Coming Soon: Enable PII Consent Capture

Overview

Some states prohibit retailers from retaining a consumer’s personally identifying information (PII) without explicit, documented consent from the shopper. Dutchie POS lets you record this consent automatically from certain workflows, collect it manually for others, and automatically anonymize profiles that never gave consent.

This feature affects how you handle walk-in, loyalty, and online customers differently, so review it carefully with your own compliance advisors. Dutchie does not provide legal or compliance advice; the language you use to gather consent from consumers must be compliant and valid under your local regulations.

Before you begin

• Accessing PII Consent settings requires the Administrator user permission.
• Before enabling PII consent recording, make sure your location can support an anonymous shopper workflow for consumers who choose not to have their information stored.
• Most states apply PII rules to recreational consumer profiles only, not medical patient data.

Check location readiness before requiring consent

The PII Consent page lists each location that needs a change before it can enable required consent before creating a recreational profile. A location can’t use this requirement if it currently has any of the following:

• Automatic profile creation from ID scans enabled (Settings > Location > Point of Sale > Auto create profile with ID scan)

• Scanning that isn’t unified

• Nationwide check-in

• A VeriScan device without a device ID

Resolve these first, then return to this page to enable the requirement. For the register-side experience once this is enabled, see Capture signed PII consent at the Dutchie POS Register.

Enable PII consent recording

1. Go to Settings > Taxes & Compliance > PII Consent.
2. Toggle on Enable PII consent recording.
   
3. Save.

Turning this on exposes the PII Consent section on customer profiles and gives you access to:

• Automated and manual consent sources (see below)
• Retroactive consent for existing profiles
• Automatic anonymization for non-consenting profiles

Consent sources

Consent sources fall into two categories: automated and manual.

Automated consent sources

Automated consent sources are pre-populated by Dutchie and reflect workflows that generally capture or imply consent before PII reaches Dutchie POS:

• E-Commerce orders
• Loyalty enrollment
• Kiosk checkout
• Medical checkout

You can enable or disable each of these at your discretion, based on your own interpretation of your rules and workflows.

A few things worth knowing about these sources:

• Dutchie E-Commerce and adjacent workflows qualify for automatic consent because customers checking out on Dutchie menus agree to the Dutchie Terms of Service and Dutchie Privacy Policy, which extend the right to store consumer information to dispensary partners.
• At your discretion, some third-party integrated loyalty programs may also be opted into automatic consent, including retroactive consent for their associated customer profiles.
• Because most states only apply PII rules to recreational profiles, a completed medical transaction is treated as an optional automatic consent source. You can disable it at will.
• Profiles created by other third-party sources, such as external menus or loyalty integrations, may have their own consent-gathering workflows, but Dutchie can’t proactively verify them. These profiles are not automatically treated as having consent, though you can choose to configure them that way.

Manual consent sources

Walk-in customers may not have a profile created through any automated source. For these customers, configure a manual consent source to document consent gathered outside Dutchie, such as a signed paper form or an online form.

To record a manual consent source, edit the PII Consent section on the customer’s profile.

Apply retroactive consent to existing profiles

If you enable an automated consent source, you may have existing profiles that were created through that same workflow before the source was enabled, for example, profiles created from past e-commerce orders.

To apply consent to those existing profiles:

1. Toggle the automated source on.
2. Click Save.
3. Click Record Retroactive Consent.
4. Choose whether to apply consent since the beginning of time or on or after a specific date.
   

Require consent before creating a recreational profile

You can enforce a stricter setting, Require consent before creating a recreational profile, found on the same PII Consent page.

Before you enable this:

• Your location must be configured to use Dutchie ID Scan.
• You need a customer-facing touchscreen device, such as a tablet.

Once enabled, this setting blocks new recreational profile creation until one of the following happens:

• A signature is captured on your consent form, or
• An alternative manual consent source is selected.

After either condition is met, profile creation continues normally.

If you’re creating a medical profile instead, click Create Medical Profile instead to bypass this requirement and proceed normally. When you use this bypass, only medical customer types are available for selection.

View PII consent history on a customer profile

Once PII consent recording is enabled from Taxes & Compliance, a PII Consent history section appears on customer profiles. It shows all relevant consent history for that profile, including when consent was captured, its format or type, and the date and time.

Opt out and anonymize a profile

If a customer no longer wants their PII retained, you can manually trigger an opt-out. This removes consent from the profile, and the profile is anonymized overnight after the opt-out is initiated.

Automatic anonymization

With PII consent recording enabled, you also get access to Automatic Anonymization, which runs a cleanup job on a regular cadence.

Configure the number of days to retain a non-consenting customer’s information before it’s automatically removed. The minimum value is 1 day. If you’re concerned about retaining information for less than a day, use anonymous checkout workflows instead of collecting customer information at all.

When the anonymization job runs, it removes the following from any profile without consent:

• Name (first and last)
• Date of birth
• Email address
• Mailing address (address, city, state, zip)
• Phone number
• Driver’s license number
• Driver’s license image

Review related settings for conflicts

Before enabling PII consent collection, review your configuration of these related settings to avoid conflicts.

Related articles

• Prevent duplicate guest profiles with ID scanning at check-in
• Clean up duplicate customer profiles in Dutchie POS Backoffice
• Add customer and patient data without storing personal information - Dutchie POS Register