One field decides
whether your marketing can be judged at all.

Almost certainly the one you already have. In practice the faults that make a CRM frustrating are configuration rather than capability — source overwritten at creation, fields dropped on record-type changes, nothing writing back from closed jobs, and fields nobody fills. A migration carries every one of those into a more expensive system and spends six months doing it. The question worth asking first is whether your current setup can pass a real submission from a tagged link through to a closed record, with conversions defined consistently at both ends. Related: CRO.

Usually because the two systems are counting different things, and nobody wrote down which. Analytics may count a form submission while the CRM counts a qualified lead after a salesperson touches it — both legitimate, neither wrong, and comparing them produces an argument rather than an answer. Google's conversion documentation covers the counting mechanics; agreeing the definition is a business decision that should be written down. The second common cause is campaign parameters being dropped at the form boundary. See landing pages.

Through call tracking that attributes the call to the page and campaign that produced it, then writes that attribution onto the record. Without it, calls arrive with no source and the channel that generated them looks inert — which is how a working campaign gets paused. This matters most in service businesses, where a large share of revenue starts as a call. Tracking numbers also need implementing without fragmenting your canonical number across listings, which is why it coordinates with directory management and Google's technical baseline for the site itself.

In the CRM, on the customer record, not in whichever sending platform happened to capture it. The record needs what the person agreed to, the wording they were shown, and a timestamp, retrievable for any individual quickly. Email opt-outs must be honored under the FTC's CAN-SPAM guidance, and text consent has to be producible if questioned. Keeping it in a platform means it is lost when you change platforms — which is when businesses discover they cannot prove any of it. See SMS marketing.

Suppression needs to apply globally, from whichever direction the request arrived. The FCC's guidance on unwanted calls and texts reflects that consumers may revoke consent by any reasonable method, so a plain-language text reply, an email, or a phone call to your office all count. That is a systems problem more than a policy one: the reply lands in a messaging platform, the call lands at a desk, and both have to reach the same suppression record. The federal rules at 47 CFR 64.1200 set the framework. Channel-level handling is covered under SMS marketing.

They depend on where you operate and what you hold, so this needs a lawyer rather than an agency. What is general: the FTC publishes data security guidance for businesses and enforces against deceptive privacy claims, and several states grant consumers rights over data held about them — California's are documented by the Attorney General and administered by the Privacy Protection Agency. The practical starting point is collecting less: every field you do not need is data you do not have to protect. Related: website maintenance, since access and backup posture sit alongside this.

Reduce what it costs them, rather than mandating compliance. When entering data takes more time than it returns, people build a shadow system — a notebook, a spreadsheet, their own memory — and no policy survives that arithmetic. The usual fix is removing fields nobody reads, replacing free-text with picklists where you need to count, and making sure something useful comes back to the person entering the data. A CRM nobody trusts is worse than a spreadsheet, because it still looks authoritative in a report. Google's people-first principle applies internally too — build for the person doing the work. Related: market research, since loss reasons are demand evidence.

Importing it and being permitted to contact it are separate questions, and the second one is the one that matters. A list arriving in your system of record carries no consent with it, which means it cannot lawfully be texted and creates exposure if emailed carelessly — the FTC's CAN-SPAM guidance also makes clear that responsibility cannot be contracted away to whoever sold you the list. It additionally puts personal data into your care that you are now obliged to protect. We decline this work. See email marketing.

Long enough to serve the customer and meet your own record-keeping requirements, and no longer by default — which is the opposite of what most systems do. Indefinite retention is a decision nobody makes deliberately; it happens because deleting feels risky. The FTC's privacy and security guidance treats holding data you do not need as a risk in itself, and state privacy laws such as California's give consumers deletion rights. Set a retention position with a lawyer, then configure the system to it. Related: reputation management.

Most often it restores the ability to judge marketing at all. Once source survives from click to closed job, campaigns that produce revenue become distinguishable from campaigns that produce activity, and budget decisions stop being guesses. The second common outcome is discovering that consent records do not exist in a retrievable form, which is a problem worth finding before someone asks rather than after. Third, the fields nobody uses come out, which returns time on every record your team touches. The wider measurement picture sits under conversion rate optimization and Google's conversion definitions.