Consent Must Travel With the Data: A Rule for AI Personalisation

AI personalisation is often described as a benefit: the system remembers preferences, predicts needs and adapts the experience. But personalisation can quietly change meaning as data moves. A detail shared to improve one conversation may later shape advertising, eligibility, ranking or automated decisions.

A useful ethical rule is: consent must travel with the data. Wherever information moves, the original purpose, permission, limits and route to withdrawal should remain attached.

Data does not stay in the form it entered

A user may provide age, location or a stated preference. An AI system can then infer other characteristics: likely income, vulnerability, political interest, health concern or purchasing intent. These inferences may feel more intrusive than the original facts because the person never typed them directly.

The ethical question is therefore not only, “Did the user consent to collection?” It is also, “Did the user understand the transformation and the decision that would follow?”

The four receipts every personalisation system needs

1. Source receipt

Where did the information come from: direct input, observed behaviour, a connected service, a broker, public data or an AI-generated inference? The system should not blur these categories.

2. Purpose receipt

What was the declared reason for using it? “Recommend articles” is different from “determine credit risk.” Purpose should be specific enough that a person can predict the likely consequence.

3. Retention receipt

How long will the fact and any derived profile remain? Does deleting the original remove the inference, or does the shadow profile survive?

4. Revocation receipt

What happens when the user changes their mind? Withdrawal should affect future use, connected copies and derived preferences where legally and technically applicable. A control that only hides the visible field is not meaningful revocation.

Consent is not a one-time button

A long privacy notice followed by “Accept all” cannot carry every future purpose. When the use changes materially, the system should return to the person with a clear explanation and a real choice. This is especially important when personalisation crosses into profiling or decisions with significant effects.

The UK Information Commissioner’s Office says organisations using profiling and automated decision-making need a lawful basis, transparent information and ways for people to understand the data used to create their profile. Meaningful human oversight matters when consequences become serious.

Design personalisation as a visible contract

• Let users inspect and correct important profile attributes.
• Label inferred traits separately from facts the person supplied.
• Show why a recommendation or decision appeared.
• Provide granular controls rather than one universal switch.
• Prevent sensitive data from flowing into unrelated commercial uses by default.
• Log which model, rule and data sources influenced consequential actions.

The business case for portable consent

This is not only compliance. A product that can explain its memory is easier to trust. Clear controls reduce the fear that the system is building an invisible dossier. They also make integrations safer because downstream tools inherit explicit boundaries rather than guessing.

Personalisation should feel like a service the user directs, not surveillance that happens to produce convenient results. If the data travels, its permissions must travel too.

Further reading: ICO guidance on AI and data protection and ICO guidance on profiling and automated decisions.