12 Days of Privacy

The holiday season is a festive feast of customer data, but responsible collection and use are vital. Every interaction — from click to check out — can build or erode trust, impacting your brand long after the holidays.

Here are key holiday shopping touchpoints where customer consent is required.

Cookies and trackers

Cookies and trackers

New pages, new pixels! Tell shoppers what’s tracked and why so consent is informed. Also, partners who share data share privacy responsibility.

In-session personalization

In-session personalization

Recommending the perfect gift for Mom? Lovely — but remember, even merry marketing needs consent before you start personalizing.

Loyalty and rewards programs

Loyalty and rewards programs

New customers — cheers! Just don’t carry that holiday fling too far. Be upfront about data use for programs and get new consent for new purposes.

Checkout and payment flows

Checkout and payment flows

Holiday shopping brings a flurry of data. At checkout, if you’re inviting newsletter signups or dangling offers or discounts, get consent first. Fair deals are the sweetest.

Post-purchase marketing

Post-purchase marketing

One purchase doesn’t guarantee another date under the mistletoe. Ask before sending promos or keep it low key with a quick review request or product care tips.

Mobile apps and notifications

Mobile apps and notifications

Privacy’s not just for websites. Ask before sending push alerts or tracking location. Simple prompts like “Turn on delivery updates” work best.

Advertising and retargeting

Advertising and retargeting

Retargeting’s festive sparkle fades without consent. Be transparent about pixels and ad personalization to keep your brand on the nice list.

Promotions, contests, and campaigns

Promotions, contests, and campaigns

Contest entries or discount codes aren’t wishes to join your mailing list. Tell customers what they’re agreeing to and keep the rest of their data wrapped.

Customer support and chat tools

Customer support and chat tools

oy troubles? Remember: help calls, chats, and tickets log data. Good elves share a quick, clear note on how it’s collected and used. (Batteries optional.)

Give (and get) the gift of trust this holiday season. Privacy-centric brands aren’t just compliant. They convert better. Stay on your customers’ nice list all year round.

The holidays can bring digital privacy risks along with delight, and it’s not just your credit card transactions that you need to keep an eye on. Smart speakers, consoles, and connected toys often request logins, microphone access, or account pairing, all of which can open the door to new forms of data collection. With a few proactive steps, families can enjoy their new tech while limiting privacy exposure.

Start with setup: Make security part of unboxing

Before batteries go in or the device powers on, take a moment to review privacy settings, permissions, and connection options. Most devices now provide granular controls that can help to support safer and more private use.

Recommendations for better security and data privacy

Recommendations for better security and data privacy

Create unique logins and avoid reusing passwords

Across toys, streaming services, and email accounts. A password manager helps generate strong credentials, and masked email addresses can reduce spam and reveal when data has been shared.

Turn on multi-factor authentication

Wherever offered, especially for gaming, social platforms, and device ecosystems. It’s a simple way to reinforce access security.

Check network access

And ensure your Wi-Fi is properly secured. Creating separate networks for work, guests, and devices can help isolate risks.

Update firmware right away

As many patches are released only after devices leave the factory. Older toys or gadgets may be several updates behind.

Smart devices, smarter privacy

Connected toys and AI-enabled assistants are increasingly common. They can capture snippets of conversation or behavioral patterns, so it’s important to understand how they listen — and how to limit what they store.

A brief look at how these devices operate can help you make informed choices as you configure them.

How connected toys and digital assistants listen and respond

Voice assistants listen locally for a “wake word,” such as “Alexa,” or “Hey Siri.” When detected, the device begins recording and interpreting speech. Commands are typically processed in two stages: on-device wake word detection, followed by cloud-based natural language processing.

While wake word detection means devices aren’t continuously recording, they are continuously listening, which is what creates privacy questions for many families. 

Devices’ “listening” isn’t foolproof

False activations are possible. Music, similar-sounding words, or background noise can trigger recordings unexpectedly. There have also been cases where snippets were reviewed by human evaluators to improve accuracy.

Such incidents have raised concerns, particularly when mistaken activations resulted in private conversations being transmitted to unintended contacts. In addition, some criminal investigations have involved requests for smart speaker recordings. Providers are increasingly shifting more processing on-device to minimize exposure.

Checklist for better security and data privacy

Follow the principle of least privilege

And grant only the permissions a device truly needs.

Choose on-device processing

Where possible so information remains local.

Disable microphones or cameras

when not needed, or use a physical mic-mute switch during sensitive conversations.

Turn off always-listening modes

And review companion app access to photos, recordings, contacts, and location.

Place voice-enabled devices away

From areas where private or work-related discussions happen.

Delete recordings or history

Periodically if cloud storage is used by default. Opt out of human review programs when available.

Turn off optional features

Like drop-in or voice purchasing, especially when credit cards are linked.

Use parental controls

Voice profiles, and periodic audits of linked integrations or calendars.

Register toys to an adult

Rather than a child to reduce the amount of identifying data collected. Many children’s accounts require parental authorization by law.

Notable enforcement actions for toys, games, and connected platforms

Regulators have taken significant action in recent years against platforms, toys, games, and ed-tech providers that mishandled children’s data. These cases underscore the importance of parental consent, transparent defaults, and appropriate data handling.

Examples include:

Bringing privacy and safety into the season

As new devices, apps, and connected toys enter your home, a few mindful steps can help your household enjoy them safely all year. Strong credentials, sensible permissions, and understanding how listening technologies operate all help reinforce confidence and control at a time when data can travel quickly.

As children explore new tools, adult guidance becomes part of their digital foundation. Helping them make informed choices about privacy equips them with safe, long-lasting habits. With a thoughtful approach to holiday tech, you can enjoy the season’s excitement while protecting your family’s data well into the new year.

The holiday season can be hectic, so anything that simplifies planning or shopping can feel like a lifesaver. Many families are using AI-powered tools to plan entertaining, shop efficiently, and coordinate busy schedules.

These tools raise questions about privacy, data collection, and control. With the right knowledge and a few practical habits, holiday browsing can be smoother, safer, and more enjoyable.

Recent research from Pew Research Center shows that 73 percent of Americans are willing to use AI for everyday tasks. But 57 percent feel they have little or no control over use of these systems in their lives, and many consumers encounter AI without realizing it. 

Understanding how AI collects and uses your data

As AI becomes more common in shopping apps, voice assistants, and browser extensions, many people use these tools without fully realizing how much data they collect. AI systems can interpret prompts, track browsing behavior, and learn from user interactions to improve recommendations.

Common AI touchpoints during holiday shopping

These tools often rely user inputs to tailor suggestions, including:

• Answering questions about stores or products
• Making recommendations for gifts, menus, or travel
• Suggesting nearby shops and checking hours of operation or delivery cutoffs
• Price-checking or deal-finding extensions

What data do AI-powered tools collect?

Depending on settings, AI tools may collect:

• Search queries and browsing activity
• Written or spoken prompts
• Location data (depending on settings)
• Shopping cart contents or purchase history

Practical privacy habits for adults

Limit what you share. AI tools rarely need very personal details to be useful. Try using neutral phrasing such as:

• “Gift ideas for a 10-year-old who enjoys drawing” instead of naming the child
• “Create a holiday budget template” rather than entering card details or specific purchases
• “Turn the lights on at 5 p.m.” without providing a specific address or travel dates

Review privacy policies, consent banners, and permissions

Smart data privacy management continues once your AI assistant has given you website or app recommendations. Treat consent banners as quick privacy dashboards.

 Rather than automatically selecting “Accept all”, take a moment for review, and potentially to opportunity to explain these actions to children in an age-appropriate way:

• Look for clear descriptions of what data is collected and for what purposes
• Adjust granular settings if available
• Decline optional permissions that don’t relate to your task

Strengthen your device and account protections

Simple security checks provide valuable support for safer browser and reducing the risk of data exposure:

• Update devices and apps
• Use strong, unique passwords (and ideally a password manager)
• Enable two-factor authentication on key accounts
• Prefer secure home networks over public Wi-Fi when logging in or checking out
• Turn on browser fraud warnings and password-breach alerts
• Consider checking out as a guest when possible to limit stored information

Check the value exchange

If an AI tool, website, or app asks for information, it should be for a clear reason that directly relates to what you want to do.

If asked for access to contacts, precise location, photos, or full browsing history, pause and consider:

• Why does it need this information?
• Does the request clearly relate to what I’m doing?
• Can I decline and still use the tool?

If the purpose isn’t clear, it’s reasonable to say no and go elsewhere. This is especially true for platforms aimed at children. Data privacy laws generally have strict requirements for platforms regarding access to kids’ information. 

Teaching children to use AI safely

Children often use AI tools without realizing that some details they share may be personal. And just because the family may talk to a household AI assistant often, it’s not a friend, or even a person.

Set boundaries and model good habits

Kids learn by watching adults. When they see you reading or phrasing prompts carefully, adjusting cookie permissions, or avoiding oversharing, they absorb those behaviors. Where possible:

• Enable built-in child protections or family settings
• Use supervised accounts for younger children
• Disable or restrict purchasing features in smart devices

Exercise strong caution with smart toys using AI, as there are few controls on them to date, and they have been found to say inappropriate and disturbing things. The impact on such smart toys on children also hasn’t yet been well studied.

Explain “private information” in simple terms

One helpful guideline is: If you wouldn’t tell a stranger, don’t tell an AI tool. Examples of information you don’t want to share include:

• Full names or birthdates
• Passwords or usernames
• Names and locations for home, school, or activities
• Family travel plans
• Photos revealing locations, identities, or personal details

Encourage kids to ask an adult before sharing anything new or if they are confused or concerned about any online information request.

Make safe browsing a shared activity

The holiday season provides opportunities for shared activities, like coming up with kinds of cookies to bake or shopping together. Be intentional about how you phrase questions or prompts to AI assistants, and identify secure websites and trusted retailers.

Evaluating AI tools before you use them

Take a moment to look into the design and data practices of AI-powered tools. Transparency is a strong indicator that a company respects data privacy and security.

• Do they describe what data they collect and why?
• Are there reports of privacy violations or problematic practices with the provider? 
• Are there disproportionate promises in exchange for information?
• Are users able to opt out of various tracking or personalization?
• Can users easily customize account settings and user experience? 

Safer, more secure holidays for a happier new year

The benefits of AI-powered tools rely on thoughtful use. A little clarity and care can help families enjoy the convenience of AI while staying in control of their data and privacy, not just during the holidays but throughout the year.

Demonstrating respect for data privacy builds trust and encourages ongoing donor relationships. Safe and trustworthy donation experiences are a gift that charities can give individuals and companies.

Why can giving be riskier during the holiday season?

Why can giving be riskier during the holiday season?

• Most annual gift-giving takes place in November and December
• More giving is now done online, via websites, apps, crowdfunding, and social platforms
• Donating exposes and transfers sensitive personal information

What personal information do charities collect?

What personal information do charities collect?

• Personal: Names, emails, phone numbers, addresses
• Financial: Donation amounts, payment details via processors, tax info
• Motive-related: Causes may reveal health, religious, political, or social info
• Digital: Cookies, website analytics, campaign tracking

How to vet causes before giving

Check legitimacy

• Registration numbers
• Verified directories
• Transparency ratings

Review privacy practices

• Clear notice
• What data is collected and why
• Cookie/tracking disclosures

Evaluate security

• HTTPS (check website URL)
• Reputable payment processor
• Multi-factor authentication option for logins

Watch for red flags

• Urgency pressure
• Unsolicited messages, especially DMs
• Requests for excessive personal information

Safe giving for individuals

Safe giving for individuals

• Use official websites and trusted platforms
• Share only personal information that is necessary
• Opt out of optional tracking
• Donate on secure networks
• Use a credit card for added fraud protection
• Keep receipts and donation confirmations

Safe giving for companies

Safe giving for companies

• Vet charity partners and giving programs with due diligence
• Vet third parties that charities work with who may access personal data
• Ensure contracts include data protection terms
• Avoid sharing employee data without clear purpose
• Request transparency about how corporate contributions are used
• Promote secure giving channels for employee drives

Privacy compliance for charities

Follow legal requirements and privacy best practices

• Provide a lawful basis for personal data collection and use (where required)
• When obtaining consent for data collection and processing, ensure it’s informed and voluntary
• Use donor data only for clearly defined and communicated purposes
• Collect only the data necessary for the stated purposes, e.g., processing the donation
• Ensure opt-out or consent withdrawal options are easily accessible
• Ensure any third-party partners with access to donor data maintain appropriate data privacy and protection practices

12 tips to help marketers optimize holiday consent

The holiday season brings high-intent shoppers and a flood of behavioral and transactional data. But are you collecting and activating it the right way? 

Trust increasingly determines whether consumers choose you or move on, and it’s fast becoming a performance metric in its own right.

Here are 12 quick tips to help refine consent flows while reinforcing credibility, control, and transparency. Keep the season merry and bright for customers and marketers alike.

Day 1: Refresh your consent banner

You want to make a great impression on all of those holiday shoppers, not just with great deals. 

When was the last time you updated your tracking technologies or your consent banner design?

A fresh layout with short, clear explanations and easy-to-navigate choices is a great gift for all. Make it fun with festive visuals.

Day 2: Make consent part of the holiday user experience

Consent doesn’t need to be a hurdle. Integrate it naturally when people create wishlists, playlists, or check out. Contextual prompts reinforce clarity and keep the journey smooth. 

People say yes more often when they understand how consent can benefit what they’re already doing.

But remember, consent for one thing isn’t consent for everything. Just because someone bought Grandma a scarf doesn’t mean you can subscribe them to your newsletter.

Day 3: Check for privacy compliance updates

Regulations and platform requirements evolve as quickly as your marketing stack.

A quick pre-campaign audit of your CMP settings supports privacy-compliant, dependable data flows throughout the holiday rush.

And with new regulations arriving 1 January 2026, now isn’t the time for a long winter’s nap (or a trip to the beach if you’re in the southern hemisphere).

Day 4: Optimize for mobile-first shoppers

Mobile usage surges during peak season, Make sure your consent banner loads quickly, displays clearly, and offers easily accessible choices. 

Small improvements can enhance trust and encourage users to stick with you. 

Mobile users are already less patient, so don’t make the journey feel longer than a winter’s night at the North Pole.

Day 5: Use consented data for better personalization

With the right permissions, you can deliver fun and relevant experiences.

Zero- and first-party data is the most accurate and reflective of customers’ needs and interests. 

Highlight how personalization benefits them to reinforce the value exchange. For example, quicker, more targeted gift suggestions or restock alerts. A hectic time becomes easier, even enchanting.

Day 6: Keep your purposes clear and simple

During a busy season, clarity wins. Decision fatigue is always lurking.

Keep purpose descriptions short and in plain language so people understand what you want, why, and how it improves their experience.

When they trust the exchange, they engage longer and share more.

Day 7: Test seasonal consent banner variations

If you’re optimizing holiday content, optimize your consent banner too.

A/B testing microcopy, placement, or button text reveals what improves engagement. Watch opt-in rates and interaction patterns to guide refinements. 

What you learn will be valuable year-round.

Day 8: Strengthen trust through transparent messaging

Trust drives conversions, especially when shoppers have endless options.

Be clear about how consent and data support safer, more relevant, more personal experiences.

Avoid vague claims. Short, well-timed explanations go a long way toward building confidence.

Day 9: Improve page performance

Peak traffic strains websites, and delays increase drop-offs. 

Reducing non-essential scripts, reviewing tag load order, and avoiding heavy elements can help pages load faster — supporting user satisfaction and higher opt-in rates.

Give the gift of helping people get what they want, when they want it.

Day 10: Review server-side integrations

Reliable data flows matter even more during busy seasons. Gaps in privacy compliance or attribution are worse than a lump of coal.

Review your server-side tagging setup to confirm consent signals are honored across the stack. Better measurement, better attribution, and more respect for user choices.

It also keeps you firmly on the “Nice” list.

Day 11: Streamline consent across channels

Consistency across websites, apps, email, connected TV, and more reinforces trust and reduces confusion and frustration. 

You don’t need magic. Just a solid CMP to support cross-device and cross-platform consent management.

It’s especially helpful for returning customers engaging across multiple touchpoints

Day 12: Measure and celebrate improvements

Seasonal data offers insights for the whole year.

Review changes in opt-in rates, performance, and engagement to see what resonated.

Carry forward successes. Better transparency, UX, and messaging will help you build momentum for the new year. For sustainable growth all year long.

Smarter, safer holiday tech for families (and how brands can help)

The holiday season often comes with new gadgets, games, and connected toys, along with the rush to set them up. In the excitement, it’s easy to skip privacy checks that shape how much data you and your family share. 

A few minutes of mindful setup can help support safer and more transparent experiences for everyone, especially children.

Resources to help make informed privacy choices

You don’t have to investigate every device alone. There are good sources that offer clear, consumer-friendly reviews of privacy practices. These resources can help you spot red flags before you buy or set up accounts.

• BBC reporting often highlights digital privacy issues, breaches, and risks, which are helpful when researching a device or brand.
• Consumer Reports Digital Lab evaluates common tech products and explores what happens behind “Agree” buttons.
• Common Sense Media has Parents’ Ultimate Guides with reviews, parental control setup instructions, and more, filterable by age, platform, and more.

Account hygiene: Seasonal cleaning for your accounts and data

New devices usually mean new accounts for games, apps, streaming services, and cloud backups. All of these expand your digital footprint. Taking time for basic account hygiene supports safer year-round use.

Recommendations for better security and data privacy

Safer digital experiences begin with small, practical steps that help you stay in control of your data — including preventing access to it entirely.

Privacy Dashboards

Privacy Dashboards

Platforms like Google, Apple, Meta, and Amazon offer centralized controls for permissions and family settings.

Third-party integrations

Third-party integrations

“Sign in with” options can expose more data than necessary. Use direct email registration when possible.

Old Accounts

Old Accounts

Delete or deactivate unused accounts, including those created during past holidays. Tools like Have I Been Pwned can reveal compromised credentials.

Password Management

Password Management

Use a password manager to track accounts, generate strong passwords, and monitor reused or weak credentials.

Child Profiles

Child Profiles

Enable child-specific profiles and parental controls rather than granting adult access.

Teaching kids to be privacy-savvy

Kids adopt digital habits quickly. Introducing privacy concepts early helps them navigate devices and apps with confidence.

Explain, in age-appropriate terms, why personal data matters, what devices can collect, and why some information shouldn’t be widely shared. Many kids are naturally vigilant once they understand the risks, and often remind others.

Examples you can discuss together:

• “Your toy can listen like a microphone. Let’s decide when that’s OK and when it should stay muted.”
• “Usernames and account details shouldn’t include your real name, school, or address.”
• “If an app asks for your photo or location, check with me first.”

Check before you connect

Before downloading an app, pairing a toy, or creating a new account, run a quick check of the essentials. A few extra minutes can prevent unwanted data exposure and create a safer digital environment.

Reputation and origin

Reputation and origin

Look up the developer or manufacturer with terms like “breach,” “privacy,” or “fine.” Some countries are not considered adequate for international data transfers.

Requested permissions

Requested permissions

Review camera, mic, location, and contact access. Understand where this data is stored and who can access it.

Third-party Data sharing

Third-party Data sharing

Check whether data is shared with advertisers, analytics partners, or used for AI training.

Advertising practices

Advertising practices

Investigate what type of ads appear and what data powers them.

How companies can give the gift of privacy and trust

While families carry much of the work of safeguarding personal data, businesses share responsibility. Developers, retailers, manufacturers, marketers, and website owners all influence how transparent and secure consumer experiences can be.

Building trust starts with privacy by design and considering privacy, data protection, and user rights at every stage, from concept to post-purchase support.

A transparent approach doesn’t just reduce regulatory risk. It helps strengthen customer trust, which is the foundation of long-term relationships.

What companies can do

Disclose

Provide clear, accessible information within websites, apps, and consent management platforms.

Clarify

Communicate what data is collected, why, who can access it, and how individuals can exercise their rights.

Support

Offer guidance on how to adjust settings to limit data collection or processing.

Activate

Adopt Privacy-Led Marketing to support the responsible activation of high-quality, consented data while respecting the privacy of children and families.