DEV Community: Nova Solutions

We checked 2,137 contractor websites on a phone

Nova Solutions — Mon, 09 Nov 2026 16:21:23 +0000

Most advice about contractor websites is opinion. We wanted a count. So we took every plumber, HVAC company, electrician, roofer, landscaper, painter, carpenter and general contractor with a website listed in OpenStreetMap across 21 states, loaded each homepage the way a customer's phone would, and recorded what a visitor can actually do there.

Why we counted instead of guessing

Search for contractor website statistics and you get the same recycled lines about how many customers search on a phone, usually traced back to a vendor survey with no stated sample. Nobody publishes what is actually on contractor websites. So we checked, site by site, and wrote down what a customer on a phone can do on each homepage: tap to call, book a time, send a text or chat, or fill in a form.

Method

Sample: every business tagged as a plumber, HVAC company, electrician, roofer, gardener or landscaper, painter, carpenter or builder with a website in OpenStreetMap, across 21 US states, pulled October 27, 2026. Duplicate domains and social or directory links were removed, leaving 3,170 sites. Each homepage was loaded in headless Chrome with an iPhone user agent at a 390 by 844 screen, with about eight seconds for scripts to run, on October 27 and 28, 2026. 763 sites did not load (dead domains, certificate errors, blocked requests or pages that never rendered) and are excluded. Another 270 loaded something other than the business's working site: a security check (such as 'Just a moment...'), a parked or for-sale domain, an expired or suspended hosting account, an error page, a pay-per-call page on a lapsed domain, or a hacked page selling online gambling. They are excluded too, leaving 2,137. No company is named.

The 21 states: California, Texas, Florida, Pennsylvania, Illinois, Colorado, New York, Ohio, Washington, North Carolina, Arizona, Virginia, Minnesota, Georgia, Indiana, Missouri, Massachusetts, Alabama, Arkansas, Utah and Alaska. California, Texas and Florida contributed the most sites. OpenStreetMap is volunteer-mapped, so this is a large real sample, not a statistically weighted census of every contractor in the country.

Corrected October 29, 2026

The first version of this study, published October 28, used two detection patterns that also matched unrelated text: one counted domains ending in 'local.com/' as the Cal.com booking tool, and one counted the word 'intercom' (as in door intercoms) as the Intercom chat widget. We re-loaded every site those patterns flagged with stricter checks, and stopped counting review widgets as chat. Booking fell from 13% to 12%, chat or text from 21% to 15%, and sites with neither rose from 71% to 77%.

Second correction, October 29, 2026

Checking the pages behind a later study, we found 270 of the 2,407 homepages we had counted were not the contractor's working site: security checks, parked or for-sale domains, expired or suspended accounts, error pages, pay-per-call pages on lapsed domains and hacked pages. Counting them as sites with no call link and no booking understated the figures. We dropped them, leaving 2,137. Tap-to-call links rose from 76% to 84%, contact forms from 49% to 53%, booking from 12% to 13%, and sites with neither booking nor chat or text fell from 77% to 75%. We also removed the row counting mobile viewport tags: the check missed tags written with their attributes in a different order and the fixed-width tag Wix uses on phones, so it undercounted. Every figure on this page is the corrected one.

What a phone visitor finds

What the homepage has	Share of sites
HTTPS	94%
A tap-to-call link coded in	84%
A phone number shown but no call link coded in	9%
No phone number on the homepage at all	6%
A contact form	53%
A chat widget or a text option	17%
A text-message link	6%
An online booking tool	13%
A button or link worded as booking or scheduling	20%
No booking tool and no chat or text	75%
No booking, no chat or text and no form	36%
No call link, no chat or text and no booking	15%

Share of 2,137 contractor homepages with each feature, loaded as an iPhone, October 27 to 28, 2026

The basics are mostly in place. 94% of sites run on HTTPS, and more than four in five put a call link on the homepage. The gap is everything after the phone call. Only about one site in six lets a customer start a conversation in writing, and about one in eight lets them book a time without talking to anyone. Which tools those sites use is in which booking and chat tools contractor websites use.

About the 9% with no call link

A phone number written as plain text is not useless on a phone. iPhone Safari and many Android browsers detect numbers and make them tappable on their own. What these sites lack is a call link coded into the page, which is what makes the number a button everywhere and lets call tracking work.

After hours, most sites only offer a phone call

A customer whose water heater fails at 9pm or who finally gets around to a roof quote on Sunday is on a phone, outside business hours. On 75% of the homepages we loaded, that customer could not book a time and could not send a text or chat. Their options were to call a business that is probably closed or fill in a form and wait. On 36% of homepages there was no form either, so the phone was the only way in.

That is not a website design problem as much as a coverage problem. A booking tool or chat widget needs someone or something on the other end. The cheaper fix is making sure the calls that do come in after hours get an answer: a text back to every missed call, or a receptionist that picks up.

By trade: HVAC leads, finish trades lag

Trade	Sites	Tap-to-call link	Booking tool	Chat or text	Neither booking nor chat
HVAC	563	88%	25%	23%	60%
Roofing	446	91%	4%	17%	80%
Plumbing	406	89%	19%	16%	71%
Landscaping	211	75%	3%	18%	80%
Electrical	194	81%	11%	9%	82%
General contractor	111	71%	3%	9%	89%
Carpentry	105	60%	2%	9%	90%
Painting	101	82%	1%	12%	88%

By trade, of the 2,137 homepages counted

HVAC is the only trade where nearly a quarter of sites take online bookings, which tracks with how many HVAC companies already run field-service software that includes a booking page. Plumbing is close behind. Roofing sites almost always have a call link but almost never a booking tool, which makes sense for a trade that sells inspections and quotes rather than time slots. Carpentry and general contractors trail on every measure: about nine in ten of their homepages offer neither booking nor chat or text, and only 71% of general contractor sites and 60% of carpentry sites have a call link. Painting sites mostly have a call link but almost never a booking tool.

What this study does not show

Only homepages were checked. A company may have booking or chat on an inner page, so the booking and chat figures are a floor, not a ceiling.
Detection reads the rendered page for known booking tools (such as Housecall Pro, ServiceTitan, Jobber, Calendly, Acuity and Setmore) and known chat and texting widgets (such as Podium, LeadConnector, Tawk, LiveChat, Intercom and HubSpot chat), plus plain wording like 'text us' or 'live chat' and text-message links. Review widgets such as Birdeye and NiceJob are not counted as chat. A widget that only loads after a click or a long delay can be missed.
It measures what is on the site, not whether anyone answers. A site with a chat widget can still leave messages unread overnight.
OpenStreetMap lists businesses volunteers have mapped. Businesses that are not on the map, and states we could not pull (Michigan, Tennessee and Oregon failed on the day), are not in the sample.

What to check on your own site

Open your homepage on your phone and tap your number. If nothing happens, the number needs a call link coded in.
Visit at 9pm and ask what a customer could do right now. If the answer is call and hope, decide what happens to that call.

Every figure from this study and the others in the series is on one page, with a CSV: contractor website statistics.

Questions this post answers

How many contractor websites have online booking?

13% of the 2,137 contractor homepages we loaded in October 2026 had an online booking tool such as Housecall Pro, ServiceTitan, Jobber, Calendly or Acuity. HVAC was highest at 25% and plumbing next at 19%. Landscaping, carpentry, painting and general contractors were at 1% to 3%.

How many contractor websites have a click-to-call button?

84% had a tap-to-call link coded into the homepage. Another 9% showed a phone number with no call link, which many phones still detect and make tappable. 6% showed no phone number on the homepage at all.

Can customers reach a contractor's website after hours?

On most of them, only by calling or filling in a form. 75% of the homepages we loaded had no online booking tool and no chat or text option, and 36% had no form either, which leaves a phone call as the only way in.

How was the contractor website study done?

We pulled every plumber, HVAC, electrical, roofing, landscaping, painting, carpentry and building business with a website listed in OpenStreetMap across 21 states, removed duplicates and directory links, and loaded each homepage in headless Chrome as an iPhone between October 27 and 28, 2026. 2,407 of 3,170 sites loaded; 270 of those turned out not to be the business's working site (security checks, parked or for-sale domains, expired or suspended accounts, error pages and hacked pages), leaving 2,137 counted. Only homepages were checked, so booking and chat counts are a floor.

Originally published at www.advai.cloud/blog/contractor-website-study-2026.

Which website builders do contractor sites run on?

Nova Solutions — Mon, 09 Nov 2026 16:21:20 +0000

Every website builder says it is the one contractors use. We checked. Using the same sample as our contractor website study, we loaded each homepage again and recorded which platform built it, from the code each platform leaves in the page.

How we checked

The sample is the 2,137 contractor homepages counted in our contractor website study, drawn from OpenStreetMap across 21 states. We loaded each again in headless Chrome as an iPhone on October 29, 2026; 1,996 loaded and showed the business's own site. Each platform leaves its own marks in a page: the folders WordPress serves files from, the image servers Wix, Squarespace and Duda use, a generator tag naming the builder. We recorded every mark we found and checked samples of each platform by hand before counting it.

WordPress: files served from /wp-content/ or /wp-includes/, or a WordPress generator tag. Page builders such as Elementor run inside WordPress and count as WordPress.
GoDaddy Website Builder: only sites whose generator tag names GoDaddy's builder. Many WordPress sites hosted at GoDaddy load a GoDaddy script too; those count as WordPress.
Thryv and Hibu: both build their customers' sites on Duda, so a Duda site that also loads Thryv's or Hibu's files counts as Thryv or Hibu. Other Duda sites count as Duda, a builder sold mainly to web agencies.
Scorpion: the marketing agency's own code or links in the page.
GoHighLevel: a site built with GoHighLevel's site builder. A WordPress site that only embeds a GoHighLevel form counts as WordPress.
Not identified: no platform mark we looked for. Most are custom-built sites; some use a small builder we did not check for.

The platforms

Platform	Sites	Share
WordPress	1,096	54.9%
Wix	94	4.7%
Squarespace	87	4.4%
Duda (other than Hibu and Thryv)	72	3.6%
GoDaddy Website Builder	57	2.9%
Hibu	38	1.9%
Next.js (custom-built)	38	1.9%
Thryv	34	1.7%
Scorpion	33	1.7%
Webflow	30	1.5%
GoHighLevel	12	0.6%
Weebly	10	0.5%
Other (HubSpot, Framer, Joomla, Shopify, Drupal)	27	1.4%
Not identified	368	18.4%

Platform behind 1,996 contractor homepages, October 29, 2026

WordPress runs more than half of contractor websites, more than every other platform we found put together. The do-it-yourself builders (Wix, Squarespace, GoDaddy and Weebly) add up to 248 sites, 12.4%. Platforms sold mostly through agencies and directories (Duda, Hibu, Thryv, Scorpion and GoHighLevel) add up to 189, 9.5%. Among WordPress sites, the most common page builder named in the code was Elementor, on 154.

By trade

Trade	Sites	WordPress	Wix	Squarespace	GoDaddy	Agency platforms	Not identified
HVAC	537	60%	3%	3%	3%	10%	18%
Roofing	410	64%	4%	2%	1%	7%	14%
Plumbing	382	57%	3%	3%	2%	12%	20%
Landscaping	192	43%	6%	9%	5%	9%	20%
Electrical	182	49%	8%	3%	5%	9%	24%
General contractor	102	49%	13%	10%	4%	6%	10%
Carpentry	98	34%	7%	15%	4%	11%	21%
Painting	93	43%	5%	3%	2%	14%	27%

Share of each trade's homepages by platform, October 29, 2026

Roofing and HVAC are the most WordPress-heavy trades, at 64% and 60%. Carpenters and general contractors lean furthest toward the do-it-yourself builders: about one carpentry site in four and one general contractor site in four runs on Wix, Squarespace or GoDaddy. 'Agency platforms' is Duda, Hibu, Thryv, Scorpion and GoHighLevel combined.

What each platform's sites offer a phone visitor

We matched each site to what the website study recorded on its homepage on October 27 and 28: a tap-to-call link, an online booking tool, and a chat or text option. The platform does not decide these. A WordPress site has booking because someone added it. But the pattern is plain.

Platform	Sites	Tap-to-call link	Booking tool	Chat or text	Neither booking nor chat
WordPress	1,096	90%	17%	20%	70%
Wix	94	87%	1%	4%	95%
Squarespace	87	54%	3%	3%	93%
Duda	72	99%	19%	15%	74%
GoDaddy Website Builder	57	67%	4%	0%	96%
Hibu	38	100%	5%	47%	50%
Next.js (custom-built)	38	89%	24%	24%	55%
Thryv	34	97%	3%	6%	94%
Scorpion	33	100%	27%	48%	42%
Webflow	30	80%	7%	13%	87%
Not identified	368	72%	10%	9%	83%
All sites checked	1,996	84%	13%	17%	75%

Platforms with at least 30 sites, share of their homepages, October 2026

Do-it-yourself builders: on the 248 Wix, Squarespace, GoDaddy and Weebly sites, 2% had a booking tool and 4% a chat or text option. 94% had neither. Only 54% of Squarespace sites and 67% of GoDaddy sites coded the phone number as a call link.
Agency platforms: on the 189 Duda, Hibu, Thryv, Scorpion and GoHighLevel sites, 98% had a call link and 31% a chat or text option, mostly on Hibu and Scorpion sites, where nearly half had one.
WordPress sat in between: 90% had a call link, 17% a booking tool, 20% a chat or text option.

Small groups

Hibu, Thryv, Scorpion and Webflow each have 30 to 38 sites here, so one or two sites move their shares by several points. Treat their rows as a direction, not a precise rate. Our chat check looks for the widgets listed in the website study; a platform's own chat that is not on that list is missed, which may understate Thryv in particular.

What it means if you are choosing a platform

The builder matters less than what is set up on it. The DIY builders can all show a call button and embed a booking page, yet on the contractor sites we checked almost nobody did. If you build on Wix, Squarespace or GoDaddy yourself, budget the time to add a call link, a booking or quote form, and a way to text. If someone builds it for you, ask what happens to a call you miss. Our best website builder for plumbers compares the options on cost and time.

Limits

Homepages only, loaded once as an iPhone. A platform that leaves no mark we looked for falls into 'Not identified'.
141 sites from the website study did not load on October 29 and are left out.
Feature figures come from the website study's October 27 and 28 load, matched to the platform found on October 29; a site that changed in between would be mismatched.
The sample comes from OpenStreetMap, which lists the businesses volunteers have mapped; it is large and real, but not a weighted census.

Every figure from this study and the others in the series is on one page, with a CSV: contractor website statistics.

Questions this post answers

What website builder do most contractors use?

WordPress, by a wide margin. Of 1,996 US contractor homepages we checked in October 2026, 55% ran on WordPress. Wix was next at 4.7%, then Squarespace at 4.4%, Duda at 3.6% and GoDaddy's website builder at 2.9%. 18% showed no platform we could identify.

Do contractors use Wix or Squarespace?

Some do, mostly smaller trades. Wix ran 4.7% and Squarespace 4.4% of the contractor homepages we checked. Squarespace was most common among carpenters (15%) and general contractors (10%), and Wix among general contractors (13%).

Do Wix and Squarespace contractor sites have online booking?

Rarely. On the 248 contractor homepages built with Wix, Squarespace, GoDaddy or Weebly, 2% had an online booking tool and 4% a chat or text option; 94% had neither. Across all sites we checked, 75% had neither.

Originally published at www.advai.cloud/blog/contractor-website-platforms-study.

Your missed-call text-back is not firing: six things that break it

Nova Solutions — Wed, 30 Sep 2026 09:14:28 +0000

The dashboard says the message sent. The customer never got it. That gap has a small number of causes, and they are worth ruling out in a specific order.

The shape of the problem

A missed-call text-back is a short chain, and a break anywhere in it looks identical from the outside: the call comes in, nobody picks up, and no text arrives. Your software usually reports success, because from its point of view it did everything it was asked to do.

That is why guessing is expensive here. The six causes below are ordered by how often they turn out to be the answer, and the first one accounts for most of the silent failures.

1. Carrier registration is missing or was rejected

US carriers require application-to-person messaging sent from a standard ten-digit number to be registered: a brand, and a campaign describing what you send and how people consented. Unregistered traffic is filtered or blocked rather than returned with an error.

This is the failure mode that wastes the most time, because nothing in your own tooling looks wrong. The send succeeded. The handoff succeeded. The message simply stopped at the carrier. If your text-back worked at some point and then quietly stopped, check whether a campaign lapsed or was rejected before you check anything else.

Worth knowing

Registration is a carrier requirement, not a law. There is usually no fine attached. The penalty is that your messages do not arrive, which for a lead-capture automation is the entire cost.

2. A previous STOP is still suppressing that number

If a specific customer never gets your text-back while everyone else does, look for a revocation. Someone who once replied STOP to any of your messaging, including a campaign unrelated to this one, will usually sit on a permanent suppression list.

This is working as intended and you should not try to route around it. Consent revocation has to be honored, and the rules give you a limited window to act on it. The right response is to recognize it as the cause and stop debugging, not to find a way to message that person anyway.

3. The trigger is listening to the wrong call outcome

A missed call is not one event. Declining on your handset, letting it ring out, forwarding to voicemail, answering and immediately dropping, and a call that never reaches your device at all can all be distinct outcomes to whatever is watching the line.

Plenty of setups are wired to one of those and not the others, which produces the most confusing version of this problem: it works sometimes. If yours fires for some real calls and not others, this is usually why.

Test each outcome separately rather than testing once and declaring it working.
Check whether calls that go through a forwarding chain still register as missed on the instrumented number.
Confirm the automation is watching the number customers actually dial, not a secondary line. ## 4. Business-hours logic is suppressing it

Many setups ship with a schedule, and the default is often business hours. That quietly removes the automation from exactly the window it was bought for: evenings, weekends, and the hours when the person who normally answers is asleep.

A missed call at eight on a Saturday evening is not a lower-value lead than one at eleven on a Tuesday. It is usually a higher-value one, because fewer competitors are picking up. Check the schedule before you assume the automation is broken, because a schedule doing its job looks exactly like a failure.

5. The number is not text-enabled, or is the wrong type

A traditional landline cannot send or receive SMS unless it has been text-enabled. That is a single setting somewhere, and it is invisible until you try to use it.

Beyond that, number types are treated differently by carriers. Toll-free numbers, ten-digit long codes, and short codes each have their own registration path and their own filtering behaviour. Using the wrong one for your volume and use case tends to produce inconsistent delivery rather than total failure, which is harder to spot.

6. The message body is getting filtered

Carriers filter on content as well as registration. Messages that read like unsolicited marketing, lean heavily on shortened links, or use formatting associated with spam can be dropped even from a properly registered campaign.

For a text-back this is easy to avoid, because the message that performs best is also the message least likely to be filtered: short, plainly identifying your business, referring to the call that just happened, and asking a question. Keeping promotional content out of it helps on this front and on the compliance front at the same time.

The order to check, and when to stop

Confirm carrier registration is active and the campaign was approved.
Check whether the affected number is on a suppression list.
Test every missed-call outcome separately, not just the one that is easy to reproduce.
Read the schedule, including timezone.
Confirm the sending number is text-enabled and the right type for the use case.
Simplify the message body and retest.

If you have been through all six and it still does not fire reliably, the honest read is that you are now maintaining infrastructure rather than running a business. That is the point at which a managed setup stops being a convenience and starts being the cheaper option, because the cost of a text-back that silently does not work is every lead it was supposed to catch.

Questions this post answers

Why does my missed-call text-back say sent but never arrive?

Almost always carrier filtering. US carriers require application-to-person traffic from a ten-digit number to be registered with a brand and a campaign, and unregistered or rejected traffic gets dropped rather than bounced. Your software reports a successful handoff because it did hand off. The message just never made it past the carrier.

Why does it work when I test it but not for real customers?

Two common reasons. You may be testing from a number that is already on an allowlist or has messaged you before, and you may be testing a call outcome that differs from a real one. A call you decline on your handset, a call that forwards to voicemail, and a call that rings out can be three different events to the automation, and only some of them may be wired to the trigger.

Can an old STOP reply block future texts to that customer?

Yes, and it should. Once someone revokes consent you have to honor it, and most platforms keep a permanent suppression list so you cannot accidentally message them again. If one specific customer never receives your text-back, check whether they ever replied STOP to anything you sent, including a different campaign.

Does the number I send from matter?

It matters a lot. A landline that has not been text-enabled cannot receive or send SMS at all, and toll-free, ten-digit long code, and short code numbers are registered and filtered differently. Sending from the wrong number type for your use case is a common cause of messages that deliver inconsistently rather than not at all.

How fast should the text actually go out?

Fast enough to beat the next contractor on the list, which in practice means seconds rather than minutes. The value of a text-back decays quickly, because the caller is still holding their phone. If yours is arriving several minutes later, treat that as a failure to fix rather than a quirk to live with.

Originally published at www.advai.cloud/blog/missed-call-text-back-not-working.

What is actually in a data licensing agreement

Nova Solutions — Wed, 30 Sep 2026 09:12:04 +0000

Most of the value in one of these agreements is decided by clauses nobody reads out loud in the meeting. These are the ones worth slowing down for.

Why this post does not give you a template

A lot of people searching for this are looking for a document to fill in. It is worth saying plainly why that is the wrong tool here.

In most contracts, a template is a reasonable starting point because the variables are obvious: parties, dates, amounts. In a data licensing deal, the terms carrying the most value are the ones a template cannot guess, and getting one of them wrong does not produce an obviously bad contract. It produces a contract that looks fine and quietly gives away the asset.

So instead, here is what each clause actually decides. Read it, form a view on what you want, then have a lawyer draft or review the real thing.

The four clauses that decide the value

These are the ones to slow down on, because each of them can be worth more than the number on the front page.

Clause	What it decides	The question to ask
Exclusivity	Whether you can license this data to anyone else, and for how long	If this is exclusive, what am I giving up in every future deal?
Field of use	What the buyer may use the data for	Is this licensed for one purpose, or for anything they ever build?
Derivatives	Who owns what comes out the other side	If they train a model on this, what is my position in that model?
Term and survival	When it ends, and what outlives the ending	What exactly happens to every copy on the last day?

The scope clauses, in the order they usually matter

The one people underweight

Derivatives. In an AI deal, the data going in and the model coming out are different assets, and the second one often has the longer life. An agreement silent on derivatives has not quietly settled it in your favour.

The clause that is not optional

Most of this list is commercial negotiation. One item is not.

If the deal is structured around the data being de-identified under the CCPA, the statutory definition at Civil Code section 1798.140, subdivision (m) requires three things, and the third is that the business contractually obligates any recipients of the information to comply with all provisions of that subdivision. That includes the commitment not to attempt reidentification.

This is not a nice-to-have term you can trade away for a better price. If it is missing, the data does not meet the statutory definition, and the reason the transfer sat outside the personal-information rules in the first place stops being true.

The clauses that protect you afterwards

Representations and warranties: what you are promising about the data, and what you are not. Promising more than you can verify is the most common way a seller creates a problem for themselves.
Indemnity: who carries the cost if something goes wrong, and whether it is capped. An uncapped indemnity from a small business to a large buyer is an asymmetric risk worth naming out loud.
Security and handling obligations: how the recipient must store and transmit the data, and whether subcontractors are permitted.
Onward transfer: whether the buyer may pass the data to affiliates, contractors, or acquirers. A license to one company can become a license to an industry through this clause alone.
Audit rights: whether you can ever verify any of the above, and at whose cost.
Confidentiality: covering the deal terms themselves, not only the data.
Governing law and dispute resolution: which is the clause nobody reads until it is the only one that matters.

How payment is usually structured

Payment terms vary more than people expect. A lump sum on delivery is the simplest and the easiest to value. Structures that pay over time, or that tie payment to the buyer's use, shift risk toward the seller and are much harder to verify without audit rights.

If a broker is involved, the fee structure is its own term: whether it is a percentage, whether it is contingent on closing, and whether the broker is paid on renewals or expansions of the original license. Nova's own arrangement is a percentage paid only if you accept an offer and a deal closes, which is one model among several rather than a standard.

A test worth applying

Ask what happens if the buyer's business changes. Acquisition, pivot, shutdown. If the answer is not in the document, the answer is whatever they decide later.

Before you sign

Read your own privacy policy and customer contracts first. They can prohibit what the agreement permits.
Decide your position on exclusivity and derivatives before the negotiation, not during it.
Make sure the recipient-obligation clause is present if the deal rests on de-identification.
Confirm what happens to every copy at termination, in writing.
Have a lawyer review the actual document. Not a template, and not this post.

This is general information about how these agreements are typically structured, plus one statutory requirement quoted from published text. It is not legal advice and it is not a substitute for a lawyer who has read your specific deal.

Sources

Cal. Civ. Code 1798.140(m), definition of deidentified, including the requirement at (m)(3) to contractually obligate recipients.
Cal. Civ. Code 1798.140(v)(3), personal information does not include deidentified or aggregate consumer information.
All other clause descriptions above are general commercial practice, not statutory requirements. ## Questions this post answers

Is there a standard data licensing agreement template?

There are templates in circulation, and using one you cannot evaluate is how businesses sign away things they did not mean to. The terms that matter most in these deals, exclusivity, field of use, and ownership of derivatives, are exactly the ones a generic template will get wrong for your situation. The useful preparation is knowing what each clause does, then having a lawyer draft or review the actual document.

What is the most important clause?

Usually exclusivity, because it is the one that forecloses the future. An exclusive license can be worth more upfront and means you cannot license that data to anyone else, possibly ever. A non-exclusive license pays less per deal and leaves the asset intact for the next one.

Who owns a model trained on my data?

Whatever the derivatives clause says, which is why it deserves more attention than it usually gets. Data going into a training run and a model coming out of it are different assets, and an agreement that is silent on the second one has not left it unresolved in your favour. Decide it explicitly.

Is any clause actually required by law?

One is, if the deal relies on the data being de-identified under the CCPA. The statutory definition requires the business to contractually obligate any recipients of the information to comply with all the same provisions, including not attempting reidentification. Without that clause the data does not meet the definition, and the whole structure the deal rests on comes apart.

What happens to the data when the agreement ends?

Only what the agreement says happens. Deletion, certification of deletion, and whether anything already derived from the data survives termination are separate questions with separate answers. A term that expires while the copies persist is not really a term.

Originally published at www.advai.cloud/blog/what-is-in-a-data-licensing-agreement.

What de-identified actually means, and what it does not

Nova Solutions — Wed, 30 Sep 2026 09:09:21 +0000

It is the word every data licensing conversation turns on, and it is used loosely almost everywhere. In the two places it is defined precisely, it is a test with conditions rather than a description of effort.

Why one word carries the whole deal

In a data licensing arrangement, de-identified is not marketing language. It is the hinge the entire structure hangs on, because the CCPA states that personal information does not include consumer information that is deidentified or aggregate consumer information. Clear the definition and the privacy obligations built on personal information do not reach the data. Miss it, and they all do.

Which makes it worth knowing that four words get used interchangeably in ordinary conversation, two of them are defined in the statute, and they do not mean the same thing.

De-identified: a three-part test

Under Civil Code section 1798.140, subdivision (m), deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided the business that possesses it does three things.

Takes reasonable measures to ensure the information cannot be associated with a consumer or household.
Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify it, except to test whether its own deidentification process works.
Contractually obligates any recipient to comply with all of the same provisions.

Notice what is not technical

Only the first condition is about the data. The second is something you have to publish, and the third is a clause that has to appear in the agreement. A flawlessly scrubbed dataset that ships without those two has not met the definition.

Pseudonymized: the key still exists

The CCPA defines pseudonymization separately, at subdivision (aa): processing personal information in a manner that renders it no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures ensuring the personal information is not attributed to an identified or identifiable consumer.

Read that carefully and the difference is obvious. Pseudonymization assumes a key exists and is being kept somewhere safe. De-identification claims the link cannot reasonably be rebuilt at all. Swapping customer names for stable customer IDs is pseudonymization. It is a genuine safeguard, and it is not the same claim.

Aggregate: a different category, not a stronger one

Aggregate consumer information is defined at subdivision (b) as information relating to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device.

Then the definition adds a sentence that settles a very common misconception: aggregate consumer information does not mean one or more individual consumer records that have been deidentified.

So rolling records up into counts and averages is aggregation. De-identifying a million individual rows is not aggregation, however many rows there are. They are two separate categories with two separate tests, and only the statute's own words settle which one you are in.

HIPAA runs its own standard entirely

For protected health information none of the above applies. HIPAA sets its own de-identification standard at 45 CFR 164.514(b), with two routes.

Method	Rule	Where it is defined
Safe Harbor	Remove eighteen enumerated identifiers, and have no actual knowledge that the remaining information could identify a person	45 CFR 164.514(b)(2)
Expert Determination	A person with appropriate statistical and scientific expertise concludes the reidentification risk is very small, and documents the analysis	45 CFR 164.514(b)(1)

The two HIPAA de-identification methods

The eighteen identifiers include names, most geographic subdivisions, dates, telephone and fax numbers, email addresses, URLs, IP addresses, Social Security numbers, medical record numbers, device identifiers and serial numbers, vehicle identifiers, and biometric identifiers. Safe Harbor is used more often than Expert Determination, mostly because it is specified precisely enough to demonstrate.

What to do with this in a real negotiation

Define the term in the agreement itself. Do not let anonymized do load-bearing work when it has no statutory definition.
Check that the public commitment actually exists and is published, not just agreed internally.
Check the recipient-obligation clause is present and binds downstream recipients too.
Be honest internally about whether you have de-identified or pseudonymized. If someone in the building holds a key, you have pseudonymized.
If any of it is health data, stop and use the HIPAA standard with proper advice.

This post describes published statutory text. It is general information, not legal advice, and it cannot account for your sector or the specific records you hold. Have a lawyer look at the actual data before you agree to a definition in a contract.

Sources

Cal. Civ. Code 1798.140(m), definition of deidentified.
Cal. Civ. Code 1798.140(aa), definition of pseudonymize and pseudonymization.
Cal. Civ. Code 1798.140(b), definition of aggregate consumer information.
Cal. Civ. Code 1798.140(v)(3), personal information does not include deidentified or aggregate consumer information.
HIPAA Privacy Rule, 45 CFR 164.514(b)(1) and 164.514(b)(2), with de-identification guidance published by the US Department of Health and Human Services. ## Questions this post answers

What does de-identified data mean?

Under the CCPA it means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided the business takes reasonable measures to ensure it cannot be associated with a consumer or household, publicly commits to keep it that way and not attempt reidentification, and contractually obligates any recipient to do the same. It is a three-part test, not a description of how hard you tried.

Is de-identified the same as anonymized?

Not in US statutory terms. Anonymized is a common-usage word that appears in everyday conversation and in some non-US frameworks, but the CCPA does not define it. What the CCPA defines is deidentified, and that is the term that determines whether the privacy obligations apply. Using anonymized in a contract without defining it leaves the most important word in the deal undefined.

What is the difference between de-identified and pseudonymized?

Pseudonymization, defined separately in the CCPA, means processing personal information so it is no longer attributable to a specific consumer without the use of additional information, where that additional information is kept separately and protected. The link still exists. Someone holds the key. De-identification is the stronger claim that the link cannot reasonably be reconstructed at all.

Does aggregating the data count as de-identifying it?

No, and the statute is unusually direct about this. Aggregate consumer information means information about a group or category of consumers that is not linked or reasonably linkable to any consumer or household, and the definition ends by stating that it does not mean one or more individual consumer records that have been deidentified. They are separate categories with separate tests.

How does HIPAA define it differently?

HIPAA does not use the CCPA test at all. It provides two routes at 45 CFR 164.514(b): the Safe Harbor method, which requires removing eighteen enumerated identifiers and having no actual knowledge that what remains could identify someone, and the Expert Determination method, in which a qualified person concludes and documents that the reidentification risk is very small. If you hold health data, this is your standard, not the CCPA one.

Originally published at www.advai.cloud/blog/what-de-identified-data-actually-means.

Can a business legally license its own customer data?

Nova Solutions — Wed, 30 Sep 2026 09:06:53 +0000

The question almost every owner asks first, and the answer is more specific than either yes or no. It turns on one definition, and on what you did to the data before anyone else saw it.

The honest answer

Usually yes, but not in the form it is sitting in right now. There is no single federal statute that says a business may not license data it holds. What there is instead is a layer of state privacy law, a layer of sector-specific rules, and a layer of promises you have already made in your own documents. All three have to clear.

That is a more useful answer than a flat yes or no, because it tells you where the work is. Almost all of it happens before the data leaves your systems, and almost none of it is about the transaction itself.

Read this first

This is general information about published statutory text. It is not legal advice, it does not create any professional relationship, and it cannot account for your state, your sector, or the specific records you hold. Talk to a lawyer before relying on it.

What counts as a sale, and why the definition is so wide

California's Consumer Privacy Act is the most commonly cited reference point, and its definition of a sale is deliberately broad. Under Civil Code section 1798.140, subdivision (ad)(1), sell, selling, sale, or sold means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to a third party for monetary or other valuable consideration.

Two things in that sentence do more work than people expect. Making available is in the list, so you do not have to hand anything over for it to count. And monetary or other valuable consideration means a barter, a discount, or a credit lands in the same place as a cheque.

Where a transfer is a sale of personal information, consumers have a right to opt out of it under section 1798.120. That is not a fatal problem, but it is an operational one: you would be taking on an ongoing obligation to honor opt-outs against data you have already licensed to somebody else.

The mechanism the statute itself provides

The same statute supplies the way through. Section 1798.140, subdivision (v)(3) states plainly that personal information does not include consumer information that is deidentified or aggregate consumer information.

If the information is not personal information, the sale rules built on top of personal information do not reach it. That is the whole architecture, and it is why every serious data licensing arrangement is built around deidentification rather than around consent.

The catch is that deidentified is a defined term with three conditions, not a description of effort. Under subdivision (m), it means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided that the business possessing it does all of the following.

Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify it, except to test whether its own deidentification process works.
Contractually obligates any recipients of the information to comply with all of the same provisions.

The part people skip

Two of the three conditions are not technical. One is a public commitment you have to actually publish, and one is a contract term that has to bind every recipient. A perfectly scrubbed file that ships without them has not met the definition.

Health data is a separate regime, not a harder one

If what you hold is protected health information, none of the above is the governing test. HIPAA has its own deidentification standard at 45 CFR 164.514(b), and it offers two routes.

Safe Harbor, at 164.514(b)(2): remove eighteen enumerated identifiers, including names, most geographic subdivisions, dates, phone and fax numbers, email addresses, URLs, IP addresses, Social Security numbers, medical record numbers, device identifiers and serial numbers, vehicle identifiers, and biometric identifiers, and have no actual knowledge that what remains could identify a person.
Expert Determination, at 164.514(b)(1): a person with appropriate statistical and scientific expertise determines that the risk of reidentification is very small, and documents the analysis supporting that conclusion.

Safe Harbor is used more often simply because it is precisely specified and therefore easier to demonstrate. Neither route is something to attempt from a blog post. If you are in this category, the first call is to counsel, not to a broker.

Your own documents can be stricter than the law

This is the constraint that catches people, because it does not appear in any statute. Your privacy policy is a public promise. Your customer agreements are private ones. Your vendor contracts may restrict what you can do with data that passed through their systems.

A statute sets a floor. A promise you published sits above it, and nothing about a licensing deal erases it. If your privacy policy says you never share customer information with third parties, that sentence governs you regardless of how thoroughly you deidentified anything.

The practical sequence is therefore backwards from what most people expect. Read your own documents first. Then look at the statute. Then think about a transaction.

What a defensible version looks like

The copy that leaves is deidentified to a defined standard, not simply stripped of obvious names.
You have published the commitment the definition requires, not just made it internally.
Every recipient is contractually bound to the same conditions, including not attempting reidentification.
The license is non-exclusive and scoped, so you have not signed away the ability to use your own records.
You keep every original, in your own systems, unchanged.
Anything touching health, legal privilege, or children gets sector-specific advice before anything moves.

None of that is exotic, and none of it is fast. It is the difference between a transaction you can explain to a regulator, a customer, or an acquirer, and one you cannot. Again: this is general information about published rules, not legal advice. Before anything leaves your systems, have a lawyer look at your situation specifically.

Sources

California Consumer Privacy Act, Cal. Civ. Code 1798.140(ad)(1), definition of sell, selling, sale, or sold.
Cal. Civ. Code 1798.140(m), definition of deidentified and its three conditions.
Cal. Civ. Code 1798.140(v)(3), personal information does not include deidentified or aggregate consumer information.
Cal. Civ. Code 1798.120, the consumer right to opt out of sale or sharing.
HIPAA Privacy Rule, 45 CFR 164.514(b)(1) Expert Determination and 164.514(b)(2) Safe Harbor, with guidance published by the US Department of Health and Human Services. ## Questions this post answers

Is it legal to sell customer data?

Selling identifiable customer data is legal in many US contexts but heavily regulated, and under the CCPA it counts as a sale that consumers can opt out of. Licensing properly deidentified data is a different question, because the CCPA states that personal information does not include consumer information that is deidentified or aggregate consumer information. The work is in meeting the statutory definition of deidentified, not in the sale itself.

What counts as a sale under the CCPA?

The statute defines it broadly. Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration. Note the last five words: you do not need to be paid in cash for it to count.

Does deidentifying the data actually solve it?

It is the mechanism the statute itself provides, but it is a three-part test, not a single step. California requires reasonable measures so the information cannot be associated with a consumer or household, a public commitment to keep it deidentified and not attempt reidentification, and a contractual obligation on any recipient to comply with the same rules. Strip names and stop there and you have not met it.

What if my business holds health records?

Then a different and stricter regime applies. HIPAA sets out two methods for deidentifying protected health information: removing eighteen enumerated identifiers under the Safe Harbor method, or an Expert Determination that the reidentification risk is very small, documented by a qualified person. Health data is not a harder version of the same problem, it is a separate one, and it needs sector-specific advice.

Can my own contracts stop me even if the law allows it?

Yes, and this is the trap people miss. Your published privacy policy, your customer terms, and your vendor agreements may each promise things about how data is used. A statute setting a floor does not override a promise you made above it. Read your own documents before you read anyone else's.

Is this legal advice?

No. It is general information about publicly available statutory text, written for owners deciding whether the idea is worth exploring at all. Your state, your sector, and the specific data you hold all change the answer. Get advice from a lawyer before acting on any of it.

Originally published at www.advai.cloud/blog/can-a-business-legally-license-customer-data.

GEO vs SEO: what actually changed, with our own numbers

Nova Solutions — Wed, 30 Sep 2026 09:04:12 +0000

GEO is being sold as a new discipline with its own price tag. We looked at our own sites instead of taking anyone's word for it, and the numbers point somewhere more specific than a new service.

The pitch being sold right now

Search a term like "generative engine optimization services" and the results are a wall of agency listicles, several of them advertising specific numbers: hundreds of percent growth in AI citations, several-times return on investment, all at retainers in the $3,000 to $10,000-plus a month range.

We are not going to add our own version of that claim to the pile, and not because we do not care about the category. We simply do not have signed clients or documented results to cite, and we are not going to invent any. What we do have is our own measured data, across our own four sites, which is worth more here anyway: nobody has an incentive to make it look better than it is.

What we pulled, and from where

Google Search Console has a dedicated "Generative AI features" report, separate from the regular Performance report, that tracks how often a page shows up inside an AI-generated answer rather than a traditional blue-link result. It is a citation and visibility signal, not a click signal: AI Overviews are largely zero-click by design, the answer is often served without anyone visiting the page.

We first checked this report across four sites we run on 2026-09-05, and pulled it again today to see whether the pattern held or was a one-time artifact. It held, and every property grew.

The numbers, three weeks apart

Property	AI impressions (Sep 5)	AI impressions (Sep 28)	Growth	Top-cited page
Government-services directory	1,400	2,490	1.8x	A specific province's land-use and demographic page
Citizen-safety guide site	179	529	3.0x	A city-specific emergency-preparedness guide
B2B SaaS marketing site (this one)	83	235	2.8x	A cost breakdown for a specific market
Company homepage	43	55	1.3x	The homepage itself, brand-query dominated

GSC "Generative AI features" report, 90-day trailing window, both pulls

Two things stand out. Every property grew, in a range of 1.3x to 3.0x in three weeks, on a report we were not actively trying to move. And the ranking of which property grew fastest lines up almost exactly with how much factual, single-purpose reference content each one carries versus how much of the site is a pitch.

What gets cited is not what you would guess

On every single property, the pages with the most AI-citation impressions are not the homepage, not a service page, not a pricing page. They are the pages that answer one specific, factual question as directly as possible.

The government-services site's top page is a specific province's land-area, population, and land-use status, not its homepage or its product page.
The citizen-safety site's top page is a specific city's emergency-preparedness guide, not its app-download page.
This site's own top page is a cost breakdown for a specific market, not a service lander.
The one exception, the plain company homepage, is dominated by its own brand name being searched directly, which is a different mechanism entirely, not a counterexample.

This is the same pattern that already drives ordinary organic search on these same sites. Specific, well-sourced, clearly structured reference content wins both surfaces, because an AI system reading a page to decide whether to cite it is doing something close to what a search engine already does when deciding whether to rank it.

Why we do not sell GEO as its own line

If the work that wins AI citations is the same work that wins ordinary search, selling a separate "GEO package" alongside an SEO package means charging twice for one piece of work. We do not do that, and we say so plainly rather than staying quiet about it.

Showing up in AI answers is included in our Local SEO work: service-area pages, citations, on-page structure, and Google Business Profile upkeep, done every month. It is a feature of doing that work properly, not a separate line item with a separate invoice.

The honest version

If someone offers to sell you GEO as a stand-alone service with its own monthly fee, ask what it actually includes that good SEO does not already do. In our own experience building this, the honest answer is very little.

What this is not saying

This is not a traffic claim. AI Overview impressions are largely zero-click; a citation is a visibility signal, not a visitor.
The absolute numbers are still small everywhere except the government-services site. 55 and 235 impressions over 90 days are thin samples, not proof of a channel at scale.
This is a snapshot comparison at two points three weeks apart, not a rate we are tracking continuously. We would want a few more check-ins before calling the growth curve reliable.
None of this is a result we produced for a client. It is our own properties, measured by us, which is exactly why we can show it without violating our own rule against citing results we have not verified. ## Questions this post answers

What is GEO (generative engine optimization)?

GEO is the practice of structuring content so it gets cited inside an AI-generated answer, whether that is a Google AI Overview, a ChatGPT response, or a Perplexity summary, rather than just earning a ranked position in a traditional list of results.

GEO vs SEO: what is actually different?

Less than the terms suggest. SEO optimizes a page to rank for a search query. GEO optimizes a page to be the one an AI system quotes when answering a question. Our own data across four sites shows the same pages winning both: specific, factual, clearly structured content that answers one question directly. The audience differs (a search engine's ranking algorithm versus a language model choosing what to cite), but the actual work of building a good page is close to identical.

Will AI replace SEO?

Not in the sense of making it unnecessary. AI answer engines still need something to read and cite, and our own measured data shows they cite the same kind of page that already ranks well in ordinary search: clear, factual, well-structured content. SEO is not becoming obsolete. It is becoming the same work that also wins the AI-answer surface.

How do you get cited in Google AI Overviews or ChatGPT?

Based on what our own data shows across four sites: build a page that answers one specific, factual question clearly, with real structure (headings, direct answers, tables where they help) rather than a general pitch page. The pages that got cited in our numbers were reference and how-to pages, not landing pages or service descriptions.

Do you sell GEO as a separate service?

No, deliberately. We treat it as a feature of doing SEO properly rather than a separate line item, because the two are built the same way. Selling a GEO package on top of an SEO package would mean charging twice for one piece of work.

Originally published at www.advai.cloud/blog/geo-vs-seo-what-actually-changed.

Is missed-call text-back legal?

Nova Solutions — Wed, 30 Sep 2026 09:01:23 +0000

Short answer: yes, in the ordinary case. The longer answer is that three separate rule sets apply at once, and only one of them is actually a law.

The short answer

Texting back a person who just called your business, promptly, about the thing they called about, is the ordinary case and it is generally allowed. That is not a loophole. It is the least surprising thing you can do with a number someone dialed you from thirty seconds ago.

Where businesses actually get into trouble is not the text-back itself. It is what they put in the message, what they do when someone says stop, and whether they registered with the carriers at all. Those are three separate rule sets, they come from three different places, and only one of them is a law.

Read this first

This is general information, not legal advice. It describes publicly available FCC rules and one Supreme Court decision. It cannot account for your state, your industry, or what your particular message says. Talk to a lawyer before you rely on it.

First: a text is a call

The governing US statute is the Telephone Consumer Protection Act, 47 U.S.C. 227, with the FCC's implementing rules at 47 CFR 64.1200. People sometimes assume it covers voice only. It does not. In its 2003 TCPA Order the FCC confirmed that a text message is a call for TCPA purposes, so every consent rule written for calls applies to SMS as well.

That is the starting point, and it is why a text-back deserves five minutes of thought rather than none. It is also why a lot of the advice you will find written about phone calls is directly relevant to your SMS setup.

Where the consent comes from when someone calls you

The FCC's position here is old and it is stable. In its 1992 TCPA Order the Commission held that persons who knowingly release their phone numbers have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary.

A customer who dials your business has knowingly released their number to you, and they did it for the specific purpose of reaching you about a job. A reply on that subject is the most obviously invited message there is. This is the plain reason a text-back sits in a different category from a cold marketing blast to a purchased list.

The practical line

The consent you have is tied to why they called. Answer that. The further your message drifts from the reason they picked up the phone, the less the 1992 position is doing for you.

A federal court reached a version of the same conclusion on a phone call, not a text. In Butera v. Sugarhouse Real Estate Group, decided in the District of Utah on June 30, 2025, the plaintiff called the defendant's number back after a missed call and hung up without leaving a voicemail. When the business called him again the next morning, the court held that call was not unsolicited: a callback made in response to the plaintiff's own call was not an independent, unprompted solicitation under the do-not-call rules, because it is ordinary behavior to return a missed call displayed on a phone.

Where this does, and does not, reach

This is one district court, deciding a live phone call under the do-not-call "more than one solicitation" framework (47 CFR 64.1200(c), (f)(15)), not an automated text under the consent rules that actually govern a text-back. It is not binding outside that court, and it does not resolve the text-message question on its own. What it does confirm, from a different direction, is the same basic idea: responding to contact the other person started is not the kind of thing these rules were written to stop.

The autodialer question, after Duguid

The TCPA's strictest consent requirements attach to calls made with an automatic telephone dialing system. For years the scope of that phrase was genuinely unsettled, and courts disagreed about whether ordinary business software counted.

The Supreme Court resolved it on April 1, 2021 in Facebook, Inc. v. Duguid. The Court held that the statutory definition requires equipment that uses a random or sequential number generator. Facebook's login-notification system, which texted specific numbers tied to specific accounts, did not qualify.

A missed-call text-back is the same shape. It does not generate numbers at random or walk a sequence. It replies to the one number that just rang your line. On the federal definition, that is generally not an autodialer.

Do not over-read this

Duguid narrowed one prong of one statute. It did not repeal the marketing-consent rules, the do-not-call rules, the revocation rules below, or any state statute, several of which define autodialer more broadly than the federal one. It is a reason not to panic, not a reason to skip the rest of this page.

The line that moves everything: marketing content

The TCPA treats two kinds of message very differently. A message that is informational or transactional, answering the thing the person contacted you about, sits in one tier. A message that advertises or promotes sits in a stricter tier that requires prior express written consent, which is a specific, documented thing rather than an inference from behaviour.

This is the single easiest way to turn a defensible text-back into an indefensible one, and it usually happens by accident. Someone decides the auto-reply is wasted space and adds a seasonal discount to it. That one sentence can move the whole message into the tier that needed written consent you never collected.

Safer: sorry we missed you, what can we help with, when suits you for a visit.
Riskier: sorry we missed you, and ask about our spring tune-up special, twenty percent off this month.
The first answers the call. The second sells something they did not ask about.

STOP, and the ten business days

In February 2024 the FCC adopted an order strengthening a consumer's ability to revoke consent. It is the most operationally specific rule on this page, and compliance has been required since April 11, 2025.

A person can revoke consent in any reasonable manner. You cannot require them to use one exclusive channel or a particular magic word.
Replying STOP, or anything that reasonably conveys the same thing, creates a presumption that consent was revoked.
You must honor a revocation within a reasonable time, not to exceed ten business days from receipt.
After a revocation you are limited to a single confirmation message, and it must not contain marketing content.

For a text-back system specifically, the thing worth checking is whether opt-outs propagate. It is common for STOP to stop one campaign while another automation keeps messaging the same person from a different number. That is the failure mode this rule is aimed at.

A2P 10DLC: not a law, but it decides whether anything arrives

The last layer is not government at all. US carriers require application-to-person messaging sent from standard ten-digit numbers to be registered: a brand and a campaign, filed with The Campaign Registry, describing who you are and what you send. Unregistered traffic gets filtered or blocked.

Because it is a carrier rule rather than a statute, there is no fine to worry about in the ordinary case. The penalty is quieter and arguably worse. Your text-back appears to work in testing, the dashboard shows messages sent, and customers never receive them. If you have ever heard someone say their text-back stopped working for no reason, registration is the first thing to check.

Two different questions

Am I allowed to send this is a TCPA question. Will it actually be delivered is an A2P 10DLC question. You can be completely in the clear on the first and still have every message dropped on the second.

What this means if you are switching one on

Reply to the reason they called. Keep promotional content out of the automatic message.
Send it promptly, while the call is obviously the context for the text.
Identify your business in the message, so the recipient knows who is texting.
Make opting out easy, honor it everywhere, and well inside ten business days.
Register your brand and campaign for A2P 10DLC before you rely on delivery.
Check your state. Several states have their own texting statutes with definitions broader than the federal one.
If you handle health, financial, or legal matters, get advice specific to your sector before you automate anything.

None of this is exotic. It is the same instinct you would apply without any statute in front of you: answer the question they asked, do not sell them something they did not ask about, and stop when they say stop. The rules mostly just write that down and attach a deadline to it.

Sources

Telephone Consumer Protection Act of 1991, 47 U.S.C. 227; FCC implementing rules at 47 CFR 64.1200.
FCC, Report and Order, CC Docket No. 92-90, FCC 92-443 (1992), on persons who knowingly release their phone numbers.
FCC, Report and Order, CG Docket No. 02-278, 18 FCC Rcd 14014, 14115, para. 165 (2003), confirming that a text message is a call under the TCPA.
Facebook, Inc. v. Duguid, No. 19-511 (U.S. Apr. 1, 2021), on the definition of an automatic telephone dialing system.
FCC, Report and Order, CG Docket Nos. 02-278 and 21-402, FCC 24-24 (released February 16, 2024), on revocation of consent; compliance required April 11, 2025.
A2P 10DLC brand and campaign registration is administered by The Campaign Registry on behalf of US carriers. It is an industry requirement, not a federal rule.
Butera v. Sugarhouse Real Estate Group, L.C., 2025 WL 1798968 (D. Utah June 30, 2025), on a returned phone call not being an unsolicited call under 47 CFR 64.1200(c), (f)(15).

This post is general information about published rules. It is not legal advice, and it does not create any professional relationship. Before you rely on it for your own business, speak to a lawyer who can look at your state, your sector, and the exact wording of your messages.

Questions this post answers

Is it legal to text someone back automatically after they call my business?

In the ordinary case, yes. The FCC has held since its 1992 TCPA Order that a person who knowingly releases their phone number has in effect given permission to be contacted at that number, absent instructions to the contrary. Someone who dials your business has given you their number for exactly that purpose. The reply should stay on the subject of why they called.

Does the TCPA apply to text messages, or only phone calls?

Both. The FCC confirmed in its 2003 TCPA Order that a text message is a call for TCPA purposes, so the statute's consent rules apply to SMS the same way they apply to voice calls.

Does a missed-call text-back count as an autodialer under the TCPA?

Generally not, on the federal definition. In Facebook, Inc. v. Duguid the Supreme Court held in April 2021 that an automatic telephone dialing system must use a random or sequential number generator. A text-back does the opposite: it replies to the one specific number that just called you. That narrows one prong of the TCPA, but it does not switch off the marketing-consent rules or any state statute.

What happens if someone replies STOP?

You have to honor it. The FCC's 2024 consent-revocation order requires callers and texters to treat revocation made in any reasonable manner as valid, and to honor it within a reasonable time not to exceed ten business days. STOP creates a presumption that consent was revoked. After that you are limited to a single confirmation message, and it cannot carry marketing content.

Do I need A2P 10DLC registration for missed-call text-back?

For business texting from a standard US ten-digit number, yes in practice. A2P 10DLC is not a law, it is a carrier requirement: you register a brand and a campaign with The Campaign Registry, and the major US carriers filter or block unregistered application-to-person traffic. An unregistered text-back tends to fail quietly, which is worse than failing loudly.

Has a court actually ruled on returning a missed call?

Yes, though on a phone call, not a text. In Butera v. Sugarhouse Real Estate Group (D. Utah, June 30, 2025), a business's call back the morning after the plaintiff himself called the business's number and hung up without leaving a voicemail was held not to be an unsolicited call, because a callback in response to your own call is not unsolicited. It is one district court, on a phone call under the do-not-call rules rather than a text under the consent rules, but the underlying idea, that responding to contact someone else initiated is not itself unsolicited, is the same one running through this whole page.

Is this legal advice?

No. This is general information about publicly available FCC rules, one Supreme Court decision, and one district court decision, written for business owners deciding whether to switch a text-back on. Your situation, your state, and your message content all change the answer. Talk to a lawyer before relying on any of it.

Originally published at www.advai.cloud/blog/is-missed-call-text-back-legal.

The AI data economy just started paying small businesses too

Nova Solutions — Sun, 27 Sep 2026 02:06:44 +0000

Reddit, Shutterstock, and the Associated Press have already sold data to AI labs. Less visible: the same demand for real operational data is now reaching small businesses, in deals structured very differently from a publisher license.

The deals that already made the news

Over the past two years, several large publishers signed licensing deals with AI labs to let their content train models. Reddit struck an agreement with Google. Shutterstock has licensed image and caption data to multiple AI companies. The Associated Press signed a deal with OpenAI. None of the exact terms are fully public, but the pattern is consistent: a company that already has a large, structured archive of content licenses a copy of it, non-exclusively, for training use.

What's less visible is that the same underlying demand doesn't stop at publishers. Model developers need more than clean, professionally written text. They need messy, realistic examples of how work actually gets done: how a dispatcher schedules a service call, how a sales rep answers an unusual customer question, how an ops team handles an edge case a policy document never anticipated. That kind of data mostly lives inside small and mid-size businesses, not media companies.

Two real deals, further down market

Two licensing deals closed in this smaller, less visible tier of the market. Names are withheld below, both by request and because the terms one small business gets don't depend on the industry press knowing whose CRM it was.

Seller	Deal size	Terms	Time to close
A business with roughly $3 million in annual revenue	$100,000, paid upfront	Non-exclusive, de-identified license	3 business days
A manufacturer with fewer than 100 employees	Comparable terms	Non-exclusive, de-identified license	Similarly fast

Two closed data-licensing deals

Both deals were arranged independently by a data-licensing partner, not by Nova Solutions. We're describing them because they're real, verifiable proof that this category exists and moves fast, not because we closed them ourselves.

What “non-exclusive” and “de-identified” actually mean here

Non-exclusive: the seller can still license the same underlying data to a different buyer later. Nothing about the deal locks the data to one buyer forever.
De-identified: the buyer receives a processed copy with names, account numbers, and other identifying details stripped or masked before it ever leaves the seller's systems.
The seller's own systems and originals are untouched. Nothing about how the business operates changes after the deal closes.
Price and buyer are approved by the seller before anything moves. There's no obligation to accept an offer that comes in.

That structure is why the deal above closed in three business days: there was no negotiation over exclusivity, no migration of live systems, and no ongoing operational change to review. A one-time, de-identified export is a much smaller decision than it sounds.

Why this is happening now, not five years ago

Two things changed at once. First, the supply of freely usable, high-quality text on the open web is thinner than it was: a lot of it is now paywalled, licensed, or contested in litigation, and labs that scraped without a license are facing lawsuits over it. Second, the models themselves have gotten good enough at general language that the next gains come from realistic, domain-specific examples, not more generic text. Ordinary operational data, the kind that sits in a CRM or a dispatch log and was never written for an audience, is exactly that kind of example.

That's a different pitch than “your data is valuable,” which every business has been told for a decade. What changed is that there's now a real, structured buyer for a specific, narrow slice of it, at a price and speed that make it worth a business owner's actual attention.

What this means if you're the seller

If you're evaluating whether this applies to your own business, the two deals above suggest a rough shape: the categories most likely to have licensable value right now are manufacturing, freight and logistics, accounting, finance, insurance, distribution, construction, professional services, and retail, businesses where operational records reflect judgment calls a model can learn from. Healthcare and legal records are currently held out of this category entirely, pending buyer-side legal clearance on protected information.

We set up data licensing partnerships for businesses in the cleared categories above: preparing a de-identified sample, taking it to buyers, and letting the business approve the price and buyer before anything moves. If that's relevant to your business, it's worth a conversation even if nothing closes.

Questions this post answers

What does “non-exclusive” mean in a data-licensing deal like this?

It means the seller isn't locked into one buyer. The same underlying data could theoretically be licensed to a second buyer later, since the first deal doesn't grant exclusive rights to it.

Why would an AI lab pay for a small business's CRM data instead of just using public web data?

Public web text is thinner than it used to be, partly paywalled and partly contested in litigation over unlicensed scraping, and models have gotten good enough that the next gains come from realistic, domain-specific examples rather than more generic text. Ordinary operational records like CRM histories or dispatch logs are exactly that kind of example, and they mostly don't exist anywhere on the open web.

Who actually arranged the two deals described here?

Both were arranged independently by a data-licensing partner, not by Nova Solutions. They're described here as real, verifiable evidence that this category of deal exists and moves quickly, not as our own track record.

Originally published at www.advai.cloud/blog/ai-labs-licensing-small-business-data.

What is an AI OS? A practical definition

Nova Solutions — Fri, 25 Sep 2026 06:25:02 +0000

An AI OS is not a chatbot and not an agent framework. It is the connective layer between the messy state of your real business and the AI workflows you want to run on top of it.

The gap an AI OS fills

A common pattern among mid-size Philippine companies is saying, in the same breath, "we already use AI" and "we have no idea what our customers are actually doing." That is the gap an AI OS fills. It is not a chatbot. It is not even an agent framework. It is the connective layer between the messy state of your real business and the AI workflows you want to run on top of it.

This is the working definition I wish someone had handed me when I first sat down to design Nova AIOS. We will cover what an AI OS actually is, why Palantir Foundry is the canonical example, where the term breaks down, and what to look for if you are evaluating one for a PH or SEA enterprise.

A working definition

An AI OS, sometimes written AI Operating System or AIOS, is the layer of software that does four things.

Models the real-world things your business cares about (customers, loans, properties, students, transactions, equipment) as typed objects with relationships.
Provides a runtime for AI agents to read, reason about, and write to those objects.
Enforces a permission model deciding which agent, on whose behalf, can touch which object in what way.
Logs every action with enough fidelity to pass an audit, a regulator check, or a post-incident review.

Strip away the marketing and that is the whole shape. An ontology of business objects. A runtime that executes agents against them. A permission and audit layer that makes the result usable in regulated industries. If a vendor selling you an AI OS cannot show you, on a whiteboard, where each of those four pieces lives, you are buying a chatbot.

Note

An AI OS knows the state of your business. A chatbot only knows the sentence you just typed.

Why the term started showing up

Three things happened at roughly the same time in 2023 and 2024 that made AI OS a useful phrase. First, language models stopped being parlor tricks and started being usable as workflow engines. You could give a model a complex multi-step task involving structured data and it would actually finish.

Second, enterprises looked at the resulting work and realized something uncomfortable. Every team was building the same plumbing. Each new AI workflow needed its own data pipe, its own retrieval layer, its own observability, its own permission model. Twelve workflows meant twelve duplicated stacks of infrastructure.

Third, Palantir Foundry had been quietly proving for a decade that you could build the plumbing once, model your business objects once, and ride that foundation through hundreds of downstream AI use cases. The model worked. The price tag was usually north of $500,000 USD per year, which kept it inside the Fortune 100 and the US Department of Defense. The phrase AI OS emerged as shorthand for the Foundry shape, available to people who are not the Pentagon. That is what almost every credible vendor in this category is building today, including us.

The four layers, with examples

Layer 1, the ontology, is the typed model of your business. For a microfinance institution the core objects are Borrower (name, contact methods, KYC documents, credit history, language preference), Loan (principal, balance, schedule, status, arrears state, with a relationship back to Borrower), Payment (amount, channel, date, applied-to-loan reference), and CollectionsAction (channel, script used, outcome, timestamp, plus a compliance flag tied to RA 11765 and the SEC MC 18 collection-conduct rules).

Notice what is missing. There is no "chat message" object and no "document" object. The ontology is the things your business cares about, not the things your AI happens to produce. Documents and transcripts are inputs and outputs, not first-class objects. This sounds pedantic. It is the most important call you will make. Get it wrong and every downstream agent reasons about chat transcripts instead of loans, which means it can only make conversational decisions, not business ones.

Layer 2, the agent runtime, is where AI workflows live. It needs to read the ontology fully typed and fast (every loan and payment for a borrower in under 200 milliseconds), write to the ontology transactionally, and compose agents. A collections agent does not exist alone. It calls a payment-status agent, which calls a credit-history agent, which calls a sentiment classifier on the last three messages. The runtime decides what runs in what order and what each step is allowed to see.

Layer 3, the permission model, is not a feature. It is the difference between a tool you can ship to production and a science project. Can the collections agent see the borrower's health-related KYC notes? No. Can it see the outstanding balance? Yes. Can a customer-facing chatbot create a Payment object directly, or only suggest one for human approval? Depends on amount and channel. Can a marketing agent send promotional SMS to a borrower flagged as in arrears and sensitive? No, and the system should refuse to compose that message at all. This is the layer where RA 10173, RA 11765, and the BSP circulars live.

Layer 4, audit and observability, logs every agent action, every read, every write, every refused permission. Not in the casual "we have logs somewhere" sense. In the sense that a BSP examiner can sit down and reconstruct any decision the system made in the last 18 months. This is the layer most pre-2024 AI products skipped, and the reason most never made it past pilot in a regulated industry.

AI OS versus chatbot versus agent framework

Three things people sometimes call an AI OS that are not one.

A chatbot is a stateless conversational interface. It knows the current message and maybe a short rolling history. It does not know your business objects and cannot do an audited write to a loan record. It sits on top of an AI OS at best.
An agent framework like LangChain, LangGraph, or CrewAI is a useful tool for composing agents, but it gives you layer two and partial layer four while leaving layers one and three to you. Building an AI OS on top of one is reasonable. Calling the framework itself an AI OS is a category error.
A RAG pipeline grounds a model in your documents. It is not an AI OS for the same reason a document object is not a business object. RAG retrieves text; an AI OS reasons about typed state.

When you should adopt one, and when not

The honest test: if the same underlying business object will be touched by more than one AI workflow over the next 18 months, you need an AI OS. If only one workflow is on the roadmap, buy the single tool.

A 200-loan microfinance startup that wants AI collections, AI loan screening, and a customer-facing FAQ chatbot needs an AI OS. Same borrower, same loan, three workflows. Without a shared ontology, each workflow grows its own borrower model and they drift. An HVAC contractor with one phone line that misses after-hours calls does not need an AI OS. They need a missed-call text-back automation. Buy the single tool, and come back when you have three more workflows that need to share customer state.

How to evaluate an AI OS vendor

Five questions to ask before you sign anything.

Can you see the ontology in a UI, in plain language, before any agent is built? If the answer is "the ontology emerges from your data," walk away. A real AI OS makes the ontology explicit and editable.
Show me an audit log entry from a real customer, with PII redacted. If they cannot produce one in under five minutes, they have not shipped to a regulated customer.
What happens when an agent tries something the permission model forbids? You want a loud, audited refusal with an explanation. Not a silent skip. Not a hallucinated success.
Who owns the data residency? In the Philippines, "our data is in AWS Singapore" is sometimes acceptable and sometimes not, depending on the regulator. The vendor should know the difference for your industry.
What is the actual price after the first 90 days? Discovery and setup are usually quoted at a loss. The retainer for ongoing operations is where the cost lives. Ask for it in writing.

What an AI OS costs in the Philippines and SEA

Round numbers, as of mid-2026.

Foundry-tier US vendor: $500,000 USD per year and up. Includes professional services, but you are paying for the brand and the certification stack.
Mid-market US vendor: $80,000 to $250,000 USD per year. Usually a thinner version of the four-layer pattern with one or two layers stripped down.
Nova AIOS build: ₱150,000 for a single-product deployment, scaling to about ₱1.2M for a multi-product enterprise rollout, plus a monthly operations retainer typically between ₱50,000 and ₱200,000.
Build it yourself: free in cash, expensive in time. Twelve to eighteen months of senior engineering to reach a usable runtime. Often right for large banks. Almost never right for anyone below 500 employees.

The order-of-magnitude gap between US vendors and Philippine-built systems is not a quality gap. It is an engineering-economics gap. A senior Filipino ML engineer at a Philippine company costs about one-fifth of a senior ML engineer at a US enterprise software company. That ratio shows up in the price.

The mistake most teams make

They start with the agent. Someone reads a blog post about a clever agent, copies the pattern, gets a demo working in a week, then spends six months trying to plug it into their actual business. The agent works in isolation. Connecting it to real customer data, real permission rules, and real audit requirements is where the project dies.

The teams that ship to production start with the ontology. They map their Borrower, Loan, and Payment objects on a whiteboard, argue about field names for two days, and only then build the agent that reasons over them. The first version is dumber than the demo. The production version, three months later, is more useful by an order of magnitude. The ontology-first move is the single biggest predictor of whether an AI OS deployment makes it to production. If your vendor is not making you do the ontology work first, find a new vendor.

Originally published at www.advai.cloud/blog/what-is-an-ai-os.

We almost let our own automation cold-email its own founder

Nova Solutions — Fri, 25 Sep 2026 06:16:16 +0000

The fix was supposed to be a one-line merge. Looking at the actual rows before running it found a FOIA desk, two charities, and the founder's own inbox sitting in the send queue.

The plan was to merge the backlog forward

We were in the middle of repairing a broken cold-email queue on our own outreach pipeline. Part of the fix meant a backlog of contacts, stranded by the earlier bug, needed to rejoin the working pipeline. The plan, as written, was simple: merge the stranded backlog forward.

A merge like that is easy to trust. The rows had been collected before, the fields lined up, and the fix elsewhere was already done. Nothing about the plan looked risky on paper: it was a data operation, not new code, and data operations tend to get less scrutiny than the code around them.

The tempting move was to run it and move on. We did not do that. Before merging anything, we opened the actual rows and read them, the same way we would read the diff on a code change before shipping it.

What was actually sitting in the backlog

The list was not what a clean prospect backlog should look like. It contained a federal .gov address belonging to a FOIA desk, two charity addresses, an immigration legal-aid nonprofit, a support inbox for a hosting platform, and a placeholder address left behind by a website-builder tool.

The row that stopped us

One row in the backlog resolved to the founder's own email address. Had the merge run as planned, our own cold-email automation would have sent a prospecting email to its own founder.

None of these rows were ever real prospects. They were the accumulated residue of however the original list had been built over time: a scrape, a form submission, a support ticket, an address typed into the wrong field once and never corrected. A list assembled this way does not announce which rows are bad. It just sits there looking like the rest of the data, until someone reads it closely enough to notice.

A merge treats every row the same. It has no concept of "this one is a government agency" or "this one is us." Only a human looking at the actual data notices that some of those rows do not belong in an outreach queue at all, which is exactly why the step of looking cannot be automated away along with everything else.

A permanent filter, then the real migration

Instead of merging the backlog as it was, we built a junk filter first: rules to catch government and military domains, our own company's own domains, known platform-support domains, and common nonprofit signals. Only after the filter existed did we run the actual migration.

Backlog rows	Junk (filtered out)	Already known	Clean, migrated
163	7	33	123

The 2026-07-29 backlog migration, after the junk filter was in place.

Seven of 163 rows were junk by the filter's own rules. Thirty-three were contacts already known elsewhere in the pipeline. The remaining 123 were genuinely clean and migrated forward. The filter did not just catch the founder's own address. It caught six other rows an automation should never have been allowed to touch on its own.

The cheaper version of the same habit: look before you act

Reading 163 rows by hand does not scale, and it was never meant to be the permanent answer. The filter is the durable version of the same instinct: instead of a human reading every row every time, a fixed set of rules reads them automatically and refuses to pass through anything that matches a known-bad pattern, before a single message goes out.

The same habit shows up in a plainer form as a dry run: a mode where an automation reports exactly what it would do, to whom, and how many times, without actually doing it. A dry run over this backlog would have printed the founder's own address as a send target in plain text, which is a much cheaper way to catch the problem than finding out after the fact. Any automation that touches real addresses, real accounts, or real money is worth running once in a mode that only reports, before it is ever allowed to act.

Guardrails matter as much as retries

Most of the engineering attention that goes into an automation goes into making it run reliably: retries, error handling, logging, alerts when something fails. All of that matters. None of it would have caught this. The problem here was not that the automation broke. It was that it was about to work exactly as designed, on data nobody had actually looked at.

An automation inherits every defect already present in its inputs. "The list", whatever list it is, almost always contains something you would be embarrassed to act on automatically, because it was assembled over time by processes that were never built to guarantee it was clean. A gate that checks who an automation is about to touch, before it touches them, is not optional polish. It is as load-bearing as the retry logic everyone remembers to build.

We keep this filter in place permanently now, on every list that feeds this pipeline, not just the one that happened to catch a founder's own inbox. The cost is a few seconds of automated checking before anything sends. The alternative, on a bad day, is an automation doing exactly what it was told to do, to exactly the wrong address.

This is the same standard we hold any automation to, ours or one we build for someone else: before it runs unattended at volume, someone has actually looked at what it would touch, and a permanent check stands in that person's place going forward. A list is never as clean as it looks from the outside, and the automation running against it will not notice the difference on its own.

Questions this post answers

Why does an automated contact list need a human to look at it before it runs?

Because an automation inherits every defect already sitting in its input, and a list built up over time will always contain rows you would be embarrassed to act on automatically. In our case that meant a government address, charity contacts, and even the founder's own email, all queued for the same automated send.

What kind of "junk" ends up in a cold-outreach list?

Addresses that were never real prospects to begin with: government and institutional domains, nonprofit and charity contacts, platform support inboxes, placeholder addresses left over from tools like website builders, and occasionally an internal address that got swept in by accident.

What does a junk filter for an outreach automation actually check?

Ours checks for gov and mil domains, our own company domains, known platform-support domains, and common nonprofit signals, and excludes any row that matches before it ever reaches the send queue. It runs before volume, not after a complaint.

Does inspecting the data before automating it slow things down?

It costs the time it takes to look. In our case that was one migration pass across 163 rows before anything moved. A dry run that prints what an automation would do, without doing it, costs the same small amount of time and catches the same problems before they become an actual send.

Originally published at www.advai.cloud/blog/the-junk-filter-that-caught-us-cold-emailing-our-founder.

OCR document extraction for Philippine banks: what actually works

Nova Solutions — Sat, 19 Sep 2026 11:04:53 +0000

A BIR Form 2316 printed by payroll software and a Torrens title issued in 1974 are not the same kind of document. Treating them as one is why production accuracy collapses.

Two documents, two different problems

A BIR Form 2316 printed by payroll software and a Torrens title issued in 1974 are not the same kind of document. Not the same OCR accuracy profile, not the same preprocessing pipeline, not the same confidence threshold before the data lands in a KYC record.

The common pattern in Philippine bank OCR builds looks the same almost everywhere: scan or upload, run extraction, get a result. Demo accuracy looks fine, 88, 91, sometimes 94 percent. Then the system goes live. Failure patterns emerge that are specific to Philippine document types, completely predictable, and fixable, but only if you understand the problem before you build the pipeline.

The three-tier problem

Before you write a line of OCR code, know this: your corpus splits into three tiers that need completely different treatment.

Tier 1, machine-generated structured documents. BIR Form 2316, payslips from payroll software, system-generated PhilHealth MDR forms, GSIS UMID cards, passport MRZ zones. Fixed layout, printed text, consistent fonts, predictable field positions. With off-the-shelf tools you get 92 to 96 percent field-level accuracy on clean copies. "Clean copy" is doing a lot of work there: a 2316 folded three times, stapled to a payslip, and run through a flatbed scanner at 150 DPI is no longer clean. But for standard machine-generated versions, these are the most reliable documents in the stack. Build your happy path here.

Tier 2, scanned handwritten forms. Loan applications from rural branches, income declarations filled by hand. Accuracy drops hard, 60 to 75 percent character-level without preprocessing. That sounds acceptable until you realize a 75 percent accurate extraction of a bank account number produces a garbage number that looks real. Invisible error, catastrophic record. Preprocessing, binarization, noise removal, deskew, handwriting-specific model selection, can push this to 82 to 88 percent on clean handwritten documents. You will never reach Tier 1 accuracy, which means Tier 2 needs a different verification architecture regardless of model quality.

Tier 3, phone-photographed documents, where the most aggressive failure happens, and where the most volume is heading as banks add mobile onboarding. A phone photo of a Torrens title taken at an angle with a flash and a shadow across the bottom third: 40 percent accuracy baseline, maybe. Required preprocessing before any OCR: perspective correction, glare and shadow removal, contrast normalization, and resolution assessment with automatic rejection below 200 DPI equivalent. After that, accuracy on a clean government ID recovers to 78 to 88 percent. Still not Tier 1. Good enough for a first pass if you have human review flagging anything below threshold. Most deployments run the same model and threshold whether the input is a crisp 2316 or a phone photo of a 1982 title taken in Leyte. The demo number masks real production accuracy, which for banks with rural customers is often below 70 percent.

What works well

Philippine passports. The machine-readable zone is essentially 100 percent reliable with any decent OCR library. MRZ was engineered for automated reading. If your pipeline takes passport data, start there and treat it as ground truth.
GSIS UMID cards. Consistent layout, machine-printed text, modern card stock. 90 to 95 percent field accuracy on clean captures, handled well out of the box.
PhilHealth ID (post-2015 format). Same story as UMID. Fixed layout, machine-generated, high reliability.
BIR Form 2316 (machine-generated copy). Once you have trained a layout model on the current template, fixed-position fields like gross compensation, tax withheld, and employer TIN extract at 92 to 96 percent. The highest-volume KYC document for employed borrowers and the clearest automation ROI in the stack.
SSS ID (post-2019 biometric format). Reliable. Pre-2019 printed-card formats are Tier 2.

What does not work, and why

These are the documents where vendors demo beautifully on curated samples and fail embarrassingly in your production queue. Handwritten loan application forms from rural branches: the problem is not just handwriting, it is that the forms vary between branches and years, with different field positions and handwriting from neat block letters to barely legible cursive. Photocopied Torrens titles with carbon copy layers: multiple generations of photocopying pile artifacts onto the text until characters are partially overwritten by scan noise. PSA birth certificates in older formats use typewriter fonts with varying ink density and faded toner, and the layout changed several times across decades. And a BIR 2316 the moment a human hand touches it drops from Tier 1 to Tier 2. No exceptions.

Torrens titles: their own category

Torrens title extraction is a common place for vendor demos to look credible and then produce complete garbage in production. Torrens titles accumulate history physically. A title from 1965 may have handwritten margin annotations noting easements. The original TCT number may have been crossed out and replaced as lot partitioning occurred over decades. Stamps in Tagalog record registration. Owner names appear in Spanish-era conventions mixed with modern format. Carbon copy layers create ghost text sitting directly on top of primary content. That is all before physical condition: humidity damage, fold lines, edge fraying, faded ink. No off-the-shelf model was trained on this.

Preprocessing first. Deskew to correct rotational distortion, denoise to reduce scan artifacts, normalize contrast to pull faded text out of the background, and for carbon copy artifacts, a descreen filter to remove the moiré pattern from scanning a copy of a multipart form.
Multi-zone parsing. The primary record area (TCT number, registered owner, lot and technical description) is structurally different from the margin annotations and the stamp area. A single unified model fails on all three. You need a zone detector that identifies which region it is reading, then applies the appropriate logic per zone.
Human review for anything issued before 1985. Not a crutch, an architectural requirement. Quality variance for pre-1985 titles is too high to accept machine extraction without review. Getting a collateral document wrong in a loan file is not recoverable with a model update. Build the review queue from day one.

Note

Ask any vendor demoing Torrens title OCR: what was the issuance year range of the titles in your test set, and what was your scan-quality selection criterion? If they cannot answer precisely, the accuracy number they are quoting is fiction.

BSP KYC compliance and the audit trail

This is where most builds miss something that matters more than accuracy rates. BSP's KYC framework requires that customer identification and verification be auditable: you must demonstrate what data was collected, how it was verified, and who was responsible. For an automated pipeline that translates into three things you must build.

A confidence threshold, not just a confidence score. Every extraction produces a score; most teams look at it in logs. You need a hard threshold below which the extraction does not pass to the KYC record automatically and routes to human review. The threshold depends on document type and risk tolerance, but it must exist and be documented.
A review queue integrated into the same application. The KYC officer sees extracted text alongside the original image, corrects errors, and confirms. Built into the runtime, not a spreadsheet or an email chain. Same application, same session, same record context, with the correction tracked as a discrete action by a named user.
An immutable audit log. Every document gets a record: original extraction result, confidence score, whether it was auto-approved or reviewed, reviewer identity and timestamp, and any corrections. Append-only. BSP examiners will want to see this. "The system extracts it" is not an audit trail.

It is common to find OCR implementations with none of these three elements, even when the underlying accuracy metrics look good internally. An implementation like that would fail a compliance audit on the audit trail question alone.

The practical KYC stack for mid-size banks

If you are a thrift, rural, or savings bank rather than BPI, BDO, or UnionBank scale, you do not need an enterprise OCR platform. You need something proportionate. Use a managed document AI service for structured government forms: 2316, PhilHealth ID, UMID, SSS ID, passports. High-volume, high-reliability, pre-built processors, low per-page cost. You are calling an API, not maintaining a model.

Use a custom layout parser for Torrens titles and pre-standardization documents. This is where you need local development, not because the engineering is hard but because training data for Philippine Torrens titles in various conditions does not exist inside any US vendor's model. You need a team with access to real samples who can label them and understands the physical history of what they are looking at. Add a human review queue in the same web application: reviewer sees the image and extracted fields side by side, corrects, confirms, and confirmation writes to the audit log automatically.

This stack handles 85 to 90 percent of KYC document volume automatically at most mid-size banks. The remaining 10 to 15 percent, complex titles, handwritten forms, damaged documents, routes to review without blocking the pipeline. A full enterprise OCR platform typically costs $40,000 to $150,000 annually for a mid-size deployment plus implementation. The managed-service-plus-custom-parser-plus-review-queue approach costs $800 to $3,000 per month in API fees plus a one-time build of ₱350,000 to ₱700,000 for the custom Torrens parser and review interface. For a bank processing 500 to 2,000 KYC documents per month, the pragmatic stack is both cheaper and better suited to the actual document mix.

Test set requirements before you go live

Your pre-launch test set must come from your actual production corpus, not a curated demo set. That means titles from the 1960s and 1970s, not just recent ones. Handwritten loan forms from your rural branches, not just clean printed versions. Phone photographs taken under realistic branch lighting, not studio-quality captures. SSS IDs from 2008, not just 2024. Run your accuracy metrics on those. If your vendor's numbers collapse on real samples, you have found your actual production accuracy before it finds you.

Test the failure modes explicitly too. What happens when a document is rotated 15 degrees? When a title has a hand-drawn border around a corrected field? When someone submits a screenshot of a PDF instead of the original scan? Your pipeline's behavior on bad input is as important as its accuracy on good input.

Originally published at www.advai.cloud/blog/ocr-document-extraction-philippine-banks.