Data Ethics, Privacy, and Honest Numbers

Consent, patron privacy, email and text rules, not tracking guests creepily, and not fudging the numbers.

A honky tonk runs on trust. Guests trust you with their evenings, their families, and sometimes their worst nights. The moment you start counting them, you take on a second kind of trust: what you know about them, and what you do with it. Measurement is useful because it lets you see patterns, but it can easily slide into watching people in ways they wouldn’t welcome. This chapter draws the line, in plain terms, between measuring a room and tracking its guests. The line matters for more than manners. Guests who feel watched stop coming, and rules on privacy, email, and texting increasingly treat careless data handling as a legal problem, not just a bad look.

There are two halves to the subject. The first is how you treat other people’s information: what you collect, why, how you ask permission, how long you keep it, and what you do when someone says stop. The second is how you treat your own numbers: reporting them honestly to staff, partners, sponsors, lenders, and yourself. Both come down to the same question, which is whether you’d be comfortable if the guest, or the person receiving the report, could see exactly what you did and why. Both halves come up in every other chapter of Part Three. This chapter puts them in one place.

A caution before we start. Laws on privacy, email, text messages, recordings, and advertising change often, and they differ by state and by what you do. This chapter explains principles and points to rules as they stood in the sources we checked, but it is not legal advice, and it can’t be the last word. The Heads Up at the end and Appendix J say who to ask. What you can do is build habits that keep you well inside the rules: collect little, ask clearly, keep it safe, honor requests quickly, and report truthfully. None of this has to be complicated. Most small rooms can be well inside the rules with a one-page routine and a few habits.

PR TACTIC: The Smallest Ask

What it is: Before you collect any piece of guest information, write down what it is for. If you have no use for it this year, don’t ask for it.

Why it works: Data you don’t collect can’t leak, be misused, or trigger a rule, and the guests who notice you asked for less will trust you with more.

Try this: Look at your sign-up form and cut every field you can’t connect to a decision you actually make.

35.1 Measuring a Room Is Not Tracking a Guest

Most of what this book asks you to measure is about the room: how many first-timers, how many returned, which night, which source. You can do nearly all of it with counts and cards, without keeping files on individuals. Where you do use names or contact details, as with a cohort sheet or a mailing list, keep them to the minimum needed and keep them apart from the numbers you share. A useful test: could you do this measurement with names removed? If so, remove them. A tally of “21 of 42 returned” needs no names in the report, and the fewer places names appear, the fewer places they can leak. A useful habit is to separate the tally from the list. The door tally, the cohort counts, and the how’d-you-hear shares are about the room and can be shared with staff and partners. The list of names and contact details is about people and should be seen only by the few who need it, for the purpose the guests agreed to.

There is also a feeling test, apart from the legal one. Imagine a regular reading exactly what you’ve recorded about them. Would they find it warm, as in “likes the Thursday lesson and always orders a cold lager,” or would they find it unsettling, as in “arrived at 8:12 with a woman we haven’t identified”? Staff remembering a guest’s drink is hospitality. A system logging who they came with, when they leave, and where they go is surveillance. A dancehall is a place where people come to be themselves, and where some come to be away from other parts of their lives. Respect that. If a piece of information would make a guest uneasy to see, don’t collect it. Staff memory is a good thing, and it shouldn’t be written into a system that strangers could read. If you keep notes on regulars for hospitality, such as a favorite drink or a song request, keep them short, kind, and private, and delete them when a guest stops coming or asks you to.

Be especially careful with anything that identifies a person in a sensitive situation: someone who was asked to leave, someone who had a bad night, someone who confided in a bartender. Notes about incidents belong in a private incident log kept for safety, with limited access, not in a marketing list. Do not use such notes to target promotions, and do not post about them. And be careful with photographs and video: Chapter 19 covered consent and rights, and the same care applies to counting. A face in a clip is data about a person, and the person has a say. Incident logs also deserve accurate wording. Write what happened, what was done, and who was involved, in plain factual terms. Avoid guesses about people’s motives or health, which can be wrong and can cause harm if the log is ever seen. Train staff on the difference between remembering a guest and recording one. The first is hospitality. The second needs a reason, permission, and care.

35.2 Consent, Email, and Text

For email, the federal CAN-SPAM law sets out requirements for commercial messages, summarized by the Federal Trade Commission in its compliance guide for businesses. They include honest header and subject lines, a clear identification of the message as an ad, your physical postal address, and a working way to opt out that you must honor promptly. The FTC guide describes penalties of tens of thousands of dollars per violating email, so the cost of carelessness is real. Treat the guide as your starting point, read the current version before you send, and make unsubscribe easy and instant in practice, whatever the minimum is on paper. The guide also says the law covers all commercial email, including messages to existing customers, and that a business is responsible for email sent on its behalf by someone else, such as a promoter or a platform. If you hire help with your email, the duty to follow the rules stays with you.

Text messages are stricter, and Texas has added its own rules. Federal rules on automated texts require consent, and revoking consent must be possible by any reasonable means, according to a law-firm summary of recent changes. A Texas law that took effect September 1, 2025, as summarized by a law firm, treats certain marketing texts as telephone solicitation under the state’s Business and Commerce Code, with a registration requirement and civil penalties for violations, and an exception for current or former customers. These rules are technical and have exceptions, and they may have changed since this book was written. Get express, written permission before texting anyone for marketing, keep a record of when and how it was given, and ask a Texas attorney before you start a text program. The same summary of the federal consent changes lists common words people use to stop, such as stop, quit, cancel, unsubscribe, and end, and says requests must be honored within a reasonable time capped at ten business days. Treat any of those words, and any other clear request, as a stop.

Whatever the channel, the practical habits are the same. Ask for permission in plain words, at the moment of sign-up, and say what you will send and how often. Record when and how each person agreed. Never add people to a list because they gave you a card, bought a ticket, or appeared in a photo. Honor “stop” right away, and keep a do-not-contact list so that a removed person is never added back by accident when you merge lists. If you use a platform for email or text, check how it handles consent and removal, and don’t assume that using one makes you compliant. The duty stays with you. It also helps to keep email and texting separate in your records. Someone who agreed to email hasn’t agreed to texts, and someone who agreed to a monthly calendar hasn’t agreed to daily offers.

QUESTIONS PEOPLE ASK

“Can I text people who bought tickets?” Buying a ticket isn’t the same as agreeing to marketing texts. Ask a Texas attorney before texting anyone who hasn’t given clear permission.

“Do these rules really apply to a small room?” Some apply to everyone, such as the email rules. Others have exemptions for small businesses. Find out which apply to you, and follow the good habits either way.

35.3 Texas Privacy Law, Plainly

Texas has a comprehensive privacy law, the Texas Data Privacy and Security Act, which took effect July 1, 2024, according to the Texas Attorney General’s page on it. It gives Texans rights over their personal data and places duties on businesses that collect it. The Attorney General’s page explains that small businesses, as defined by the federal Small Business Administration, are generally exempt from much of the law but still must get consent before selling sensitive personal data. It also lists civil penalties of up to $7,500 per violation, with a thirty-day period to cure after notice, and says there is no private right of action. Whether a particular business counts as small, and what counts as sensitive, depends on facts you should check. Even if you are exempt from most of the statute, the parts about sensitive data deserve attention. Privacy laws generally treat things like health information, precise location, and information about children as especially sensitive, so check the definition that applies to you. A honky tonk rarely needs any of it, and the simplest compliance is not to collect it.

You don’t have to master the statute to act sensibly. If you are small, you are probably exempt from many of its duties, but the habits it describes are good practice for anyone: collect only what you need, tell people what you do with it, keep it secure, let people see and delete what you hold on them if they ask, and never sell or share it without clear permission. If a sponsor or partner asks for your list, the answer is no unless the guests agreed to that sharing. Selling a guest’s details to a third party is the quickest way to break both the law and the trust that is the whole business. If someone asks what you hold about them, answer plainly and quickly. A short reply listing what you have, such as their email address, the date they signed up, and which messages they get, and offering to delete it, is good practice whether or not the law requires it.

Security matters as well. A list on a phone that’s lost, a spreadsheet emailed to the wrong person, or a shared login that former staff still know can all expose guests. Keep lists in one place, protect them with a password and, where possible, two-step sign-in, limit who can see them, and remove access when someone leaves. Keep only what you need and delete what you don’t, including old lists and old photos of door sign-in sheets. Check what the platforms and tools you use do with your data. You are responsible for what you gather, even when someone else’s software stores it. If a lost phone or a mistaken email exposes guest information, write down what happened right away, and ask an attorney whether you have a duty to tell anyone. Laws on data breaches can apply even to small businesses.

35.4 Honest Numbers

The second half of this chapter turns the lens on you. It is tempting, when numbers matter, to shade them: to count a flagged night as normal because it makes the average look better, to report revenue instead of margin, to cite followers instead of guests, to pick the one good month. Resist. The numbers exist so that you can make better choices, and a distorted number makes a worse one. Report the count with the rate, the baseline with the result, and the caveat with the claim. Say “small count” when it is. Say “unproven” when it is. If the quarter was bad, say so, and say what you’ll try. Honesty also applies to what you leave out. A report that shows only the good numbers is misleading even if every number in it is true. Show the funnel, not just the top of it. Show the nights that didn’t work, not just the ones that did. Readers trust a report that includes bad news far more than one that doesn’t.

Be especially honest with people outside the room. A sponsor who relies on your attendance figure, a lender who reads your scorecard, a buyer who values your list, and a grant committee who reads your impact numbers are all making decisions on what you tell them. Overstating can mislead them and expose you to serious legal and financial trouble. Use the same definitions for outsiders as for yourself, state your assumptions, and show how a figure was counted. If a figure is an estimate, call it one. The same goes for reviews and testimonials: the FTC has rules against fake reviews, as described by law firms summarizing the rule, so never write or buy them, and don’t invent quotes. If you discover that a figure you shared was wrong, correct it promptly with the people who received it. A correction made early is a sign of integrity. One discovered later by someone else looks like concealment.

Honesty also protects your own judgment. People tend to find what they expect, and in a small business the one who pays for the marketing is often the one who counts its results. Guard against that by deciding in advance what counts, as the Prediction Line in Chapter 31 does, by letting someone else check a figure now and then, and by writing “unproven” beside things you hope are true. Chapter 21 warned that a number becomes useless once it becomes a target. Honest reporting is the only reliable defense. A room that tells itself the truth about a bad month has already started to fix it. Finally, be honest with yourself about what you don’t know. “We don’t know how many first-timers came from the radio spot” is a better line in a report than a guess dressed up as a number.

AN HONEST-NUMBERS CHECKLIST FOR ANY REPORT

☐ Every rate has its count beside it. ☐ Every result has its baseline and swing. ☐ Small counts are labeled. ☐ Flagged nights are named. ☐ Estimates are called estimates. ☐ Definitions match the ones we use internally. ☐ Bad news is included. ☐ Nothing is described as more than it was (a listing isn’t a feature, a scan isn’t a guest). ☐ Anything paid for is disclosed. ☐ Someone other than the author checked the figures.

35.5 A Data-Handling Routine

Turn the principles into a routine you can follow in an hour a quarter. List every place guest information lives: the email platform, the text tool, the cohort sheet, the door sign-in sheet, the phones of staff, photos, and any notes. For each, write what it holds, why, who can see it, how consent was obtained, and when it will be deleted. You will probably find things you forgot about. Delete what you don’t need. Fix what you can fix right away, such as a shared password. Put a date on the rest. The audit often turns up small, fixable risks: a sign-up sheet left on the bar with names and phone numbers visible, a former employee who still has a password, a photo folder with images of guests who asked not to be posted. Each takes minutes to fix once found.

Next, write a short, plain-language privacy note for guests, a few sentences on the sign-up sheet and your website: what you collect, what you do with it, who you share it with, how to opt out, and who to contact. Don’t copy legal text you don’t understand. Have an attorney review the note once, and update it when what you do changes. Train staff in five minutes: don’t add anyone to a list without their say-so, don’t photograph guests without asking, don’t share a guest’s details, honor a stop request the same day, and report any mistake right away. Keep the privacy note honest and short. If you only collect email addresses for a monthly calendar, say exactly that. Promising more protection than you provide, or describing practices you don’t follow, can cause its own legal trouble.

Finally, plan for the day something goes wrong. A lost phone, a mistaken email to the whole list, or a guest who complains. Decide in advance who handles it, what you’ll say, and whom you’ll call. A prompt, honest response, an apology without excuses, and a fix usually keep trust. Hiding it rarely does. Write the plan on one page and keep it with the incident log. Rooms that treat guest information with this care earn something that no tactic in Vol 1 through Vol 6 can buy, which is guests who give you their number because they’re glad you asked. Run a short drill once a year: pretend a phone with the list on it was lost, and walk through who you’d call and what you’d do. Ten minutes of practice makes a real mistake far less frightening. Put the next audit date in the calendar before you finish this one.

CASE STUDY

Twelve Hundred Contacts

Perla inherits a dancehall’s contact file: 1,200 names with emails and phone numbers collected from sign-up sheets, ticket buyers, and a past band’s list. She audits it.

Step 1 — Consent. She can find no record of how 300 of the contacts joined, and they came from the old band’s list and a ticket buyer export. 300 ÷ 1,200 = 25%. She removes them from marketing and keeps only what she needs for ticket records.

Step 2 — What’s left. 1,200 − 300 = 900 contacts with a known sign-up.

Step 3 — Inactive. 180 of the 900 haven’t opened, clicked, replied, or visited in twelve months. 180 ÷ 900 = 20%. She sends a one-time “still want to hear from us?” message and removes those who don’t answer in thirty days, leaving at most 900 − 180 = 720 clearly active contacts. She does not rely on open rates, which privacy features distort.

Step 4 — Result. The list is smaller by 480, a 40% cut (480 ÷ 1,200), but every remaining person asked to be there. She expects the active share, clicks plus replies plus visits over contacts, to rise. She records the change in the quarterly review and reports the smaller list honestly to a sponsor who had been told “over a thousand.” All figures are illustrative.

REAL TALK

From behind the bar:

A regular asked me once how I knew her husband had left. I didn’t. I’d just remembered she used to come in with him and now she doesn’t. That was a good reminder to be careful what I write down about people.

HEADS UP

This chapter touches privacy, consumer-protection, advertising, and telecommunications law, all of which are technical and change often. The sources used here describe the Texas Data Privacy and Security Act (effective July 1, 2024), the federal CAN-SPAM Act for email, federal rules on automated texts and consent revocation, a Texas law on marketing texts that took effect September 1, 2025, and the FTC’s rule on fake reviews. We did not confirm every effective date, exemption, or later change, and some rules may have been updated. Whether the rules apply to you depends on your size and what you do. This is general information, not legal advice. Before building a list, a text program, a privacy note, or sharing guest data, ask a licensed Texas attorney, and see Appendix J.

THE DATA-HANDLING CHECKLIST

• I have listed every place guest information is kept: email platform, text tool, cohort sheet, sign-in sheets, phones, photos, notes.
• For each, I know what it holds, why, who can see it, how consent was obtained, and when it will be deleted.
• Every email and text contact has a record of when and how they agreed.
• Every message has an easy opt-out, and a stop request is honored right away.
• I keep a do-not-contact list so removed people are not added back.
• Lists are protected with a password, limited access, and two-step sign-in where possible.
• Access is removed the day someone leaves the team.
• I collect only what I use. I deleted every form field and old file I can’t tie to a decision.
• I never share, sell, or lend a list without clear permission from the guests on it.
• Photos and video of guests follow the consent practices in Chapter 19.
• Incident notes are kept separately, with limited access, and never used for marketing.
• A short privacy note is posted where guests sign up, and an attorney has reviewed it.
• Staff have been trained in five minutes on the rules above.
• Figures I share with sponsors, lenders, or buyers use the same definitions as my own, with caveats stated.
• There is a one-page plan for what we do if something goes wrong.

MEASURE IT

The number: Consent coverage: the share of your marketing contacts with a record of when and how they agreed.

By hand: Count the contacts on your list and the number with a dated record of sign-up. Divide the second by the first. Example: 900 ÷ 1,200 = 75% before cleanup, and 100% after you remove the rest. Also track the number of stop requests honored the same day over the number received.

Watch out: Don’t trust open rates, which privacy features distort. Count the people, not the names, and remove names from anything you share. Tell outsiders the same thing you tell yourself, with the caveats attached.

Go deeper: Chapter 19 (trust, consent, rights, compliance), Chapter 26 (list health), and Appendix J (consolidated disclaimers).

ROLE BOX

• Owner: Audit where guest data lives, set the privacy note and the stop rules, and report numbers to outsiders with their caveats.
• Booker: Never share a room’s guest list with an act or a sponsor without guests’ permission, and keep contract terms confidential.
• Musician: Build your own list with clear sign-ups at the merch table, and don’t take names from a venue’s door sheet.
• Bartender: Ask before you photograph or post a guest, and keep what you learn about regulars to yourself.
• Dance Teacher: Collect only the contact details you need for classes, and keep partner and student details private.

TALK ABOUT IT

• What do you know about your guests that they might not expect you to know? Would they mind?
• If a regular asked to see everything you hold on them, what could you show, and what would you want to delete first?
• Is there a number you have shaded, even a little, because of who would read it?