Data Governance and Privacy: Key Topics for Retail

In the world of retail, data — especially customer data — is vital. It provides companies with insights into purchasing trends, enables personalized experiences for individuals, and allows retailers to build relationships that deliver value to their customers. But like any valuable asset, customer data is subject to risks and must be protected. From compliance obligations and regulatory penalties to a loss of brand reputation and consumer trust, the numerous risks retailers face continue to evolve.

Key Data and Privacy Considerations for Retail Industry Regulation and Tracking Technology

As more states and international jurisdictions pass new privacy laws and strengthen existing ones, retailers must stay abreast of changes to requirements in tracking technology. That technology includes cookies, banners, tags, pixels, consent management, retargeting, analytics tools, and mobile app tracking. Regulators are looking into whether companies are honoring opt-out choices across retailers’ websites, apps, emails, loyalty programs, and paid media.

With at least a dozen states now recognizing the Global Privacy Control browser signal, there has been a notable increase in the scrutiny of retailers’ websites. The public-facing nature and accessibility of websites also make them an easily audited area for regulators. Retailers who fail to properly abide by tracking technology requirements — even through unintentional actions such as misconfigurations — can face stiff penalties.

While the U.S. does not have a federal privacy law, individual states continue passing legislation that directly impacts retailers. This results in states such as California and Colorado, which have some of the most robust privacy requirements, creating a de facto baseline for organizations to abide by.

Artificial intelligence presents retailers with novel opportunities to engage with their customers and provide enhanced service. From answering product questions online to providing deep personalization to customers, AI can enhance shopping experiences across different platforms and in person. But to function properly, AI needs data, and for retail companies, that data often contains personal information. Retailers must understand what data AI platforms and agents are accessing, how they’re using it, and how it’s being protected. Additionally, companies need to establish protocols for how they store and govern data, keeping it only as long as they have a business need and is legally required.

Personalization features aren’t just limited to AI-enabled experiences. While AI can enhance those features, customers have been willing to provide retailers with information in exchange for a more customized shopping experience for years.

The willingness of customers to offer personal information comes with an important caveat: When they opt in to sharing their information, customers expect companies to safeguard and handle it responsibly. When retailers apply strong data governance practices, they can effectively use personal data to better understand their customers’ preferences and meet demand.

Strong data governance practices can help retailers maintain compliance with expanding privacy laws. There are several steps that retailers can take to help make the compliance process easier, including:

• Addressing data fragmentation, where data becomes scattered across platforms and systems. Data fragmentation hampers AI use by segmenting data across multiple areas rather than in a single accessible repository. Addressing this allows companies to properly inventory their data, leverage its value, and implement appropriate data protection controls.
• Building a culture where privacy considerations are part of standard operations. This means creating a culture in which teams understand their responsibilities, note concerns as they arise, and work together to handle privacy-related challenges.
• Conducting tabletop exercises to prepare teams for real-world situations they may need to respond to in the event of a security incident.

Privacy and trust are inextricably linked. In addition to fulfilling compliance obligations, retailers can demonstrate their commitment to safeguarding customer data by honoring their privacy choices.