Personalization has a boundary. Where is it?

Two messages can use exactly the same customer data and land completely differently. "Your usual order is ready to repeat" reads as helpful. "You buy this every Tuesday" reads as surveillance.

The data is identical. What changed is whether the customer feels served or studied.

That is the central problem with personalized messaging. Relevance is valuable, but relevance can become uncomfortable when the message reveals more about the customer's behavior than they expected the business to know.

Good personalization should feel like the business understands the context. Bad personalization makes the customer aware of the machinery behind that understanding.

The test that actually works

Personalization stays comfortable while it uses information the customer knowingly gave you, for a purpose they would recognize as the reason they gave it.

An order they placed, a booking they made, a preference they set: all fair, because the customer remembers handing it over. Behaviour they did not realize was being recorded, or data stitched together from somewhere else entirely, is where it turns.

This is not a universal legal test. Privacy and direct-marketing rules vary by jurisdiction and depend on the type of data, how it was collected and what the business is doing with it. But as a product and messaging principle, customer expectation is a useful starting point.

The ICO's current direct-marketing guidance makes a similar distinction from a compliance perspective: profiling can make marketing more relevant, but organizations should be fair and transparent about profiling, explain how information is used, and consider whether customers would reasonably expect information from other sources to be combined into a profile.

• Given: They typed it, chose it or bought it. Use it freely.
• Observed: You inferred it. Use it to decide what to send, not to prove what you know.
• Acquired: It came from elsewhere. Referencing it directly is almost always a mistake.
• Sensitive: Health, finances, location. Precision here reads as a threat, not a service.

The distinction between "given" and "observed" is especially useful. A customer may be comfortable with a business remembering something they explicitly told it, while feeling very differently about a prediction derived from several behaviors they never consciously connected.

And the source matters. Information collected directly during a purchase or account interaction has a different context from information obtained from a third party or combined from unrelated sources. The more distant the information is from the original customer interaction, the more carefully the business should consider whether using it will feel expected.

Say less than you know

The most practical rule is to let context shape the message without narrating it. Use what you know to pick the right moment, the right offer and the right channel — then write the message as though you knew only the obvious.

Use everything you know to decide what to send. Show almost none of it in what you actually say.

This is the difference between personalization and personalization theatre. The customer does not need to know that a model identified their preference, that a system scored their likelihood to buy, or that several behavioral signals were combined to select the message. They need the message to be useful.

A retailer can use purchase history to decide which products to recommend without telling the customer exactly how often they bought them. A travel company can use a previous booking to make a relevant suggestion without listing every destination the customer searched. A messaging platform can use engagement signals to choose the right delivery time without announcing that it has been monitoring the customer's activity.

The best personalization is often invisible. Its effect is visible in the usefulness of the message, not in how much customer data the message manages to expose.

Personalization should reduce effort, not increase awareness

There is another useful way to think about the boundary: personalization should make the customer's next decision easier.

If knowing a customer's history allows a business to remove irrelevant choices, surface a useful reminder or make an offer more relevant, the customer benefits from the data without having to think about the data itself.

But if the personalization makes the customer stop and ask, "How do they know that?", the system has created a new problem. The customer is no longer thinking about the product or service. They are thinking about the business's access to their personal information.

That shift can happen with surprisingly small details. Mentioning an exact browsing pattern, a repeated habit, a precise location or a sensitive personal circumstance can expose the underlying data relationship even when the message itself is technically accurate.

The more sensitive the data, the higher the bar

Not every piece of customer data carries the same psychological or privacy risk. Purchase history for a routine product is different from information about health, finances, precise location or other sensitive circumstances.

The ICO explicitly warns that profiling can become more intrusive depending on the type and amount of information involved, and that special-category data requires particular care.

That means personalization should become more conservative as the sensitivity of the underlying information increases. In many cases, the right decision is not to expose the information at all—even if using it internally could make the message more targeted.

A useful principle is proportionality: the more sensitive the inference, the less directly it should appear in a customer-facing message.

When you get it wrong

Crossing the line rarely produces a complaint. It produces an opt-out, or worse, a quiet decision that this business is a bit creepy — which no dashboard will ever show you.

That asymmetry is the argument for caution. A message that is slightly less targeted costs a little performance. A message that feels invasive costs the customer.

And there is a second cost: trust. Once a customer becomes uncertain about how a business knows something about them, every future message can be interpreted through that uncertainty. Personalization that was intended to increase relevance can instead make the entire communication relationship feel less transparent.

That is why privacy should not be treated only as a compliance question. It is also a messaging-design question. The ICO recommends a data-protection-by-design approach to direct marketing and emphasizes that organizations should be clear about how customer information is collected and used.

The practical answer is not to stop personalizing. It is to personalize with restraint. Use customer data to improve timing, relevance and usefulness. Avoid turning hidden observations into explicit statements. Give customers control over marketing preferences. And when you are unsure whether a detail will feel helpful or invasive, leave it out.

The best personalized message does not make the customer think about the data behind it. It makes them think, "That was useful."