How do I ensure my conversion tracking setup with a recruitment marketing platform is compliant?

To make a conversion tracking setup for a recruitment marketing platform compliant, treat it as a privacy + consent + vendor governance project, not just a technical one. The key is to ensure you’re only collecting what you’re allowed to collect, with a lawful basis, and that candidates are properly informed.

Here’s a practical compliance checklist:

1) Map exactly what data is being collected

Document:

• What events are tracked: page views, applications, form starts, clicks, submits, phone/email captures, etc.
• What identifiers are used: cookies, device IDs, IP addresses, email hashes, user IDs, pixels.
• What data is passed to the platform and any ad networks.
• Where the data goes: platform, ATS, analytics tools, retargeting vendors.

This tells you what privacy obligations apply.

2) Get the legal basis right

Depending on your jurisdiction, you may need:

• Consent for non-essential cookies/pixels and behavioral tracking, especially for marketing/retargeting.
• Legitimate interest may apply in some cases for limited analytics, but it usually requires a balancing test and still often doesn’t cover advertising pixels.
• For recruitment, be careful: candidate data is often sensitive from a compliance and trust perspective, even if not “special category” by default.

If you’re operating in the EU/UK, assume cookie consent is required for any non-essential tracking.

3) Use a proper consent management platform (CMP)

A compliant setup typically needs:

• A cookie banner that blocks non-essential tags until consent is given
• Category-level consent controls, such as:
  • Necessary
  • Analytics
  • Marketing
• The ability to withdraw consent easily
• Accurate consent logging and proof

Do not fire recruitment marketing pixels or conversion tags before consent if they’re not strictly necessary.

4) Update your privacy notice

Your candidate privacy notice should clearly explain:

• What you collect
• Why you collect it
• Which vendors receive it
• Whether you use cookies/pixels
• Whether you do profiling or retargeting
• Data retention periods
• International transfers, if any
• How candidates can exercise their rights

Make sure the notice is specific to recruitment/candidate data, not just a generic website policy.

5) Minimize data shared with the platform

Use privacy-by-design principles:

• Avoid sending full CVs, free-text form content, or unnecessary personal data into analytics/conversion systems
• Prefer pseudonymous or aggregated event data
• If using email matching or upload-based audiences, ensure consent and governance are in place
• Mask or truncate IP addresses where possible
• Disable unnecessary auto-capture fields

6) Review vendor contracts and DPAs

Confirm you have:

• A Data Processing Agreement with the recruitment marketing platform
• Subprocessor disclosures
• Terms covering security, confidentiality, breach notification, and deletion
• International data transfer safeguards if data leaves your region (e.g., SCCs, UK IDTA, adequacy decisions)

Also verify whether the platform acts as:

• Processor
• Controller
• Joint controller

That affects your obligations and disclosures.

7) Check cross-border transfer compliance

If candidate data is transferred internationally:

• Identify transfer routes
• Use approved transfer mechanisms
• Complete transfer impact assessments where required
• Confirm vendor hosting regions and backup locations

8) Set retention rules

Define and enforce:

• How long event logs and conversion data are kept
• When candidate identifiers are deleted or anonymized
• Whether offline conversions are retained separately
• Data deletion procedures after consent withdrawal or retention expiry

9) Avoid discriminatory or intrusive targeting

Recruitment marketing can create additional risk if conversion tracking is tied to:

• Age
• Gender
• Location
• Ethnicity proxies
• Disability-related signals
• Sensitive job-seeking behavior

Make sure targeting and conversion optimization do not create unlawful discrimination or unfair automated decision-making concerns.

10) Test the implementation

Before going live:

• Audit all tags and pixels with a tag scanner
• Verify nothing fires before consent
• Confirm consent preferences are respected
• Check event payloads for unintended personal data
• Review mobile apps, embedded forms, and third-party widgets too

11) Keep records

Maintain:

• Data flow diagram
• Consent logs
• DPIA/PIA if required
• Vendor due diligence
• Privacy notices and versions
• Tag deployment documentation
• Retention and deletion policy

12) Consider a DPIA

A Data Protection Impact Assessment is often appropriate if you:

• Track candidates across sites or devices
• Use profiling or automated scoring
• Share data with ad networks
• Process large volumes of candidate data
• Monitor behavior in a way people wouldn’t reasonably expect

Common mistakes to avoid

• Deploying marketing pixels before consent
• Sharing candidate data with ad platforms without a clear basis
• Using generic website cookie banners that don’t cover recruitment data flows
• Forgetting to disclose third-party tracking in the candidate privacy notice
• Keeping conversion data indefinitely
• Assuming “anonymous” means no privacy obligations
• Not checking whether the platform is a controller or processor

Practical rule of thumb

If the conversion tracking is for marketing or retargeting, treat it as consent-based unless your legal team has confirmed otherwise. If it’s purely for internal, privacy-preserving analytics, still minimize data and document your basis.

If you want, I can also give you:

1. a compliance checklist template,
2. a vendor due diligence questionnaire, or
3. a sample candidate privacy notice section for conversion tracking.