You will be able to set up tracking that respects consent and Singapore's data protection rules.
Mei Ling has a list of about 300 past customers in her phone, built up over three years of WhatsApp orders. A friend tells her she can upload those numbers to Meta and show ads only to people who have ordered before, or use them to find similar people. It sounds like free targeting. Before she does it, there is a question worth asking: when those customers gave her their numbers to arrange a cake delivery, did they agree to this?
Tracking and audience matching run on personal data. That brings legal duties in Singapore and contract duties with each ad platform. This lesson covers what to check so your tracking is set up in a way you can defend. It is a practical guide, not legal advice, and the official guidance is where to confirm anything you are unsure about.
It is easy to think of a pixel as anonymous code. It is not. Pixels and tags can record which pages someone visited, what they bought, identifiers stored in cookies, and sometimes details typed into forms. Server-side events, from lesson 3.2, Server-side events and first-party matching, often include hashed email addresses or phone numbers. Hashing scrambles the details, but the purpose is still to match them to a real person.
So your website's privacy policy should say plainly what you collect and why. That includes the use of advertising pixels and tags, the platforms you share data with, and whether you upload customer details for advertising. A visitor should be able to read it and understand that their visit may be used to show them ads later.
Many small business privacy policies were copied from a template years ago and say nothing about advertising. If yours is one of them, it needs updating before you rely on tracking.
Singapore's Personal Data Protection Act, the PDPA, governs how organisations collect, use and disclose personal data. It applies to small businesses as well as large ones. The Personal Data Protection Commission, the PDPC, enforces it and publishes advisory guidelines that explain how the Act applies in practice.
At a high level, the Act expects you to tell people the purposes for which you collect their data, to get their consent for those purposes unless an exception applies, and to use the data only for purposes a reasonable person would consider appropriate. It also expects you to protect the data and to let people withdraw consent.
Advertising is a purpose like any other. If you collect data partly so you can advertise to people, that purpose should be clear when you collect it. The PDPC's guidelines go into detail on consent, notification and online activities, and are the place to check how the rules apply to your setup. If you handle a lot of personal data or sensitive categories, get proper advice.
Back to Mei Ling's phone list. When you upload a customer list to Meta, Google or TikTok to build an audience, you are disclosing personal data to the platform for advertising. Each platform's terms for these features require you to have the right to share the data that way. The PDPA requires that the people on the list were told about and agreed to that kind of use, or that another basis under the Act applies.
Customers who gave their numbers only to arrange a delivery were probably not told their details would be used for advertising. The safer course for Mei Ling is to update how she collects details from now on, with a short notice explaining that she may use contact details to show relevant ads on social platforms and how to opt out. Over time she builds a list she can use properly. For her existing customers, she should check the PDPC guidance before uploading anything.
Lesson 4.3, Custom audiences, lookalikes and retargeting, explains what these lists can do once you have them on the right footing.
Many websites show a cookie or consent banner that lets visitors accept or decline tracking. What happens after they choose depends on how your tags are set up.
Google's Consent Mode is one example. It lets your Google tags read the visitor's choice and adjust what they do. When a visitor declines advertising cookies, the tags behave differently from when they accept, and Google describes how it uses modelling to estimate some of the conversions it cannot observe directly. Other consent tools and platforms offer similar settings. The current behaviour and options are described in each platform's help pages.
The practical point for a small business is consistency. If your banner says a visitor can decline advertising tracking, your tags must actually respect that choice. A banner that looks good but changes nothing is worse than no banner, because it makes a promise you are not keeping.
Whether you need a banner at all, and what it should offer, depends on your site and your visitors. Many Singapore businesses also have overseas visitors, and other countries have their own rules. Check the PDPC guidance and, for sites serving other markets, those markets' rules too.
Start with the document you already have. In the activity below you will read your own website's privacy policy and note whether it covers advertising pixels and customer data uploads.
Read your own website's privacy policy and note whether it mentions advertising pixels and customer data uploads.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).