Hyper-personalisation and privacy can coexist when personalisation runs on what people knowingly share and on what audiences say in public, not on inferences they never agreed to. In practice that means using the minimum personal data, explaining in plain words why someone sees a message, giving them real controls to steer it, and keeping sensitive traits and children out of ad targeting altogether.
Key takeaways
- Personalisation turns creepy when it exposes an inference the customer never knowingly gave you.
- Gartner found personalisation created negative experiences for 53% of customers, who were then 3.2 times more likely to regret a purchase.
- Singapore's PDPC and the EU point to the same habits: notice and consent, data minimisation, transparency, and no profiling-based ads to minors or on sensitive traits.
- Personalising by persona and tension, using public content and aggregated panel data, delivers relevance without a dossier on anyone.
- Ask, explain and let people steer: co-created personalisation earns more trust than silent inference.
Why does hyper-personalisation feel creepy?
Because it reveals that a brand knows something the customer did not knowingly tell it. Relevance is welcome; surveillance is not, and the line sits wherever the customer is surprised by how you knew.
The cost is measurable. Gartner's survey of 1,464 B2B buyers and consumers, published in June 2025, found personalisation generated negative experiences for 53% of customers. Those customers were 3.2 times more likely to regret a purchase and 44% less likely to buy again, and personalised customers were twice as likely to feel overwhelmed by information.
SOMIN's audience-research workspace frames the same tension from the marketer's side. Its insight engine wrote "Trust is bred in the soil of conversation, not in the data of algorithms" for a persona it calls The Insightful Strategist, on an angle labelled Distrust in Automation, drawn from Trust Theory: as people notice algorithm-driven marketing, they grow sceptical of brands that lean on it. The insight rests on 51 posts. Like all SOMIN personas and insights, it is model-generated from published content, so read it as a grounded hypothesis rather than a survey result.
The pattern shows up by market and by generation. A SOMIN study of 279 posts from July to October 2025 grouped nine under a tension about AI adoption in Thai marketing, centred on consumer doubts about whether AI can be trusted. An October 2026 study of 151 posts grouped 22 under an authenticity and connection crisis, citing a loss of trust among Gen Z users as AI-generated content and curated fakeness spread.
What do regulators expect from personalised marketing?
Broadly: tell people what you use and why, use only what you need, give them control, and keep sensitive traits and children out of ad targeting. This is a practical summary, not legal advice; check your obligations with counsel in each market.
Singapore
The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, issued on 1 March 2024, say consent is generally required to collect and use personal data for recommendations unless deemed consent or an exception applies. They suggest telling people which product feature uses their data, what types of data are involved and which features of that data most influence the result, in layered notices that are not overly technical. They also encourage data minimisation and anonymising datasets as far as possible.
European Union
Under the Digital Services Act, the European Commission lists a complete ban on targeting minors with ads based on profiling, a ban on ads that target people based on sensitive data such as political or religious beliefs, and the right to see why an ad is shown. Separately, the Commission's February 2025 guidelines on prohibited AI practices under the AI Act cover harmful manipulation among other practices. They are non-binding, but they show where the line is drawn.
Where should personalisation data come from?
From the least intrusive source that answers the question. Most strategy and creative decisions need to know what a group cares about, not what one person did yesterday.
| Data tier | Example | Privacy risk | Best use |
|---|---|---|---|
| Public content and competitor ads, read in aggregate | Themes, tensions and which ads perform in a category | Low | Strategy, personas, creative angles |
| Aggregated panel data | Survey indices for a market segment | Low | Validating personas and messages |
| Declared preferences | What a customer tells you in a quiz or preference centre | Low to medium, with consent | Individual recommendations |
| Behavioural first-party data | Purchases and browsing on your own site | Medium; needs notice and consent where required | Lifecycle messages |
| Inferred individual profiles | Predicted traits, life events, broker data | High, especially for sensitive inferences | Sparingly, and never for sensitive traits |
SOMIN's audience research starts from the first two tiers. It reverse-engineers strategy from published content and competitor ads rather than individual profiles, and every AI conclusion can be checked against the posts behind it. When SOMIN's proposition model wrote consumer takeaways for that idea, one read: "I want insights that feel grounded in real conversations, not just numbers." It is a generated line, but it is the right brief.
The Keeta HK case study shows segment-level personalisation in practice. SOMIN checked AI-written ad lines against an aggregated GWI snapshot of Hong Kong food orderers in the above-average income bracket and rewrote every direct-to-action line around curation rather than price. The work used public ads and an audience snapshot, not individual customer records.
How do you personalise without crossing the line?
Personalise to the shared tension and the moment, explain it, and let people steer.
- Ask before you infer. Gartner recommends moving from passive inference to asking customers directly for their preferences and context, using quizzes, assessments and guided experiences.
- Explain the why in one line. "Because you saved three trail-running posts" is clear; an unexplained recommendation invites guesswork.
- Give controls that work. Platforms are moving this way: Meta's October 2026 Facebook update lets people describe the topics they want more of in their own words.
- Draw hard lines. No targeting on health, religion, politics or sexuality, no profiling-based ads to minors, and no life-event inferences people have not shared.
- Keep the human voice. In SOMIN's social-listening workspace, the insight "Authenticity thrives when technology takes a backseat to human connection" warns that automation can make interactions feel transactional; it rests on 488 engagements across 36 posts.
- Audit the creative too. Generated creative can personalise tone in ways that feel manipulative, so review it against the same rules as the targeting.
That last point is one I raised in my WSDM 2023 talk on using AI responsibly for ad targeting and creative evaluation. It looked at automatic user profiling in programmatic platforms such as Meta Ads, and at applying creative assessment models within business ethics guidelines. Both halves of the system, who sees an ad and what the ad says, need the same scrutiny.
Can AI make personalisation more trustworthy?
Yes, if it is explainable. A model that can say why a message suits a persona can be checked; a black box that simply picks the winning variant cannot.
Explainability runs through SOMIN's peer-reviewed work, from the ACM Multimedia 2023 paper Against Opacity, which pairs creative performance prediction with an LLM that explains the drivers, to the papers listed on our research page. Accuracy is a privacy issue too. Another SOMIN insight, "Trust is the soil in which engagement grows", sits on an angle where people become reluctant to share personal insights once they notice brands getting their data wrong; it rests on 64 posts.
FAQ
Is hyper-personalisation legal under Singapore's PDPA and the EU's GDPR?
It can be, if you have consent or another lawful basis where required, tell people what you use and why, and avoid prohibited practices such as profiling-based ads to minors in the EU. Requirements differ by market, so take legal advice; this article is practical guidance only.
What is the difference between personalisation and hyper-personalisation?
Personalisation adapts a message to a segment or a stated preference. Hyper-personalisation adapts it to one person in real time using behavioural and inferred data, which raises both its relevance and its privacy risk.
How can I tell if personalisation is creepy?
Ask whether the customer would be surprised by how you knew. If a message reveals an inference they never shared, such as a health condition or a life event, it has crossed the line.
Does privacy-first personalisation perform worse?
Not necessarily. Gartner found that customers engaged through what it calls active personalisation were 2.3 times more likely to complete critical purchase decisions with confidence.
Start with an audit. List every personalisation rule you run, the data each one uses, and whether a customer would recognise where that data came from. Retire the rules that rely on inferences people would not expect, and move strategy-level decisions onto aggregate data. To see how SOMIN works from published content rather than personal profiles, read how we handle personal data or start with SOMIN for brands.
