The Postcard Rule: Why Your Short Links Shouldn’t Carry Personal Data

There is a tempting idea that a short link is a little privacy cloak. You take a sprawling URL, squeeze it into something tidy, and assume the messy bits disappear. They do not. A short link changes what people see in the address bar, not what you chose to put in the original address. If the long URL contains an email address, a customer number or a free-text search term, the shortener is still handling that data. And so is every service in the redirect chain.

That matters in the UK because campaign links sit in the middle of two regimes: UK GDPR, which governs personal data, and PECR, which covers cookies and similar technologies. You do not need to become a lawyer to run a campaign. You do need a sensible operating habit. Think of a URL as a postcard: assume anyone who sees it, forwards it or logs it can read the front.

A short link is not a privacy cloak

Shortening is a convenience layer. It can make a poster readable, a QR code less dense and a radio ad sayable. It can also give you click counts and redirect control. What it cannot do is make personal data invisible. If the destination URL includes an identifier that relates to a person, the shortener may be processing personal data even if the slug itself looks like cuturl.co.uk/x7k2.

The useful question is not “can we shorten this?” It is “what are we asking this link to carry?” A campaign code, a channel name and a page variant are fine. A person’s email address in a query string is not. The difference is not technical decoration; it is the whole point.

The stuff that should never make it into a URL

Start with a banned list. It is easier for campaign teams to remember a short list of never-evers than a long lecture about lawful bases. These should not appear in a campaign URL:

• Names, email addresses, phone numbers or home postcodes.
• Customer, patient, pupil or member IDs that can be traced back to an individual.
• Order numbers, booking references or case references in a link that will be shared.
• NHS numbers, national insurance numbers or any other special-category identifier.
• Login tokens, password-reset codes, session IDs or signed URLs with long expiry dates.
• Free-text search terms that people might use to reveal something sensitive.
• Hidden form fields or tracking values copied from a CRM without checking what they contain.

There is a subtler issue too: the personalised short link. If every recipient gets a unique slug, that slug can become a personal identifier even if it contains no obvious data. That may be justified for a secure portal, but it is usually overkill for a newsletter. Use group-level links unless there is a clear operational reason not to.

Tracking that answers questions without collecting people

You can learn a lot from a link without turning every click into a dossier. For most UK campaigns, the workhorse parameters are still the familiar ones: utm_source, utm_medium, utm_campaign, utm_content and utm_term. Add an internal campaign ID if your reporting needs it. Add a creative variant if you are testing copy. Keep the values short, consistent and non-personal.

A consent-safe pattern looks like this: campaign name, channel, placement, asset type and a random campaign-level identifier. No email address, no hashed email, no CRM contact ID. A hash is not a magic anonymiser; if it can be linked back to a person, treat it as personal data. Ad click identifiers and similar values can also be identifiers, so do not wave them through just because they arrived from an ad platform. Check what your analytics and consent setup does with them.

Be careful with consent itself. Do not stuff a consent string into a URL and assume that solves anything. Consent needs to be recorded properly, with a clear timestamp and scope. The link should not be the place where you store the receipt. If you need to know whether someone accepted analytics cookies, read that from your consent management setup, not from a query parameter that will end up in screenshots and shared reports.

PECR also matters at the landing page. Non-essential analytics or marketing cookies need the right consent before they fire. A short link that arrives with a beautiful set of tracking parameters is not a permission slip. The destination page still has to behave.

Audit the redirect chain, not just the destination

Most link audits stop at “does it go to the right page?” That is the minimum, not the job. A redirect can pass through a shortener, a link-management platform, a marketing automation domain and a landing-page tag manager. Each hop may collect data, append parameters or hand information to another service.

A practical privacy audit should answer a few plain questions:

1. What is the full chain from short link to final page?
2. Which query parameters survive each hop, and which are stripped?
3. Does the destination page fire any third-party scripts before consent?
4. Does the shortener log IP addresses, user agents or referrers, and for how long?
5. Are there any open redirects or wildcard redirects that could be abused?
6. Who inside the organisation can see click-level reports, and do they need to?

Do this before a campaign goes live, not after a complaint. Export a sample of live links, click them in a private browser window and watch the address bar. Then check the landing page with your consent tool in its default state. If a marketing pixel fires before someone has made a choice, you have a problem that no amount of URL tidying will fix.

Also check the boring contractual bits. If your shortener is a processor, what does the data processing agreement say about retention and subprocessors? Where is the data stored? Can you delete click logs on request? These questions are easier to answer before procurement than after a busy Christmas campaign.

A one-page link policy people will actually use

The best policy is not a 40-page PDF that nobody opens. It is a one-page rulebook with examples, a named owner and a simple way to ask for an exception. Keep it close to the place where links are actually made.

A workable policy might include:

• An approved parameter list, with naming conventions.
• A banned-data list, with three real examples from your own campaigns.
• A rule that personalised links need a named owner and a retention period.
• A requirement to test the redirect chain before launch.
• A quarterly spot-check of live links, owned by one person.
• A short request form for exceptions, so people do not invent workarounds.

Make the right thing easy. Provide link templates. Put the approved parameters in a spreadsheet or a link-builder tool. If campaign teams have to remember six rules from memory at 5pm on a Friday, they will guess. If the tool gives them a dropdown and a warning, they will comply.

At CutURL, we like short links because they make UK campaigns cleaner to share and easier to measure. The postcard rule keeps that promise honest. Put only what you would be happy to see forwarded on a poster into the URL. Keep the personal data in the systems that are built to hold it. Then measure the campaign, not the person.

This is operational guidance, not legal advice. For a specific campaign or data set, check with your data protection lead or legal team.