Most intake forms grow by accretion. Someone adds a field, nobody removes one, and a year later a solo practice or small firm is collecting a pile of sensitive data it never actually uses, sitting on a web form with a login and no encryption.
As more service businesses move intake to web forms and automated scheduling, the data they gather quietly runs into a fast-expanding patchwork of state privacy laws. Over twenty states now have comprehensive privacy laws, and some data categories carry their own strict rules with the right to sue attached. You do not need to be a big company to get caught. Here are nine intake fields that create real privacy exposure, why each one is risky, and how to keep collecting what you need without the liability.
What to know
The through-line is simple: several categories of data are treated as “sensitive” under modern privacy laws and usually require clear opt-in consent, tighter security, and a real reason to collect them. Social Security numbers, government IDs, health details, biometrics, sensitive demographics, financial data, precise location, and children’s information all fall in that bucket. The single best protection is data minimization, which means not collecting a field unless you genuinely need it. Every risky field you delete is one you can never leak, misuse, or be sued over.
Table of Contents
1. Social Security number
This is the field to challenge hardest. A Social Security number is among the most sensitive identifiers you can hold, and collecting one turns your form into a prime target and puts you squarely under state breach-notification laws if it leaks. Most service businesses do not need it at intake, if at all. Unless you have a specific, legally required reason, such as tax reporting for a contractor, take it off the form entirely and collect it later through a secure channel only when genuinely necessary.
2. Full date of birth
A birth date feels harmless, but paired with a name it is a building block for identity theft and is treated as personal data you must protect. Many businesses ask for it out of habit when all they actually need is a checkbox confirming the client is over 18, or nothing at all. Collect a full date of birth only when your service truly requires it, such as regulated age verification, and otherwise drop it or replace it with a simple age-confirmation box.
3. Government ID or driver’s license number
Scanning or typing a driver’s license, passport, or other government ID number pulls in highly sensitive identifiers and, in many states, specific handling obligations. It is common in intake flows that bolt on identity verification without thinking through storage. If you must verify identity, strongly prefer a dedicated, compliant verification service that does not leave the raw number sitting in your form database, rather than capturing the number in a plain field you then have to secure yourself.
4. Health and medical details
Health information carries some of the heaviest rules. If you are a HIPAA-covered entity, it triggers those obligations, and newer state health-data laws extend protection to consumer health information well beyond traditional medical settings, several with the right to sue. Even a casual “any health conditions we should know about?” box can pull you into that scope. Collect health data only when it is essential to the service, gate it behind clear consent, and store it with real security, never in a general-purpose form tool.
5. Biometric data (face or fingerprint scans)
This is the field that has generated the biggest legal bills. Face scans, fingerprints, and voiceprints are governed by strict biometric laws, most notably Illinois’s Biometric Information Privacy Act, which requires written consent before collection and lets individuals sue directly, producing enormous settlements. A face-scan check-in or fingerprint login on an intake flow is exactly the kind of feature that draws class actions. Unless you have airtight written consent and a real need, do not collect biometrics at all.
6. Sensitive demographics
Fields asking for race, ethnicity, religion, sexual orientation, or political affiliation are classified as sensitive personal data under most state privacy laws and generally require explicit opt-in consent to process. They also raise discrimination exposure if they influence how clients are treated. If you collect demographics for a legitimate reason, such as voluntary diversity monitoring, make them clearly optional, explain why, and get consent. If there is no real reason, leave them off.
7. Financial account and card numbers
Collecting raw bank account or credit card numbers directly on an intake form invites both payment-industry obligations and breach liability. A form field is the wrong place for card data. Route payments through a dedicated, compliant processor that handles the numbers so they never land in your own database, and keep the intake form focused on the information you actually administer. Never store full card numbers in a spreadsheet or a general form tool.
8. Precise location and device tracking
Precise geolocation is treated as sensitive data, and tracking scripts embedded in a form can create separate exposure, including wiretapping-style class actions over session-replay and chat tools that record what visitors type. Ask for a specific address only when the service needs it, avoid capturing precise location by default, and review the third-party trackers running on your intake page. A privacy problem is not always a field you added; sometimes it is a script you forgot was there.
9. Children’s information
If your intake can gather data about anyone under 13, federal children’s privacy rules come into play, and several states add their own protections for minors. A family-facing service that collects a child’s details on the same casual form as an adult’s is taking on real risk. Separate any collection of children’s data, gather only what is essential, and build in the parental consent those rules require rather than treating a minor’s information like any other field.
How to cut the risk without gutting your form
You do not need to lawyer every checkbox, just apply a few habits:
- Practice data minimization: for each field, ask “do we actually use this?” and delete the ones you cannot justify.
- Gate any sensitive field behind clear, specific opt-in consent that explains why you need it.
- Set retention limits and delete sensitive data when the reason for holding it ends.
- Push identity and payment capture to dedicated compliant services instead of raw form fields.
- Audit the trackers and scripts on your form page, not just the questions you wrote.
Most intake risk disappears the moment you stop collecting data you were never using in the first place.
This article is general information, not legal advice, and privacy laws vary by state and change quickly. Consult a qualified attorney about your specific intake practices, industry, and the states where your clients are located.
Frequently asked questions
What makes an intake form a privacy risk?
Collecting sensitive data, like Social Security numbers, health details, biometrics, or precise location, without a real need, clear consent, and proper security. State privacy laws and specific statutes such as biometric laws impose extra obligations, and some let individuals sue directly.
What is data minimization on a form?
Only collecting the information you genuinely need for the service. For each field, you ask whether you actually use it, and remove the ones you cannot justify. It is the simplest and most effective way to cut privacy risk, since data you never collect cannot leak or be misused.
Do small businesses have to follow privacy laws?
Often partly. Some comprehensive state laws have size thresholds that exempt very small businesses, but rules for sensitive data, biometric laws like BIPA, and tracking-related claims can apply regardless of size. Do not assume being small makes you exempt.
Is it safe to collect Social Security numbers on an intake form?
Generally no, unless you have a specific legal need. SSNs are highly sensitive, make you a target, and trigger breach-notification duties. Most service businesses should remove the field and, if truly required, collect it later through a secure channel.
Can tracking scripts on my form create liability?
Yes. Session-replay and chat tools that record what visitors type have driven wiretapping-style class actions. A privacy problem is not always a field you added; it can be a third-party script running on the page, so audit those too.
The bottom line
The riskiest thing on most intake forms is not a clever new field but old habits: asking for sensitive data nobody uses and storing it loosely. Reconsider Social Security numbers, full birth dates, IDs, health details, biometrics, sensitive demographics, raw financial data, precise location, and children’s information, then keep only what you need behind clear consent and real security. For more on rules that affect running a business, browse The Other Stream’s Law and Business sections.
Related Posts
