verifying who you are speaking to.

Do not describe your security arrangements in detail, since that is a different question wearing the same clothes.

And where a request is plainly a legal matter, arriving from a lawyer or framed as a formal complaint, take advice rather than improvising a helpful reply.

The default is plain and open. The exceptions are identity, security specifics, and anything that has become formal, and those are narrow.

Getting ready

1. Write the five points in plain language, once.
2. Name the third parties rather than describing them.
3. Keep it where phone staff can reach it.
4. Answer the actual question first, then the context.
5. Say you will find out rather than guessing.
6. Have a route for copy and deletion requests.
7. Verify identity before discussing anything personal.

Step one is an afternoon and it is the difference between a two-minute reply and a fortnight of escalation.

The document behind all of this is covered in the privacy policy nobody wrote.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.