Hair salon client records in the US: what to keep and how to protect it

Ask a colorist what makes a regular feel like a regular and you will hear the same answer: "I pull up her card and I know everything." The formula from last time, the developer volume, how long it processed, the fact that she is growing out bangs and books every five weeks. That card, paper or digital, is one of the most valuable assets in your salon.

It is also a file full of other people's personal information, and in the United States that comes with questions most articles skip: which privacy laws actually apply to a salon, what happens if a laptop with your client list walks out the door, and what a client can reasonably ask you about her own data. This guide covers both halves: how to build a client record that earns money, and how to look after it. It is published by ViteUneCoupe, which offers a free client database and online booking system for hair salons, with 0% commission on bookings, but everything below applies whatever tool you use, index cards included.

One note before we start: this article explains US rules in plain language and links to the primary sources. It is general information, not legal advice, and state laws differ. For anything with real stakes, ask a lawyer licensed in your state.

What a useful salon client record actually contains

The best client records are built for the next appointment, not for a filing cabinet. In practice that means six things:

• Contact details. Name, cell number, email. Enough to confirm, remind and reach her if her stylist calls in sick. US numbers in +1 format work fine in a digital client database.
• Visit history. Dates, services, which stylist, what she paid. This is what turns "I think she came in around July?" into an answer.
• Technical notes. The color formula, developer volume, processing time, toner, how her hair lifted, what you would do differently. For a colorist this is the heart of the record.
• Preferences. Prefers quiet appointments, hates heavy layers, always wants a blowout finish. Small notes, outsized effect on how valued she feels.
• Retail history. What she bought and when, so you can mention the liter size before she runs out.
• Sensitive notes, kept to a minimum. If she has reacted to a product or reported an allergy, note the fact plainly and factually. Write every note as if the client might one day read it, because she might ask to.

If you track one more thing, make it the rebooking status: did she leave with her next appointment or not? That single field feeds your retention work, and we cover how to use it in our guide to salon client retention and rebooking.

Paper cards or software?

Plenty of excellent colorists still run on a binder of cards, and the binder has real virtues: it never needs a password reset and it cannot be hacked from the other side of the world. It also has real limits: one copy, in one place, readable by anyone who opens the drawer, unsearchable, and very much flammable.

Software flips those trade-offs. A digital client database attached to your booking calendar fills itself in as appointments happen, is searchable in seconds, and does not live on a shelf anyone can browse. The free plan of ViteUneCoupe includes exactly that: a client database with full booking history, tied to your salon's online booking page. One honest limit worth knowing: ViteUneCoupe handles appointments, not payments, so no client card numbers pass through or sit in your account there at all, which is one less category of data for you to worry about.

Whichever you choose, the deciding question is the same one regulators ask: who can see this, and do they need to? A locked drawer and a password-protected account are the same idea in two materials.

Which US privacy laws actually apply to a hair salon?

Here is the part the internet gets wrong most often, usually by importing European rules. The United States has no federal GDPR equivalent for ordinary commercial data like a salon's client list. There is no national registration, no annual data protection fee, no license. What exists instead is a patchwork, and for a typical salon it is smaller than the scary articles suggest.

State comprehensive privacy laws mostly do not reach small salons

California's CCPA is the law everyone has heard of. Its own regulator is clear about who must comply: for-profit businesses that meet at least one threshold, which, per the California Privacy Protection Agency's FAQ checked in October 2026, are gross annual revenue above $26.625 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of revenue from selling or sharing personal information. A business below all three thresholds is not subject to the CCPA.

Colorado runs the same pattern: the Colorado Privacy Act, as explained by the Colorado Attorney General and checked in October 2026, applies to businesses that process personal data of 100,000 or more Colorado consumers in a year, or 25,000 or more if the business gets revenue or discounts from selling that data. More than a dozen other states have passed comprehensive privacy laws in the same family, each with its own thresholds and scope rules.

Read those numbers against your salon. A busy three-chair salon might hold a few thousand client records, not one hundred thousand, and it does not sell anyone's data. Most independent hair salons simply fall below these laws. Two honest caveats: thresholds and state coverage change, so check your own state before relying on this, and "the law does not require it" is not the same as "clients do not expect it."

The FTC baseline applies to everyone

What does apply to every US business, salon included, is the Federal Trade Commission's authority over unfair and deceptive practices. In data terms that means two things: do not say things about privacy that are not true (if your booking page says "we never share your information", that has to be accurate), and do not be reckless with the data you hold. The FTC's own Protecting Personal Information guide for business, checked in October 2026, condenses its expectations into five habits that fit a salon perfectly; the next section applies them.

Breach notification laws exist in all 50 states

If client data does leak, every state has a say: all 50 states, the District of Columbia and several US territories have security breach notification laws requiring businesses to notify affected individuals, as summarized by the National Conference of State Legislatures, checked in October 2026. Deadlines and definitions vary by state, which is one more reason the prevention habits below are cheaper than the cure.

Five FTC-grade security habits, salon edition

The FTC's five principles translate directly to a salon floor:

1. Take stock. Know where client information lives: the software account, the old binder in the back room, the export someone downloaded to a personal laptop in 2023, the group chat where someone once pasted a client's number. You cannot protect what you have forgotten.
2. Scale down. Keep what the next appointment needs, and stop collecting what nothing needs. You do not need a birth date for a balayage. The less you hold, the less a mistake can spill.
3. Lock it. Strong, unique passwords on the software account, no shared logins written on a sticky note at the front desk, paper cards in a drawer that actually locks, and access limited to the people who need it. A booth renter's clients are hers; her records should not be an open book to everyone in the building, and yours should not be open to her.
4. Pitch it. When you clear out records of clients you have not seen in years, shred the paper rather than tossing it whole, and delete exports you no longer need. If you leave a booking platform, download your client list and then remove what the old provider lets you remove; our guide to switching salon booking software covers who lets you export what.
5. Plan ahead. Decide now what you would do if the laptop were stolen: which passwords to change, which provider to call, how you would know what was on it. Ten minutes of thinking in advance beats a panicked weekend later.

None of this costs real money. It is the same discipline you already apply to the cash drawer, pointed at the client list.

Texting and emailing the people in your records

Client records and client messaging are neighbors: the record is where the phone numbers and emails live, and separate federal rules kick in when you start sending. Appointment confirmations and reminders are treated differently from marketing blasts, and texting has its own consent rules under the TCPA. That is a full topic of its own, covered in our guide to appointment reminders for US hair salons, templates included.

When a client asks about her data

Even where no statute forces your hand, treat these three requests as standing policy, because they cost little and build trust:

• "What do you have on me?" Show her. A visit history and a color formula are nothing to hide, and the conversation usually ends in a rebooking, not a dispute.
• "Delete my information." Unless you have a real reason to keep something (a dispute, a payment record your accountant needs), honor it and say so plainly.
• "Stop texting/emailing me." Always, immediately, regardless of what any law requires. A reminder sent to someone who asked you to stop is marketing against yourself.

Put one plain sentence on your booking page about what you do with client details ("We use your contact details to manage your appointments and never sell them") and then make sure it stays true. Under the FTC's deception standard, the sentence you publish is the promise you are held to.

Frequently asked questions

Does GDPR apply to my US hair salon?

Not as a US legal requirement. GDPR is European law; the United States has no federal equivalent for salon client data. You could only encounter GDPR-style duties in unusual situations, such as actively serving clients in Europe. The rules that matter at home are the FTC's honesty-and-security baseline, your state's breach notification law, and a state comprehensive privacy law if your business is large enough to meet its thresholds, which most independent salons are not.

Do I need a client's consent to keep her color formula on file?

No US law requires a signed consent form to keep ordinary service notes like formulas and visit history for your own business use. Good practice still applies: tell clients plainly that you keep service records, keep notes professional and minimal, and honor deletion requests when there is no real reason to refuse.

How long should I keep client records?

No single US rule sets a retention period for salon service records. Practical anchors: keep technical records as long as the client is active, since that is their whole value; keep records tied to money (invoices, disputes) as long as your accountant and your state's tax rules require; and clear out records of long-gone clients on a schedule you actually follow, shredding paper as you go.

Is a paper client card system legal in the US?

Yes. Nothing requires salons to digitize. The same care applies in both formats: a locked drawer, access for the people who need it, and shredding instead of tossing. The reasons most salons move to software are practical, searchability, automatic history, and backups, rather than legal.

What should I do first if client data leaks?

Figure out what was exposed and for which clients, change the relevant passwords immediately, and check your state's breach notification law the same week, because every state has one and several set notification deadlines. If the leak came through a software provider, ask them in writing what happened and what they are doing about it.