Your marketing team wants deeper personalization. Your legal team is accountable for every piece of customer data that personalization runs on. Most organizations treat that as a tug of war.

It isn’t one.

Privacy discipline and good personalization want the same thing: data you know you have, collected for a reason the customer understands, used in a way you’d be comfortable explaining.

Get privacy right and you end up with cleaner, consented customer data. Cleaner data is what makes personalization accurate instead of creepy.

But getting there takes more than a cookie banner. Here’s what governs personalization now, and four steps that let marketing and legal agree on which data to use and how.

The rules that govern personalization now

When this post first ran in 2019, GDPR was the headline. It still sets the bar for much of the world. But it’s no longer the only rulebook you’re working from, and it’s changing too.

In the European Union, GDPR governs how you collect and use personal data, and the ePrivacy Directive governs cookies and similar trackers. That split may not last. In November 2025 the European Commission proposed the Digital Omnibus, which would move cookie consent rules into GDPR and exempt some low-risk uses from consent. It’s still working its way through the European Parliament and Council. Plan for it, but don’t build on it yet.

In the United Kingdom, the Data (Use and Access) Act has amended UK GDPR. It adds a new lawful basis and changes the rules on when you can reuse personal data for a new purpose (more on both in step 2).

In the United States, there’s still no comprehensive federal privacy law. Instead, about 20 states have comprehensive consumer privacy laws in effect, with more signed and waiting to take effect. The IAPP’s US state privacy legislation tracker keeps the current count. A growing number of those states require you to honor browser-level opt-out signals such as Global Privacy Control.

Everywhere else, the picture is just as busy. DLA Piper’s Data Protection Laws of the World handbook covers more than 160 jurisdictions. Some go beyond notice and consent and restrict where personal data can be stored or transferred, which matters if a single campaign runs across several markets. Regulated industries add another layer on top: first-party data in financial services and healthcare marketing under HIPAA each come with their own constraints.

The practical upshot? If you personalize across regions, you’re building to the strictest rule that applies to each customer, not to one global standard. That’s a legal judgment as much as a marketing one, so get your privacy counsel’s read on how these rules apply to you before you change anything.

Step 1: Know what personal data you collect and where it flows

You can’t personalize responsibly with data you can’t find.

At enterprise scale, customer data lives in more places than anyone expects: your CRM, your customer data platform, analytics, ad platforms, email tools, partner data feeds, and every form on every domain and subdomain you run. Each system usually has a different owner, too.

Under GDPR, keeping track of this isn’t optional. Article 30 requires most organizations to keep records of processing activities, with a limited exemption for some organizations under 250 employees. A full personal data inventory goes further than that legal minimum. I think it’s the version you actually want. The glossary entry on personal data inventories and data maps walks through the method.

Start with your digital footprint:

  • Domains and subdomains
  • Forms
  • Cookies and other trackers
  • Third-party analytics and tracking (Google Analytics, ad pixels)
  • Social share widgets and other embedded third-party content
  • IP addresses

Then list the personal information each touchpoint collects, such as names, home addresses, personal or work email addresses, identification numbers, location data, IP addresses, cookie IDs, and workplace or education details.

As you go, include elements that help you qualify your data. Record who owns it, where it lives, whose data it is, how it was collected, what it’s used for, who can access it, how long you keep it, and your policy for deleting it.

Don’t try to build this by hand. An estate with hundreds of forms and tags needs automated discovery, or the inventory is out of date before you finish it.

Step 2: Tie every personalization use to a purpose and a lawful basis

The old marketing instinct was to collect everything and work out the use later. Privacy law reverses that. Before you use a piece of customer data for personalization, you should be able to answer two questions: why do we need this, and what gives us the right to use it?

The first question comes from the purpose limitation principle. As the UK Information Commissioner’s Office explains it, you have to be clear about your purposes from the start, record them, and tell people what they are. If you want to reuse personal data for something new, the new use has to be compatible with the original purpose. The rules are stricter for data you collected on the basis of consent.

The second question is about lawful basis. GDPR Article 6 sets out six of them:

  • You have consent to process the data
  • You need to process it to fulfill a contract with the data subject
  • You have to process it to comply with a legal obligation
  • You have to process it to protect someone’s vital interests
  • You need to process it to perform a task in the public interest or an official function
  • Processing is necessary for your organization’s legitimate interests, and those interests aren’t outweighed by the data subject’s rights

The UK now has a seventh, recognised legitimate interests, which covers a short list of purposes such as crime prevention and safeguarding. Marketing isn’t on that list, so it changes little for personalization.

Where does consent fit? It’s one basis among six, but it’s the one personalization leans on most, especially anything that depends on cookies or tracking across sites. Consent has to be freely given, specific, informed, and as easy to withdraw as it was to give. A pre-ticked box doesn’t count.

Your customers are paying attention to how you handle this. In Cisco’s 2024 Consumer Privacy Survey of more than 2,600 consumers in 12 countries, 75% said they won’t buy from organizations they don’t trust with their data.

With the inventory from step 1 in hand, audit each data type:

  • How do we use this data today?
  • Which lawful basis covers that use?
  • Do we actually need it?
  • Does using it give the customer a better experience?

Anything that fails those questions goes.

You end up with a smaller, cleaner set of customer data, and that’s the set worth personalizing with.

Step 3: Be transparent about how you use customer data

Once you know what you have and why, tell people. Transparency covers two kinds of content. There’s what the law requires you to communicate, and there’s what builds trust beyond that.

What are you legally required to communicate?

It depends on where you and your customers are located. But it usually includes some mix of the following:

  • Privacy policy
  • Cookie banner and cookie policy
  • Data breach policy
  • Third-party access to customer/user data
  • Users’ rights to their data
  • Details for consent (how can users give, withdraw, or decline consent?)
  • Compliance statement with your local regulations
  • Terms and conditions for use of your product/service

What should you communicate?

Ashley Stirrup, then chief marketing officer at Talend, put the customer’s side plainly. If customers share their data, they want to know they can trust you: “that you're not going to use it for the wrong purposes, you're not going to resell it and you’re not going to give it to the wrong people.”

You can go well beyond what the law requires to earn that trust:

  • Publish a plain-language data privacy FAQ on your website
  • Give customers a preference center where they can see and change what they’ve shared
  • Honor opt-out signals such as Global Privacy Control everywhere, not just where the law requires it
  • Walk users through your third-party requirements, and hold third parties to a data privacy culture aligned with your own
  • If you have a data privacy roadmap, consider making it public so users can see your progress
  • Explain the data privacy and ethics training your customer-facing teams go through
  • Release information on your internal data privacy policies and standards
  • Make it easy for users to submit feedback or complaints

Step 4: Make new data uses a shared decision

This is the step most organizations skip. I’d argue it’s where the marketing-versus-legal tension actually lives.

Steps 1 through 3 give you a clean starting point. But personalization doesn’t stand still. Someone wants to add a partner’s audience data, test a new segment, or feed customer history into an AI model that writes personalized offers. Each of those is a new use of personal data, and each one reopens the questions from step 2.

If marketing makes those calls alone, legal finds out after launch. If legal reviews every request from scratch, marketing waits weeks for an answer.

Neither works.

What works is a process both teams agree on in advance:

  • Marketing proposes the new use in writing: what data, what purpose, which customers, which markets.
  • Privacy or legal confirms the lawful basis and whether the use is compatible with what customers were told.
  • Both teams record the decision in the inventory from step 1, so the next request starts from what’s already approved.
  • You review approved uses on a regular cycle, because laws, vendors, and campaigns all change.

Partner and co-marketing data deserves extra care. Data that came from someone else’s customers carries someone else’s consent, and that consent may not cover what you want to do with it.

AI-driven personalization raises the stakes further. Using customer data to train or run a model is a purpose in its own right, so treat it like any other new use. Check that it’s compatible with what you collected the data for, say so in your privacy information, and decide what data the model actually needs. Pseudonymized or aggregated data is often enough for segment-level personalization, and it exposes far less if your data security ever fails. The same thinking sits behind privacy-first analytics, which measures behavior without tracking individual users.

Clean data + transparency = more effective personalized marketing

So where does all this leave personalization? In a better place than where it started.

When customers trust how you handle their data, they share more of it. That’s the return on everything above. Give ongoing value to the customers who give you their data, and they’ll give you more, which lets you serve them better again.

Netflix is the familiar example. It uses what you watch, search for, and abandon to recommend titles and personalize what you see, down to the artwork shown for each title. Most subscribers are happy with that trade because the value shows up every time they open the app.

You don’t need a full data profile to get there, either. Personalization at scale often works best with modular content built on the behavioral data you already have.

Before you launch any personalized experience, ask one question: is this use of customer data consistent with everything we’ve told customers about how we handle it? If the answer is yes, go ahead. If you have to think about it, go back to step 4.

Take away

Privacy and personalization were never really opposed. Know your data, tie every use to a purpose and a lawful basis, tell customers what you’re doing, and make new uses a joint decision between marketing and legal.

Do that, and the trade-off mostly disappears. What’s left is personalization your customers expect and your legal team can defend.