How to collect customer data legally
What you'll learn
- →The three laws every US/EU business must follow
- →Consent vs. legitimate interest
- →What you must disclose in your privacy policy
- →Data minimization (collect less, sleep better)
Before you start
- □A website that collects any user data
- □An attorney for the final review (this guide isn't legal advice)
This is not legal advice — get a lawyer for your specific situation. But here are the foundational practices every small business should follow.
The steps
- Step 01
Map every data point you collect
Email, name, IP, payment, behavior. You can't protect what you haven't inventoried.
- Step 02
Collect only what you need
Data minimization. Birthday isn't required for a newsletter. Less data = less liability.
- Step 03
Get explicit, granular consent
Separate checkboxes for marketing, newsletter, analytics. Pre-checked boxes are illegal in EU.
- Step 04
Publish a clear privacy policy
What you collect, why, with whom you share, how to delete. Plain English.
- Step 05
Add a cookie banner that respects choice
EU/UK requires opt-in for non-essential cookies. CCPA: opt-out for sale.
- Step 06
Honor deletion and access requests
Build a process to retrieve and delete a user's data within 30 days.
- Step 07
Secure data appropriately
Encrypt at rest and in transit. Don't store passwords in plaintext. Don't email spreadsheets of customer data.
- Step 08
Include unsubscribe in every marketing email
Required by CAN-SPAM, GDPR, and basic decency.
Common questions
+Does GDPR apply to US businesses?
Yes — if you have EU users. Geolocation doesn't help.
+Do I need a cookie banner?
If you have EU/UK users or use non-essential cookies, yes.
+What's the fine for non-compliance?
GDPR: up to 4% of global revenue. CCPA: per-violation fines.
+Can I send a cold email?
B2B is often allowed; B2C usually requires opt-in. Region-dependent.
+Where do I host my privacy policy?
Footer link, accessible from every page.
What to do next
Social Perks turns happy customers into a marketing team. Free 14-day trial. No card required.
Start freeMore guides in Customer acquisition
A scrappy, repeatable playbook for hitting the magic 100-customer milestone organically.
The framework that grows real customers — not contest-hopping accounts who unfollow the next day.
Set up tracking, commission, and recruitment in a week. No agency required.
Give-X-get-X mechanics, friction tradeoffs, and the messaging that drives 30%+ acquisition from referrals.