An organization has developed a tracking system to better understand customer purchasing behavior. Prior to deployment it is discovered that the consumer privacy policy does not properly convey that c

Verbal scripts from customer service representatives are not a substitute for a legally compliant written privacy notice and do not reach all affected customers before data collection begins.

A notice in the purchase confirmation is provided after the transaction, meaning customers were not informed before their data was collected and the prior notice requirement is not met.

Transparency and notice are core privacy principles requiring that data subjects be informed of data practices before collection begins. Deploying the system without an accurate privacy policy would constitute a violation of consent and transparency obligations under regulations such as GDPR. Delaying deployment ensures the organization acts lawfully and does not expose itself to regulatory penalties for collecting data without proper notice.

Collecting personal data - even without analyzing it - without a proper legal basis and notice still violates privacy regulations, as the act of collection itself requires lawful grounds and transparency.