AI Personalisation in Marketing: Levels, Data Rules and How to Start

AI personalisation means using data and machine learning to tailor what each customer sees: the content, offers, products and timing. Done well it makes marketing more useful, because people get what is relevant to them. Done badly it feels intrusive, breaks privacy law or simply guesses wrong. The safe route is first-party data, clear consent, simple tests and a limit on how far you go.

Personalisation is one of the most promising uses of AI in marketing and one of the easiest to get wrong. This guide explains the levels of personalisation, the data it needs, practical use cases, the privacy rules in the UK and India, how to build it step by step, how to measure whether it works and where to stop. For the wider AI context, see our AI marketing guide. For data foundations, see our guide to first-party data strategy.

Levels of personalisation

Level	What it does	Example	Data needed
1. Basic	Uses simple fields	"Hi Priya" in an email	Name
2. Segment-based	Groups people by shared traits or behaviour	Different emails for new and returning customers	Purchase history, sign-up source
3. Behavioural	Reacts to recent actions	Reminder about a product someone viewed	Browsing and basket events
4. Predictive	Estimates likely needs or actions	Recommending items based on similar customers	Rich history across many customers
5. Real-time, one-to-one	Adapts content for each person as they interact	A site that reorders products for each visitor	Live data and strong consent

Most businesses get the best return from levels 2 and 3. Higher levels need more data, more engineering and more care with privacy, and the gain over the lower levels is not guaranteed. Start where you can do it well.

Where personalisation pays off

• Welcome and onboarding. A message tailored to why the person signed up.
• Product and content recommendations. "People who bought this also bought" or "read next" suggestions.
• Triggered reminders. Basket and browse reminders, restock alerts, renewal notices.
• Lifecycle messages. Different content for new customers, loyal customers and lapsed customers.
• Site experience. Showing local store information, relevant categories or language.
• Ad creative. Matching messages to audience needs. Ad platforms increasingly do this for you using AI.
• Service and support. Giving an agent or assistant the customer's history, so they do not ask again.

The data you need, and where it comes from

Data type	Source	Notes
Zero-party	Information customers volunteer: preferences, goals, sizes	The best quality. Ask simple questions and use the answers
First-party	Your own records: purchases, enquiries, site and app behaviour, support history	Reliable and under your control. Needs consent and care
Second-party	Another company's first-party data shared by agreement	Needs contracts and consent coverage
Third-party	Purchased or aggregated data from brokers	Quality, consent and legality can be doubtful. Be cautious

The strongest personalisation rests on first-party and zero-party data. Google decided in 2024 not to phase out third-party cookies in Chrome, and later retired the Privacy Sandbox APIs, but privacy rules, browser limits and customer expectations still favour using data people knowingly gave you. See our first-party data strategy guide.

Privacy and consent rules

United Kingdom

The ICO's guidance says you must not send marketing emails or texts to individuals without specific consent. There is a limited exception, the soft opt-in, for your own previous customers, if you got their details while selling to them, you only market similar products or services, and you gave a clear chance to opt out when you collected the details and in every message. It does not apply to prospects or bought-in lists. Personal data use also needs a lawful basis under UK GDPR.

India

India's Digital Personal Data Protection Act, 2023 and the Rules notified in November 2025 require a clear consent notice that explains the specific purpose, with an itemised list of the data collected, and provide for withdrawal of consent and a phased compliance period. If you serve Indian customers, review how you ask for and record consent.

Practical rules

• Tell people what you collect and why, in plain language.
• Collect only what you will use.
• Make it as easy to withdraw consent as to give it.
• Check the terms of any AI tool that processes customer data, and take legal advice for your situation.
• Avoid inferring sensitive characteristics, such as health or finances, from behaviour for marketing purposes.

How to build personalisation step by step

1. Pick a journey, not everything. Choose one moment where relevance clearly matters, such as the first purchase or a lapsed customer.
2. Define the goal and metric. For example, increase second-purchase rate within 60 days.
3. Audit your data. What do you have, is it accurate, and do you have consent to use it for this purpose?
4. Create a few segments. Three to five meaningful groups beat dozens of thin ones.
5. Write the variations. Different message, offer or content for each segment. AI can draft variants for human review.
6. Test against a control. Keep a group that receives the standard experience, so you can see the real effect.
7. Roll out gradually. Expand where the test beats the control.
8. Review regularly. Check whether the segments still make sense and whether the results hold.

Recommendation systems, in plain words

Recommendation engines suggest items based on patterns in behaviour. The common approaches:

• Popular items. Show what sells well. Simple and a good baseline.
• Similar items. Show products that resemble what someone viewed, based on attributes.
• People like you. Show what customers with similar behaviour bought or read.
• Rules plus AI. Combine business rules, such as in-stock only, margin floors and exclusions, with model scores.

Always compare a recommendation against a simple baseline such as popular items. If a complex model does not beat it, it is not worth the cost.

Using generative AI for personalised content

Generative AI can draft many message variants and adapt tone for different audiences. Guidelines:

• Give it approved facts, brand voice rules and examples, and forbid invented claims.
• Keep a person in the approval path for anything customer-facing, at least until sampling shows consistent quality.
• Do not feed it personal data unless the tool is approved and covered by your privacy terms.
• Test variants against each other and a control, instead of assuming that a tailored message is better.

Measuring whether it works

Measure	How
Uplift over control	Compare the personalised group with a holdout that gets the standard experience
Revenue per recipient or visitor	More meaningful than clicks alone
Margin and returns	Check that personalised offers are not just discounting profitable sales
Customer signals	Unsubscribes, complaints, opt-outs and satisfaction scores
Long-term effect	Repeat purchase and retention over months, not days

Be careful with attribution. Personalisation often targets people who were already likely to buy, so a simple before-and-after comparison can overstate the result. Holdout groups are the honest test.

Where to stop: avoiding the creepy line

People like relevance and dislike feeling watched. A useful test is to ask: would the customer be comfortable if we told them exactly how we knew this? Guidelines:

• Use data customers knowingly gave you, or that they would expect you to use.
• Do not reveal sensitive inferences, such as health conditions, pregnancy or financial trouble.
• Do not follow people across channels with the same message at high frequency.
• Offer a visible way to change preferences or turn personalisation off.
• Avoid price discrimination that customers would find unfair if they knew.

A small business version

You do not need a data science team. A small shop could:

1. Ask new subscribers one question: "What are you shopping for?" and store the answer.
2. Send a welcome series tailored to that answer.
3. Send a reminder about viewed products and abandoned baskets, using the features in the email platform.
4. Run a monthly "we miss you" message to customers who have not bought in 90 days, with a clear, honest offer.
5. Test each against a small holdout and keep what works.

Common mistakes

• Personalising with poor or outdated data.
• Splitting audiences into too many tiny segments.
• No control group, so the lift is imaginary.
• Using personal data in tools without checking terms or consent.
• Making unsupported inferences about people.
• Chasing real-time one-to-one before mastering basic segments.
• Ignoring the signals that customers dislike it.
• Treating personalisation as a tool, not a programme with an owner and metrics.

A worked example: a tailored welcome series

This is an invented example. A UK online tea shop wants to improve second purchases. New subscribers choose one preference at sign-up: "loose leaf", "tea bags" or "gifts". The shop builds three versions of its welcome series.

Segment	Email 1	Email 2	Email 3
Loose leaf	How to brew loose leaf well, with a short video	Three beginner-friendly blends and why they suit new drinkers	A small first-order offer on a sampler
Tea bags	Our best everyday teas and how they differ	Subscription option for regular orders, with honest savings	A reminder of delivery and returns terms
Gifts	Gift ideas by budget and occasion	Delivery cut-off dates for gifts, clearly shown	A gift guide with real customer reviews

The shop keeps a 10 percent holdout who receive the standard series. After 90 days it compares second purchases, revenue per subscriber, unsubscribes and complaints. This is a simple level-two personalisation, built on information customers chose to give, and tested properly.

A personalisation roadmap by maturity

Stage	What you have	Next step
Starting	A list and basic purchase data	Add one preference question. Build a welcome series by segment
Developing	Consistent tracking and a CRM	Behavioural triggers: browse, basket, post-purchase and win-back
Maturing	Reliable segments and results from tests	Product recommendations and predictive scores, validated against a holdout
Advanced	Rich data, strong consent and engineering support	Real-time site personalisation, always with an opt-out and ongoing testing

Data quality checks before you personalise

• Duplicates. One person with three records gets three messages.
• Stale fields. A preference given three years ago may no longer apply. Consider a periodic preference check.
• Wrong merges. Mixing records for different people causes embarrassing errors.
• Missing consent flags. Make sure every contact's permission status is current in every tool.
• Test records. Remove internal and test addresses from live sends.
• Sensitive data. Do not use sensitive categories of information for targeting without a lawful basis and strong reasons.

Personalisation in B2B marketing

In B2B, personalisation usually works at account and role level instead of individual behaviour.

• By role. A finance director cares about cost and risk, while an operations lead cares about delivery and integration. Tailor proof and messages.
• By industry. Show relevant case studies and terminology.
• By stage. Early research content for new contacts, comparison and proof for evaluators, implementation detail for late-stage buyers.
• By account. For priority accounts, tailor outreach, landing pages and ads, using information the account has shared or that is public and relevant.

Be careful with business-to-business electronic marketing rules. The ICO has specific guidance for corporate subscribers, and rules vary by country.

A test plan template

Field	Example
Hypothesis	Emails tailored to the stated preference will raise second purchases within 60 days
Audience and size	New subscribers, about 400 a month, with 10 percent holdout
Variants	Three tailored series versus one standard series
Primary metric	Second purchase within 60 days
Guardrail metrics	Unsubscribe rate, spam complaints, margin
Duration	Three months, to collect enough orders
Decision rule	Keep if second purchase rate improves without harming guardrails. Otherwise revert and try a different approach
Learning log	What we expected, what happened, what we will do next

Scenarios: what to do when personalisation goes wrong

Scenario	What happened	What to do
A customer complains an email felt intrusive	A message referred to a product they had only browsed, and mentioned it in a way that suggested close tracking	Apologise, explain what data you use, offer to adjust preferences, and review whether the trigger and wording are acceptable to most customers
A wrong name or detail appears	Duplicate or mismatched records	Fix the record and the process that created it, check for other affected contacts and add a validation step before sends
Personalised offers differ in price	Different segments saw different discounts	Check that differences are fair, lawful and explainable. Avoid pricing that customers would find unfair if they knew
Segments are too small to test	Dozens of tiny groups	Merge into fewer segments with enough people, and test one change at a time
A model recommends poorly	Odd or irrelevant suggestions	Compare against popular items, check data freshness and add business rules such as in-stock only and exclusions
Unsubscribes rise after launch	Frequency or relevance problem	Reduce frequency, tighten segments, review messages and give clear preference controls

A governance checklist

• Every data field used for personalisation has a recorded purpose and a lawful basis or consent.
• Sensitive inferences are not used for marketing targeting.
• Customers can see and change their preferences easily.
• There is a named owner for each personalisation programme.
• Each programme has a holdout, a success metric and guardrail metrics.
• Vendor terms and data processing arrangements are reviewed before data is shared.
• Complaints and opt-outs are reviewed monthly for patterns.
• The programme is reviewed at least quarterly, and switched off if it does not help.

How AI actually fits into personalisation

AI can play several distinct roles in personalisation, and it helps to separate them.

• Scoring and prediction. Models estimate the likelihood that a person will buy, churn or respond. The output is a score you can use to choose a segment. Validate it against a simple baseline.
• Recommendation. Models suggest items based on patterns in behaviour. Combine them with business rules.
• Content generation. Generative tools draft variants of messages. A person approves them.
• Optimisation. Systems pick among variants and send times. Check that they are learning from meaningful outcomes, such as revenue, not just opens.
• Understanding feedback. Tools summarise reviews and survey comments into themes, which informs what to personalise.

In each role, the quality of the data and the clarity of the goal matter more than the sophistication of the model. A well-designed simple segment often beats a poorly fed complex model.

Questions teams ask before they start

Question	Answer
Do we need a data scientist?	Not to begin. Segmenting by stated preference and behaviour, and testing, needs careful marketing work more than data science
How much data is enough?	Enough customers in each segment to detect a difference in your test. Small lists limit what you can test, so keep it simple
Will customers mind?	Most welcome relevance when they understand why. They dislike surprises, so be transparent and give control
Can we personalise without cookies?	Yes, using first-party data such as accounts, purchase history, email engagement and stated preferences, with consent
What should we personalise first?	Welcome and post-purchase messages, because they reach people at moments of high attention and are easy to test

Glossary

Term	Meaning
Segment	A group of customers who share a trait or behaviour
Holdout group	A group deliberately kept from receiving the change, to measure its real effect
Lookalike	An audience of people similar to an existing group of customers
Next best action	A prediction of the most useful message or offer for a person at a given moment
Churn	Customers stopping buying or cancelling
Lifecycle marketing	Tailoring communication to a customer's stage, from new to loyal to lapsed
Preference centre	A page where people choose topics, frequency and contact methods
Zero-party data	Information customers intentionally share with you

A quick self-check before launching a personalised campaign

• Could I explain to the customer why they received this message, in one sentence?
• Do I have a lawful basis and, where needed, consent for each data item used?
• Is the data fresh and accurate?
• Is there a control group?
• Does the message help the customer, or only push a sale?
• Can the customer easily change preferences or opt out?
• Have I tested on real devices, including unusual cases such as missing names?
• Do I know what I will do if results are poor or complaints rise?

A story of personalisation that felt helpful, and one that did not

This is an invented composite. A bookshop in Edinburgh ran two personalisation experiments in the same year, and the contrast taught the owner a lot.

The first was a simple preference-based newsletter. When customers signed up, they ticked the genres they liked from a short list: crime, history, children's books, gardening and so on. The shop sent a monthly email with new arrivals in those genres, short staff reviews and an occasional event invitation. It also included a line: "You are receiving this because you told us you like crime and history. Change your preferences any time." Open and click rates were healthy, unsubscribes were rare and several customers replied to say they had found a book they would not have discovered otherwise.

The second experiment used behavioural data from the website. The shop installed a tool that tracked which books visitors viewed and sent an email within an hour: "We noticed you were looking at 'Grief in the Garden'. Still thinking about it?" Some customers appreciated the reminder. But a few wrote to say the message felt intrusive, and one wrote that the book was a gift for a bereaved friend and that seeing it highlighted in an email in the family inbox was upsetting. The shop realised that the tool did not know the context of the browsing, and that the topic was sensitive.

The owner changed the approach. She ended the one-hour trigger for sensitive categories such as health, grief, relationships and finance. She delayed other browse reminders by a day, and she rewrote the message to avoid mentioning exactly what was viewed: "Some of the books you looked at are still available. Here is a selection of our staff picks in the same section." She also added a link to a preference page where customers could turn off browse-based emails and keep only the monthly newsletter.

She learned that personalisation works best when customers have chosen it, when the value is clear and when the message does not reveal more than the customer would expect. She also learned that some topics should never trigger automated messages. And she began to ask "how would this feel if the reader's family saw it?" before approving any trigger. The bookshop's personalisation is now modest, careful and popular, which is more valuable than a sophisticated system that makes customers uneasy.

Where we can help

We are a digital marketing agency in Manchester, UK and Mumbai, India. We help businesses collect consented first-party data, build a few meaningful segments and test personalised journeys. See our conversion rate optimization and content marketing services, or contact us to discuss a first project.