Online advertising sprays data everywhere

I was conscripted into the South African army at 18. Here's one of the few pictures I have. (I was stationed on a small base in the bush far away from HQ which is why I got away with the big hair.)

Someone described military service as

weeks of boredom punctuated by moments of terror.

Pretty accurate.

This essay is about something that's boring until it isn't: protecting customer data.

I'm not a doctor or a lawyer, why should I care?

If you're not in an industry that handles sensitive enquiries it feels like this shouldn't matter. Is it really a big deal if a valve supplier or electrician's CRM is hacked?

Turns out it might be.

More and more countries are passing privacy laws. If you aren't already subject to regulations like HIPAA, GDPR, POPI, CCPA etc you probably will be in future.

And here's a thing, just being accused of a violation, true or not, changes this from boring to terrifying. The time, cost and stress involved in defending your business are likely to be overwhelming.

I’m doing my best not to exaggerate or sensationalise this. But I also don’t want to sugar-coat it. In part that's because, until recently, I haven't paid much attention to the risks that come with running online ads.

Every tool creates a copy of the lead's data

Think about a lead who contacts you via a form on your website. Every tool or system that interacts with that lead creates a copy of some or all of the lead's personal data.

• The form builder (e.g. Typeform, Jotform or Gravity Forms).
• Analytics platforms like Google Analytics.
• CRMs like HubSpot, Salesforce or GoHighLevel. Or if you don't use a CRM the data is in an inbox, a spreadsheet or a support ticket system.
• Booking systems and calendars.
• Automation tools like Zapier or Make.
• Lead delivery notifications: email, SMS, WhatsApp, Slack.

And it's the same if the lead called. Call data ends up with Google or call tracking services like CallRail or CallTrackingMetrics. Someone in marketing ticks "Enable AI analysis" and now OpenAI, Anthropic or one of the other AI services also has a copy of the conversation.

And then there are invisible records: webhook logs, server logs and backups.

None of what I've described is unusual. Anyone who runs ads has a similar tech stack. You need this to make the ads work.

But here's the problem: The tools control what's collected, how long it's stored for and who has access. But you're responsible. The small print doesn't say "We'll take the blame if that data gets leaked."

So what's a realistic solution?

I think it starts with changing how we think about customer data.

I've always thought that it's an asset. Collect it all. Keep it forever.

The opposite is actually true. Customer data is a liability. We should collect as little as possible, share only what's needed to do the job and delete it as soon as we can.

As I was thinking about this I realised I'm part of the problem too.

I've built tools that improve lead tracking and Google Ads performance. Those systems need customer data to do their job.

But I've become convinced that "collect everything forever" is the wrong default. It exposes my clients to unnecessary risk.

So one of the changes I'm making in my own products is giving clients more control over what gets stored, how long it's retained and when it's anonymised or deleted.

Related articles

The book I couldn't write today

What happens when an engineer applies failure investigation thinking to Google Ads and tries to eliminate the black boxes?

Ignore the AI hype. Watch the engineering.

Discussions about the future of Google Ads usually start with what’s announced: new features, calling everything Max-this or AI-that. But often this is PR hype. I prefer to look at where Google continues to invest engineering effort over many years. It gives a clue to what the system will depend on in the future.

You can't afford to be sloppy anymore

When I started with Google Ads in 2007, it was cheap. You could get away with a sloppy setup. That's not true today. Ads are expensive. You can't expect to be profitable if you haven't done everything in your power to get the setup right.

Tried to Fix Lead-to-Sale with Software. Here's What Actually Happened.

After building a lead-handling system that turned $8k in ad spend into $200k, I thought I knew what small businesses needed. I was wrong. This is the story of a good idea, a bad assumption, and what I learned about the real challenges of getting people to change.

"We Tried That, and It Didn’t Work” – How to Overcome Resistance to Change

One thing still amazes me: people pay for my advice - then ignore it completely. Sometimes they'll dismiss my suggestions without a second thought. Here's how I fix it.

3 thought-provoking questions

I recently came across the work of user experience designer Pavel Samsonov. He shared three thought-provoking questions that really cut through the fluff.

Topics you'll find on this site