For a lot of businesses the phone is the conversion. Clinics, law firms, home services, anything with a considered purchase and a human on the other end. If you cannot measure calls, you cannot measure your paid search.
Call tracking is also where regulated advertisers most often break rules they believe they are following. Not through negligence, but because the default settings of every call tracking product are built for an unregulated advertiser, and nobody changes them.
Here is the version that holds up when someone asks hard questions.
How call tracking works, briefly
Dynamic number insertion swaps the phone number on your website per visitor. Each visitor sees a number from a pool, that number is tied to their session, and when they call, the platform knows which campaign, keyword, and click sent them.
Google Ads also offers its own forwarding numbers through call reporting. Simpler, less capable, and a different privacy posture, which matters below.
The four things that get advertisers in trouble
Recording calls without valid consent. Recording laws vary by jurisdiction, and several US states require every party to consent. An automated announcement at the start of the call is the standard answer. Default settings on most platforms record everything, so this is a setting you have to go and check.
Sending identifiable data to advertising platforms. A phone number is personal data. Where health is involved, the fact that a person called a clinic about a specific procedure can itself be sensitive, regardless of what was said. Pushing caller identifiers or transcripts into an ad platform is the mistake to avoid, and it is easy to make by accident through an integration you enabled without reading.
Transcripts and AI call scoring. These features are genuinely useful and they create a permanent, searchable record of a conversation that may contain health, financial, or legal detail. That record lives with your vendor. Know where it lives and who can read it.
No signed agreement with the vendor. If you handle protected health information under HIPAA, any vendor processing it on your behalf needs a Business Associate Agreement. Several established call tracking vendors offer HIPAA-aligned plans and will sign one. Google will not sign a BAA for Google Ads call reporting.
That last point decides the architecture. If you operate under HIPAA, Google's own call reporting is not the right tool.
The pattern that works
Break the chain on purpose. Keep the identifying detail in the system that is contractually allowed to hold it, and send the advertising platform only the fact that something happened.
In the call tracking platform, which is under a BAA if you need one: the caller's number, the recording if you have valid consent, the transcript if you use one, and the outcome.
To Google Ads: a conversion event, with no caller identifier, no recording, no transcript, and no condition-specific labelling.
Define the conversion as a qualified call rather than any call. Most platforms let you fire a conversion only when a call exceeds a duration threshold, or only when a human marks it qualified. Sixty seconds is a common starting threshold, and the right number is whatever excludes wrong numbers and hang-ups for your business.
You lose some granularity doing this. You keep the ability to answer a regulator.
Naming matters more than people think
A conversion action called "Knee Replacement Consultation Call" tells Google something about every person who triggers it. So does a campaign structured so that a single conversion action maps to one treatment.
Name conversion actions generically: "Qualified Call," "Phone Consultation Booked." You can hold the detailed segmentation inside your own systems where it belongs.
This applies to audience lists too. A remarketing list built from visitors to one condition page is a list of people with a probable interest in that condition, sitting inside an ad platform. Google's own policies restrict building audiences around sensitive categories, and your obligations may be stricter still.
Attribution without identifiers
You can still connect a call to a click.
Capture the GCLID in the browser session and pass it into the call tracking platform alongside the call record. The platform holds the join. When the call qualifies, it sends back a conversion keyed on that GCLID. Google learns which click produced a qualified call and learns nothing about the person.
This is the same mechanism as offline conversion import, applied to calls instead of deals.
A practical checklist
- Confirm whether you are subject to HIPAA or another framework. Ask, do not assume. Many marketing teams get this answer wrong in both directions.
- If yes, confirm your call tracking vendor will sign a BAA and that you are on a plan where that applies.
- Check whether recording is on, and whether an announcement plays.
- Audit every integration the platform has enabled, especially anything pushing to an ad platform, and confirm what fields it sends.
- Rename any conversion action that describes a condition, procedure, or sensitive circumstance.
- Set a duration or qualification threshold so you optimize toward real conversations.
- Have whoever owns compliance review the setup. Before launch, not after.
The honest tradeoff
Everything above costs you measurement precision. You will attribute a bit less accurately than an unregulated competitor. That is the trade, and it is not close to a difficult decision when you weigh it against a breach notification or a regulator's attention.
The advertisers who get into trouble are rarely the ones who considered this and chose carefully. They are the ones who enabled an integration because it appeared in a list of recommendations and nobody asked what it sent.
Not sure what your setup is sending?
The Conversion Tracking Audit includes your call tracking configuration: what fires, what data leaves your systems, which integrations are live, and how your conversion actions are named and categorized. You get a written list of what to change, in priority order.
$599, fixed fee, findings are yours either way.
