Ask for the birthday month, or the month and day, never the year. Say on the form why you want it, keep it only in your email service, and send offers only to people who agreed to receive them.

A form that asks for more than it needs

A birthday club is a friendly idea. Sign up, and around your birthday a discount or a small treat arrives by email.

The sign-up form usually asks for a full date of birth: day, month and year. Often it asks for a home address and a phone number as well.

The birthday email uses the day and the month. The year, the address and the phone number sit in a list, year after year, doing nothing.

That list is a store of personal information the business never needed, and it has to be looked after all the same.

What sign-up forms collect and never use

The first matters most. A full date of birth beside a name and an email address is exactly what banks, phone companies and many other services use to confirm who someone is.

Why the year is the sensitive part

A birthday without a year is shared freely: people celebrate it at work and mention it to strangers. With the year, it becomes an identifier.

Combined with a name, an address and an email address, it helps someone impersonate a customer or answer the security questions on their accounts.

The year also reveals a customer's age, which many people would rather a business did not know, and which a birthday offer does not need.

A list without years is still worth protecting. It is simply far less useful to anyone who should not have it.

Only what the purpose needs

Canada's federal privacy law for businesses, PIPEDA, rests on plain principles: say why you collect personal information, collect only what that purpose needs, protect it, and keep it only as long as you need it.

Some provinces apply their own privacy laws to businesses instead, and which one governs yours depends on where it works and how the information travels. The principles are much the same.

A birthday offer is a perfectly good purpose. It just does not justify the year.

The month, or the month and day

An offer valid all month needs only the month. Send it on the first, and the customer can book or call in whenever suits them.

An offer for the day itself needs the day as well. Two drop-down lists, month and day, are enough, with no box for the year at all.

A month-long offer also avoids small problems: a birthday that falls on a day you are closed, or February 29 in a year that does not have one.

Make the field optional. A customer who would rather not say can still join the list.

Say why you are asking

One line beside the field does most of the work: we ask for your birthday month so we can send you a treat, and we never ask for the year.

It tells customers what the information is for, which privacy law expects, and it answers the question many of them are quietly asking.

Put the same line on any paper sign-up card, since many birthday clubs still start at the counter.

A worked example

A nail salon in a suburban shopping centre has run a birthday club since it opened: a discount on any manicure or nail art set during the client's birthday week.

Clients joined on paper cards at the front desk or through a form on the website. Both asked for full name, email, phone, home address and full date of birth.

Once a month someone typed the cards into a spreadsheet on the front desk computer, which was then emailed to the owner's phone so she could see who was due.

Over four years that spreadsheet had been copied into several inboxes. The year, the address and the phone number had never been used for anything.

The salon changed the card and the form to ask for name, email and birthday month only, with one line explaining why, and extended the offer to the whole birthday month.

Existing records lost their years, addresses and phone numbers. The list now lives only in the email service, the spreadsheet copies are deleted, and cards are shredded once entered.

Keep it in one place

Personal information spreads through copies: an export for a mailing, an attachment sent to a phone, a spreadsheet saved to the desktop for convenience.

Keep birthdays in one system, usually the email service the offer is sent from, and give everyone who needs access a separate login instead of sharing one.

When someone unsubscribes, their birthday has no purpose left. Delete it, while keeping their address on the list of people not to email.

The birthday email is a promotion

A birthday discount is a commercial electronic message under CASL, Canada's anti-spam law, however warm the wording.

So it needs consent, a clear statement of who is sending it with a way to reach you, and a working unsubscribe link. A sign-up form that says plainly what people will receive is the cleanest consent there is.

Customers whose only connection is an old purchase are a different matter. Implied consent from a purchase lasts two years, after which the birthday email needs a fresh yes.

This outline of PIPEDA and CASL is not legal advice; for your own list, ask a lawyer.

The counter-case

Some businesses do need to know about age. A brewery's mailing list may ask subscribers to confirm they are of legal drinking age, and a box to tick usually does that without collecting a birth date.

Clinics and pharmacies record dates of birth for health records, a different purpose with its own rules, and should keep that data apart from any marketing list.

A children's birthday club collects information about children, which deserves extra care and a parent's sign-up.

For an ordinary birthday offer, though: ask for the month, say why, keep it in one place, and send it only with consent.

Before the next sign-up

  1. Remove the year from every sign-up form.
  2. Ask for the month if the offer runs all month.
  3. Add one line explaining why you ask.
  4. Keep birthdays in your email service only.
  5. Delete old spreadsheets, exports and paper cards.
  6. Strip years and addresses from existing records.
  7. Check consent before each birthday send.

Step five is the one most businesses skip, because the copies are scattered and nobody remembers them all. A tidy new form achieves little while four years of full birth dates sit in old attachments.

Who can be sent a promotional email in the first place is covered in event invitations sent by email.

Frequently asked questions

Do I need the year of birth?

Not for a birthday offer. The month, or the month and day, is enough, and leaving out the year makes the list far less sensitive.

Why is a full date of birth sensitive?

Beside a name and email address, it is what many services use to confirm identity. It also reveals age, which a birthday offer does not need.

What does privacy law expect here?

Explain why you collect personal information, collect only what that purpose needs, protect it, and keep it only as long as you need it. A birthday offer does not justify the year.

Should the birthday field be required?

No. Make it optional, with a line explaining what it is for, so customers who would rather not say can still join the list.

Is a birthday email covered by CASL?

Yes. A birthday discount is a commercial electronic message, so it needs consent, identification of your business with contact details, and a working way to unsubscribe.

What should I do with old records?

Remove the years, addresses and phone numbers you never use, keep the rest in one system, and delete old spreadsheets, exports and paper cards.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Birthday club asking for the year?

Send us your sign-up form. We will trim it to what the offer needs and word the line that explains why.

Start a Conversation