Before adding a field to a tracking event, name the decision it will change. Collecting information without a defined use adds work and risk to a measurement system that may already contain more data than the team needs.
Privacy by design starts earlier: define the question, collect the evidence needed to answer it, and set boundaries around how that evidence is used.
Give every field a purpose and owner
A large dataset can still be difficult to trust. Duplicate events, unnecessary personal fields, unclear consent states, and inconsistent retention rules make analysis harder to explain. They also expand the consequences of a mistake.
A smaller, well-defined dataset is often more useful. When every event has a purpose, an owner, and a documented destination, teams can understand where a number came from and whether it should inform a decision. Restraint becomes a form of data quality.
Start with purpose, not collection
Begin each measurement request with the business decision it is meant to support. A purchase event may help evaluate acquisition. A product-view event may help diagnose the journey before checkout. If a field does not change either decision, question why it is being collected.
For each signal, document its purpose, the consent or other basis your organization relies on, where it is sent, who can access it, and how long it is retained. The appropriate choices depend on the business, the region, and the advice of qualified privacy professionals. A measurement design cannot, by itself, guarantee compliance with GDPR, CCPA, or any other law.
Make consent part of signal quality
Consent should travel with the event, not remain isolated in a banner or preference screen. Downstream reporting should be able to distinguish permitted signals from signals that must be withheld, limited, or deleted.
Technical transformations are not substitutes for policy. Hashing changes how a value is represented; it does not automatically make collection or transmission appropriate. The same principle applies to aggregation and redaction. Use them deliberately, document what they do, and keep legal and privacy owners involved.
Judge the system by what it refuses
Choose one event and review its fields, destinations, access, retention, and deletion path. Remove collection with no current purpose, and ask the privacy owner to review any unclear use before it expands.
Keep that record with the event definition. Revisit it when the campaign, vendor, or customer experience changes so the team can explain why each signal is collected and where it may go.
