The Data Privacy Conversation Every Client Needs, Even if They Don't Ask

I was hired once for a straightforward tagging implementation, nothing privacy-related in the scope. Two days in, I noticed the client was passing full, unhashed email addresses into a third-party pixel that had nothing to do with the scoped work and everything to do with a data-sharing agreement nobody on the marketing team seemed aware existed.

It wasn't in my contract to flag it. I flagged it anyway, in a short, specific message — not alarmist, just factual about what data was leaving and where. The client had no idea it was happening; it turned out to be leftover from an integration set up two years earlier by someone no longer there.

A client who finds out about a privacy exposure from a regulator trusts you less than one who finds out from you, even if it's not technically your job to tell them.

Why I raise this unprompted now, every time

Most clients genuinely don't know what's leaving their stack. They hired someone to build a feature, not to audit privacy exposure, so nobody's specifically looking for it unless it's someone's actual job — and in most mid-size companies, it isn't clearly anyone's job. A consultant who's already in the tracking layer is often the only person who will ever see it before it becomes a real problem.

• I now scan for unhashed PII in outbound requests as a standard, unbilled five-minute check on any project touching tracking, regardless of scope.
• I flag anything found immediately and in writing, with no judgment attached — this is almost never anyone's current fault.
• I don't try to fix it under the existing scope unprompted; I raise it and let the client decide whether to scope a fix.
• I document that I raised it and when, which protects both of us if it becomes a larger issue later.

This costs me a small amount of unbilled time on every project. It's bought more trust and more follow-on work than almost anything else I do, because it demonstrates something a client can't easily verify about a consultant any other way — that I'm looking out for their risk even when it's not explicitly what they're paying me for.