The 2026 Privacy Reality
Data minimization has been a legal requirement under GDPR since 2018 (collect only what you need for the stated purpose) and CCPA since 2020. But most DTC brands have treated this as a checkbox, they ask for birthday, zip code, phone number, and 5 product preferences at signup, in the hope of using it later. Most of that data sits unused in Klaviyo profiles forever.
The privacy-first alternative is counterintuitive: collect less, personalize dynamically, and let subscribers opt in to sharing more when they choose to. Brands running this playbook have better signup conversion, cleaner data, and stronger trust signals, all at once.
The Signup Friction Math
Data points asked vs signup conversion rate (from a study of 500 DTC signup forms):
- Email only: 8-15% conversion of engaged visitors
- Email + first name: 7-12%
- Email + first name + phone: 4-8%
- Email + name + phone + birthday + zip: 2-4%
Every additional field cuts conversion. The brands asking 5 fields are leaving list growth on the table.
The Minimum Viable Signup
Just email. Nothing else. Here's why:
- Email alone is enough to run welcome flows, abandoned cart, campaigns, lifecycle
- Everything else can be collected progressively (quizzes, preference center updates, post-purchase surveys)
- Subscribers who feel rushed at signup are lower-quality subscribers overall
Progressive Data Collection
Rather than asking everything at signup, ask over time:
Welcome email 3
"What's your primary goal with us?", one-click poll. Result goes to profile property.
Post-purchase (after first order)
"What name should we address you by?", captures first name organically.
Post-purchase (14 days later)
"Want birthday treats?", opt-in birthday collection with clear purpose.
Preference center (always available)"Tell us your preferences", long-form data collection for subscribers who want more personalization.Result: By month 3, you have the same (or better) data on each subscriber, acquired with less friction and more explicit consent.What to Stop Asking ForBirthday at signup. Low conversion cost, high legal burden. Collect post-purchase if you actually use it.Phone number unless you're actively running SMS. Collecting but not using is liability.Zip code for "store locator" purposes. Only ask if you actively personalize by region.Open-ended fields like "how did you hear about us." Data not used for automation. Run quarterly survey instead.The Compliance WinUnder GDPR, you need a legal basis for every data point you collect. "Just in case we want to use it later" is not a valid basis. Brands collecting less:Have easier data-subject access request (DSAR) compliance (less data to export or delete)Face lower risk from data breaches (less sensitive data to leak)Can more easily pass privacy audits and certifications (SOC 2, ISO 27001)The Trust Win2026 consumers are more privacy-aware than ever. Brands that visibly ask for less win trust:"Just your email, we'll get to know you over time" signals respectClear data usage explanations on signup forms build confidencePreference centers that let subscribers control everything reduce churnData minimization is itself a brand-signaling tool.The Revenue Counter-IntuitionCommon belief: "More data = better targeting = more revenue."Reality: "Better-consented data = more trust = more engagement = more revenue."Brands that migrate to minimum-viable-data collection see:List growth rate up 15-40% (lower signup friction)Engagement rates up (subscribers feel respected)Churn down (no "creepy email" moments)Trust / NPS-type scores measurably higherThe Implementation StepsAudit your current signup form. Remove every field except email.Build a quiz or preference-center flow that collects data progressively.Document every data point you collect and its stated purpose.Delete unused fields from profiles (e.g., if "favorite color" has never been used in segmentation, remove it).Publish a clear privacy policy explaining what you collect and why.What Not to DoClaiming "we'll never share your email" if you use any tool that technically shares it (most ESPs do, be truthful)Hiding the unsubscribe link, always prominent, always one-clickAssuming implicit consent (purchase doesn't equal marketing email opt-in, legally)Ignoring deletion requests or taking weeks to process themFrequently Asked QuestionsIf I only collect email, how do I personalize?Personalize from behavior (clicks, views, purchases) and from progressive data collection over time. First-name personalization is nice but not critical.Does this apply to B2B email?Yes, equally. B2B has similar privacy requirements (especially GDPR for EU-based contacts).How do I handle legacy data collected under the old model?Audit it. Delete anything you no longer use or can't justify retaining. Keep only what has active purpose.Will this hurt my segmentation ability?Initially yes, slightly. Over 3-6 months, progressive collection fills the gap with better-consented data. Net neutral to positive long term.What's the fastest minimum-viable-data win?Remove phone number and birthday from signup forms. Do it today. Signup conversion will climb within a week.
