Call tracking in the age of GDPR: Opportunities and challenges

Even in the digital world, phone calls remain a key channel of contact between companies and customers. With call tracking, marketing and sales managers can track exactly which campaigns, keywords, or channels led to a call—and thus significantly increase the efficiency of their measures.

However, since the General Data Protection Regulation (GDPR) came into force, the situation has changed: companies are faced with the task of leveraging the advantages of call tracking while at the same time meeting the highest standards of data protection and data security.

Summary

• What is call tracking? Definition and how it works
• The GDPR and its impact on call tracking
• Is call tracking GDPR-compliant?
• Does the GDPR apply to phone calls?
• What data is not covered by the GDPR?
• Is tracking prohibited?
• Are phone calls permitted?
• Data protection when transmitting data by telephone
• Conclusion: Utilize data protection as a competitive advantage

What is call tracking? Definition and how it works

Call tracking refers to the systematic recording and analysis of incoming phone calls generated through various marketing channels. The aim is to identify which campaigns, ads, or touchpoints actually trigger calls and thus generate valuable leads.

The way it works is simple:
Each marketing channel—whether Google Ads, social media, newsletters, or a specific landing page—is assigned its own phone number. When a prospective customer calls this number, the call is automatically assigned to the corresponding channel.

This enables companies to identify precisely which measures contribute most to their business success.

Technologies behind call tracking

The effectiveness of call tracking is based primarily on two key technologies: dynamic number assignment and automated call data capture. Both functions ensure that phone calls are clearly tracked and enriched with valuable information.

1. Dynamic number insertion (DNI)

• Visitors to a website automatically see an individual phone number—depending on the respective marketing channel, search term, or even their location.
• This allows each incoming call to be clearly assigned to a specific source, such as a Google Ads ad, a social media campaign, or an organic search result.
• This enables companies to identify exactly which channels are actually generating calls—and thus valuable leads.

2. Automated call data collection

• In addition to pure caller identification, additional data such as duration, time, origin, or call history is recorded in real time.
• This gives marketing and sales teams detailed insights into the quality and value of a lead.
• This information makes it possible to optimize campaigns in a targeted manner, use budgets more efficiently, and precisely track the entire customer journey.

3. Static call tracking (permanently assigned tracking numbers)

• DNI is not always useful or possible – for example, with offline channels or permanent touchpoints. This is where static call tracking comes into play: a fixed tracking number is permanently assigned to a channel, medium, or location.

Typical use cases

Advantages

• Easy setup and clear 1:1 attribution over longer periods of time
• Channel/location performance measurable even without web visits
• Ideal as a supplement to DNI in hybrid setups (online dynamic, offline static)

Please note

• Lower granularity than DNI (no keyword level)
• Useful if channels run continuously or are to be evaluated less granularly

4. Whispersound (Call Whisper)

A whisper sound is a very short announcement that only the receiving team hears before the caller is connected. It provides context for the call—e.g., “Google Ads | Test Drive Campaign | Cologne Location”—and helps improve conversation management and routing.

With this technological basis, call tracking becomes a powerful tool that turns pure calls into valuable data points – thus bridging the gap between marketing investments and real business results.

This makes call tracking a data-driven analysis tool that goes far beyond mere telephone statistics. Modern solutions even enable integration with CRM systems, Google Analytics, or Google Ads, so that call data can be used for smart bidding and lead nurturing processes.

Benefits for marketing and sales

The use of call tracking offers significant advantages for marketing and sales:

• Precise measurement of campaign effectiveness
• – Clearly identify which channels really generate calls and leads.
• Optimization of conversion rates
• – Target budgets at the most effective measures.
• Better customer service
• – Insights such as call duration, frequency, and topics help to improve service processes.
• Increased ROI
• – Call tracking provides the basis for efficient use of marketing budgets and demonstrably increases return on investment.

The GDPR and its impact on call tracking

The GDPR has significantly tightened the legal framework for handling personal data. Since such data is regularly processed during telephone calls (e.g., phone numbers, call content, timestamps), this directly affects call tracking.

Key requirements

Risks without a clear data protection strategy

Companies that use call tracking without GDPR compliance risk:

Is call tracking GDPR-compliant?

Yes – if certain conditions are met.

1. Create transparency: Clearly state in the privacy policy what data is collected and what it is used for.
2. Obtain consent: Documented consent should be obtained before collecting call data (e.g., notice in the cookie banner or IVR announcement).
3. Implement security measures: Modern encryption technologies and strict access rights are mandatory.
4. Apply data minimization: Only store as much data as is necessary for the purpose.
5. Rely on proven providers: Choose call tracking solutions that guarantee GDPR compliance (e.g., hosting in the EU).

Does the GDPR apply to phone calls?

The General Data Protection Regulation (GDPR) applies whenever personal data is processed—and that includes telephone calls. While it is immediately clear that information is being stored and processed in the case of digital data such as forms, cookies, or tracking pixels, this aspect is often underestimated when it comes to telephone calls.

Digital vs. telephone data

• Digital data: Online forms, emails, and web tracking allow individuals to be clearly identified by information such as their name, email address, or IP address. This data clearly falls under the GDPR.
• Telephone data: Call information such as telephone number, call content, time, and duration are also personal data as soon as they can be assigned to a specific user. Call content in particular often contains sensitive information—and is therefore highly sensitive.

This makes it clear that telephone calls are just as relevant to the GDPR as digital touchpoints. Companies must therefore also fulfill transparent information obligations for this channel, establish secure processing procedures, and guarantee the rights of data subjects (e.g., access or erasure).

What data is not covered by the GDPR?

Not all information generated in the context of lead management or telephone calls is automatically relevant to the GDPR. The decisive factor is whether there is a direct or indirect link to an identifiable person. If there is no such link, the data is not covered by the General Data Protection Regulation.

Examples of data not relevant to the GDPR

• Anonymized and aggregated data: Once data has been processed in such a way that it is impossible to identify individual persons, it is no longer considered personal data. This includes, for example, statistical evaluations of general call volume or campaign performance without individual identifiability.
• Metadata without personal reference: Information such as pure call times or the duration of a call can also fall outside the scope of the GDPR, provided that it is not linked to specific telephone numbers or names.

Important: Pseudonymized data (e.g., encrypted telephone numbers) is still considered personal data, as re-identification is possible. Companies must therefore carefully check which data categories they collect and how they are processed.

Is tracking prohibited?

There is often uncertainty as to whether tracking is still permissible in the context of lead management and customer journeys. The answer is no, tracking is not prohibited in principle—but it is subject to clear legal requirements.

When is tracking permitted?

• With explicit consent: Users must actively agree (opt-in) before personal data is collected for marketing or analysis purposes. This consent must be voluntary, informed, and revocable at any time.
• For functionally necessary tracking: Certain forms of data collection are permitted if they are absolutely necessary for the provision of a service—for example, session cookies for the login area of a website or technical data for the telephone connection.

Transparency and revocation

Companies are obliged to inform their users clearly and comprehensively about what data is collected and for what purpose. Equally important: any consent must be easily revocable at any time—for example, via an opt-out or cookie banner.

This means that tracking is a permissible tool in lead management as long as it is implemented transparently, for a specific purpose, and in compliance with the GDPR.

Are phone calls permitted?

Even in the digital age, phone calls remain a central component of customer communication. They are generally permitted, but only under certain legal conditions:

• Marketing calls: Advertising calls may only be made with the express consent of the person concerned. Without prior opt-in, they are considered inadmissible.
• Customer service calls: Service numbers or callbacks to process existing inquiries are generally permitted as long as they are not linked to additional advertising messages.

This means that phone calls are an important touchpoint in lead management, but require a clear separation between service and advertising.

Data protection when transmitting data by telephone

Even if a conversation takes place verbally, sensitive data is generated in the background – from telephone numbers and conversation notes to possible recordings. Technical and organizational measures are necessary to process this data in compliance with the GDPR:

• Encryption: Conversation data and connection information should always be encrypted during transmission and storage.
• Access controls: Only authorized employees may access call data. Role and authorization concepts are indispensable here.
• Training: Employees must be regularly sensitized to the secure and data protection-compliant handling of telephone calls.

This ensures that telephone calls remain not only an effective but also a legally compliant part of the omnichannel strategy in lead management.

Conclusion: Utilize data protection as a competitive advantage

Call tracking remains an indispensable tool for marketing and sales, even in the age of GDPR. It is crucial not to view data protection as an obstacle, but rather as a sign of quality and trust.

Companies that use call tracking transparently, securely, and in compliance with the law benefit twice over:

• They gain valuable data for optimizing their campaigns.

They strengthen the trust of customers and partners—and thus gain a clear competitive advantage.