The experiment that tells you where the line is
A peer-reviewed series of studies from 2015 asked exactly this question. In the first experiment 120 participants were shown an ad, varied along two factors: data collection was open or covert, and the ad was heavily or lightly personalized.
Click-through intent on a seven-point scale:
| Open data collection | Covert data collection | |
|---|---|---|
| Heavily personalized | 4.38 | 3.16 |
| Lightly personalized | 2.67 | 2.94 |
Read the bottom row again. When the ad was not heavily personalized, covert collection did no harm — quite the opposite. The gap only opens up where the personalization shows but its source does not.
The researchers also measured what mediates the effect: a feeling of vulnerability. What bothers people is not the amount of data, but not knowing what is known about them.
The information icon: the cheap fix
The third experiment (123 participants) tested this. When there was an information icon next to the ad showing where the data came from, the results for open (3.43) and covert (3.77) collection evened out. Without the cue the difference stayed: open 4.00, covert 2.96.
So a "why am I seeing this?" link roughly recovers what covert data collection loses. It is the best value-for-money intervention in the whole topic — and it is the same thing regulation increasingly expects.
The second experiment (194 participants) adds one more thing: the credibility of the surface moderates the effect. On a site seen as trustworthy the disadvantage of covert collection disappears; on a less trustworthy one it swamps the benefit of personalization. So if your brand is small or unknown, you have to explain more than a large one does.
Where the practical line runs
What you can comfortably do on the basis of the above:
- Refer to the customer's own action. "You looked at this", "you bought this last year", "you asked support about this". This is the open case.
- Category-level recommendations. Someone who bought running shoes may also want running socks. This is not creepy, because the logic is obvious.
- Say where you know it from. Half a sentence in the email, or a link next to the ad.
What not to do:
- Refer to data you did not collect yourself. If the customer does not remember giving it to you, it will look like covert collection — even when it is lawful.
- Target an inferred, sensitive attribute. Health, pregnancy, financial trouble, bereavement. Here the legal line and the human line coincide.
- Address the vulnerability itself. A sentence along the lines of "we know you have had a hard month" is bad even when it is true.
- Set a personalized price without that being obvious. That is the subject of the next section, and it is not only a question of taste.
What the law says today — not in the future
Four things are already in force, and those four are enough to decide on.
The right to object, unconditionally. In direct marketing the data subject may object at any time, and there is no balancing against it. Once they have objected, that is the end of it — they cannot be kept on the basis of legitimate interest.
Legitimate interest, but not automatically. Direct marketing may rest on legitimate interest, but the decisive factor is the data subject's reasonable expectation. That is exactly the same axis the experiment above measured: if the customer does not expect it, the legal basis weakens too.
Profile-based targeting and automated decisions. According to the European guidance on the subject, advertising based on profiling typically does not carry a "similarly significant effect" — demographic targeting by a fashion retailer does not fall under the stricter rule. But the guidance also lists concrete counter-examples: the intrusiveness of tracking across websites, devices and services, the manner of delivery, and expressly the exploitation of known vulnerabilities of the people targeted. It mentions as a separate example price differentiation based on personal data, where a prohibitively high price actually shuts someone out of a service.
Cookies and tracking. Access to information stored on terminal equipment still requires consent. The EU legislator proposed moving these rules into the data protection regulation, but as of the summer of 2026 that has not been concluded, and final adoption is not expected before the end of the year. Until then the current rule applies — anyone planning "according to the new regime" is planning early.
Dark patterns: what is already prohibited
This section belongs here because the line between personalization and manipulation is thinner than one would think.
According to a 2022 European Commission behavioural study, 97% of the websites and apps most used by EU consumers deployed at least one dark pattern. The most common ones: hidden information and false hierarchy, pre-ticked boxes, nagging, obstructed cancellation, forced registration.
And these do not fall under some future regulation. A provision in force today prohibits misleading and aggressive commercial practices; the regulation on digital services prohibits interface design that "materially distorts or impairs" the user's ability to make autonomous decisions; and in the AI act, subliminal and manipulative techniques together with the exploitation of vulnerability are among the prohibited practices — carrying the highest fine band there is.
The Digital Fairness Act: worth watching, but not here yet
You read about it in a lot of places, so it is worth knowing exactly where it stands. According to the European Parliament's legislative register its status is "announced": the Commission has not yet tabled the proposal, it has no file number, and the proposal is expected in the fourth quarter of 2026. The public consultation ran in the summer and autumn of 2025.
Its planned subject matter, though, is exactly our topic: dark patterns, influencer marketing, addictive design, and unfair personalization practices, particularly where consumer vulnerabilities are exploited. Anyone building their personalization now would do well to keep that list in view already.
Checklist before you go live
1. Can you say in one sentence WHERE you know it from?
If not, do not use it.
2. Is the "why am I seeing this?" cue there?
Measured effect: roughly recovers what covert
collection loses.
3. Does the customer REMEMBER giving you this?
If not, it will feel like covert collection to them.
4. Is there an inferred sensitive attribute in it?
Health, finances, family, faith -> no.
5. Is the price personalized too?
Then this is not a marketing decision but a legal one.
6. Is unsubscribing/objecting ONE click?
Obstructed cancellation is the most common dark pattern.
Common misconceptions
- "The more personalized, the better." Only when the data collection is open. With covert collection the heavily personalized ad performed worse than the lightly personalized one.
- "If it is lawful, it is fine." Lawfulness and how the customer feels are two separate axes. The experiment points both to the same place, but they are not the same thing.
- "This will fall under the Digital Fairness Act." What is prohibited today is prohibited today. Several provisions already in force cover dark patterns.
- "We are a small company, nobody looks at us." The research says covert collection does more damage on a less credible surface. A small brand has to explain more, not less.
What to take away
In personalization what decides is not the quantity but the transparency. The same recommendation can be useful or creepy depending on whether the customer understands where it came from. The cheapest intervention is a cue about why they are seeing it — an experiment backs that up, and the legal direction points the same way.
And to have something to personalize you need raw material: that is what the collecting of customer words post is about. The separate rule set for machine-generated outreach is what the limits of automated sales post works through.