Privacy Promises & Data Practices

Why this matters for your business

Every business that collects customer data makes privacy representations — in privacy policies, on forms, in checkout flows, and in marketing. When those representations don't accurately reflect what actually happens with customer data, the FTC treats that as a deceptive practice.

This isn't just about your privacy policy. It includes the data collection promises you make on opt-in forms, in email sign-ups, and throughout your customer journey. Even informal language like "we'll never share your email" creates an enforceable promise.

---

What we look at

• Your privacy policy language versus your actual data collection and sharing
• Promises made on forms, opt-ins, and checkout pages
• Third-party data sharing (analytics, ad platforms, CRM tools)
• Use of cookies, tracking pixels, and behavioral data
• How data is described and used in marketing
• Children's data considerations (COPPA, if applicable)

---

Common issues we find

• Privacy policy language that's outdated or doesn't reflect current tools and platforms
• Data sharing with third parties not disclosed in the privacy policy
• Informal privacy promises that are stricter than actual practice
• Cookie and tracking disclosures that are missing or inadequate
• Data retention claims that don't match reality

---

How we help

We assess whether your privacy-related representations — across your website, marketing, and customer-facing materials — match your actual data practices. Our recommendations identify specific mismatches and provide clear guidance on how to bring them into alignment.

We focus on FTC-level privacy compliance, not comprehensive privacy regulation (like GDPR or state-level laws). For businesses that need broader privacy legal work, we can provide referrals.