Is Your Web Designer Selling Your Customers?
The Contact Form Scam You Need to Know About
A Disturbing Practice Is Hiding in Plain Sight
This isn’t a rare one-off situation. We encounter this several times a year when new clients come to us wanting their website rebuilt. When we examine the old site, we discover that the previous developer had quietly set up their own email address as a BCC recipient on every contact form submission. Every lead, every inquiry, every customer who reached out to you — they received a copy too.
It's Not Just Email — Phone Numbers Too
The same scheme appears with “call tracking” numbers. Some developers will set up a special phone number for your website, marketed as a way to measure how many calls your website generates. While legitimate call tracking services do exist, some developers use these numbers to build their own database of your customers’ phone numbers — and then contact those people directly to pitch their web design services.
Have Questions?
Need some help on this one, contact us and we should be able to assist
The Fine Print That Makes It "Legal"
Here is the kind of consent language we’ve found buried in the contact forms on these websites:
By clicking the button above, you consent to be contacted by the Business Owner and Web Designer at any email address or telephone number you provide, including, without limitation, communications sent via text message to my cell phone or communications sent using an auto-dialer or a prerecorded message. This acknowledgment constitutes your written consent to receive such communications. You agree and consent to any applicable Terms and Conditions of Use or Privacy Policy available on this website.
Most visitors never read the fine print. Most business owners never even noticed it was there.
Why This Is a Problem — Ethically and Legally
Ethically, this is a clear breach of trust. Your customers are reaching out to you. They did not visit a web design company’s website. They have no interest in being solicited by your developer. Using a client’s customer contacts for self-promotion is, frankly, a scummy way to do business — and it can damage your reputation simply by association.Â
How to Tell If This Is Happening to You
Here are several red flags to watch for:
- Review your contact form settings. Check the “send to” or notification email settings. Are there any addresses you don’t recognize — especially addresses that belong to your developer?
- Read your form’s consent language carefully. If the fine print mentions any company name other than yours, that’s a serious concern.
- Check your call tracking number. If you were given a phone number by your developer rather than setting one up yourself through a service you control, find out who owns that number and who has access to the call logs.
- Ask your developer directly. A trustworthy developer will have no problem answering the question: “Does anyone besides me receive copies of my contact form submissions?”
What to Do If You Discover This on Your Website
- Change your contact form notification settings immediately and remove any unrecognized email addresses.
- Audit your website’s privacy policy and any consent language on your forms. Have a qualified attorney review it if needed.
- Consider replacing your contact form plugin or service entirely to ensure a clean slate.
- Document what you found — screenshots, email logs, form settings — before making changes.
- Talk to an attorney if you believe your customers may have been contacted without your knowledge or meaningful consent.
The Simply Web Services Standard
When we build your website, you own the domain, the hosting, and every piece of customer data that passes through it. We believe that’s the only ethical way to operate, and we think you deserve to know that not every web design company shares that view.