Data privacy rules sharpen as personalised advertising becomes more regulated

As regulatory restrictions tighten and platforms enforce stricter consent rules, personalised advertising faces new challenges, shifting towards cleaner data and closer compliance while maintaining targeting effectiveness.

Personalised advertising is the practice of selecting an advert for a person rather than for the page or programme they are viewing. In practical terms, it relies on data such as browsing history, app activity, purchase records, uploaded customer lists and inferred demographics. Google’s own help material says an advert is treated as personalised when historical data is used to determine or influence ad selection. According to PPC Land, the modern system is built around identifiers, audience segments and consent signals, with ad_personalization serving as the key permission flag in Google’s stack and the Transparency and Consent Framework string performing a similar role in European programmatic buying.

The commercial logic is straightforward: ads that are more specific are usually priced more highly. Marketing guides from AdRoll, Lotame and AdsDaddy all describe personalisation as a way to improve relevance, increase return on investment and use signals such as interests, buying intent and past behaviour more effectively. PPC Land adds that the premium is not small, but also not settled; estimates vary widely, and the biggest claims often come from businesses that sell personalised inventory. That makes the debate as much about measurement as about performance.

The regulatory history has steadily narrowed what can be done. PPC Land traces the modern framework back to behavioural advertising debates in the late 2000s, then through the GDPR, Apple’s App Tracking Transparency changes and Google’s Consent Mode requirements. Google’s own AdMob documentation makes the same basic distinction between personalised and non-personalised ads, while PPC Land notes that the company has since imposed stricter limits through Consent Mode v2 and later policy enforcement. In Europe, the legal position is especially tight, because consent is no longer a formality but the basis on which cross-site profiling can proceed.

Those restrictions are not only technical; they also depend on category and age. PPC Land says Google bars advertiser-curated audiences for sensitive themes such as health, race, religion, political affiliation and sexual behaviour, and excludes users under 18 from personalised advertising altogether. Its coverage also notes that limited ads, non-personalised ads and restricted data processing define the outer edge of what is still permitted in Google’s systems. That means personalisation is no longer a single switch, but a set of tightly controlled modes.

For marketers, the key lesson is that personalisation still matters, but it now depends on cleaner data, clearer permissions and closer platform compliance. AdRoll and AdsDaddy both argue that first-party data and human oversight are central to effective campaigns, while PPC Land shows why: the same data that improves relevance can also expose sensitive attributes or fail under modern consent rules. The result is a market that still rewards targeted delivery, but only within a narrower and more heavily supervised framework than the industry used a decade ago.