You Shout About AI Marketing Every Day — But Do You Actually Dare Use Customer Data?

A while ago, a founder friend came over for tea.

He runs a maternal-and-baby e-commerce business, just closed a Series A, and was getting ready to go all-in on an AI recommendation system. Halfway through the chat, he suddenly lowered his voice and asked me:

"Bro, we want to use customers' browsing records, purchase records, and chat logs to train a model for precision recommendations. But the compliance side says this is messy. Should I do it or not?"

Should he do it?

Man, this isn't a question of "should I do it." It's a question of "if you don't, you soon won't be able to do it at all."

1. That European Fine Could Buy You Half an Office Building

Let me start with something to sober everyone up.

In 2018, a European law called GDPR officially took effect. The full name is "General Data Protection Regulation" — it sounds academic, but in plain English it means Europe passed an iron law on personal data.

How ruthless is this iron law?

• The fine ceiling is "4% of global annual turnover" or "€20 million," whichever is higher.
• For a large internet company, a single fine can run into the hundreds of millions.

Four percent — sounds small? Do the math.

If your company does ¥5 billion in business a year, 4% is ¥200 million. That's roughly the price of an office building on Beijing's East Third Ring Road.

In the years since GDPR came into force, Google, Meta, and Amazon have all been hit. Google alone was slapped with a €50 million fine by France in 2019. The reason was plain — the consent mechanism for personalized advertising wasn't transparent enough.

Good lord.

And in 2024, the EU came out with the AI Act, sorting AI systems into four risk tiers: unacceptable, high, limited, and minimal. The large-scale profiling and automated decision-making used in marketing almost certainly lands in the "high-risk" tier.

In other words, the "AI precision marketing" you've been chasing every day is, in the eyes of European law, very likely a high-risk activity.

So this doesn't matter in China? Wrong. China's Personal Information Protection Law (PIPL) took effect in 2021, and its spirit is nearly identical to GDPR — minimize collection, explicit consent, the right to delete, the right to portability.

2. What Does "Data Minimization" Mean?

When my friend heard that term, he froze for a second.

What is data minimization?

In plain terms — only collect the slice you actually need for this specific task.

An example.

If you want to recommend infant formula to a customer, what you need is "how many times has this customer bought formula, when, and which brand." You don't need to know her marital status, income level, home address, or where her husband works.

Collect all of that, and your model might get a tiny bit more accurate — but you're not bearing the cost of "a tiny bit more accurate." You're bearing the cost of "once it leaks, the regulator is at your door."

Article 5 of GDPR states it clearly: the collection of personal data must be for specific, explicit, and legitimate purposes, and must not exceed what is necessary.

This principle directly punctures a fundamental fantasy of AI marketing — you think more data means more accuracy; the law tells you: the more data, the less sleep you get.

3. Privacy by Design Isn't Something You Bolt On Before Launch

So what do you do?

This is where a GDPR expert actually earns their keep — writing privacy into the system's DNA, not bolting it on before launch.

What does "written into the DNA" mean?

Three concrete actions.

First, run a DPIA (Data Protection Impact Assessment). When a new project is greenlit, run a systematic privacy risk scan first: what data will this AI system use? Where will it be stored? Who will see it? How long will it be kept? What are the leak paths? Once the assessment is done, then decide whether to ship and how.

Second, Privacy by Default. The moment the product goes live, the default setting is "the most protective tier for the user." For example, when a new user registers, personalized recommendations are off by default — they have to actively check "I'm willing to receive personalized recommendations" to turn it on. Make consent meaningful, not a default bundle.

Third, audit trails. Every data access, every model training run, every export — all of it must be traceable. When the regulator comes knocking, you can hand over a complete log of "who, when, used what data, did what."

These three things sound pretty plain, right?

But as far as I know, fewer than three in ten Chinese companies actually pull off all three. Most teams only realize — huh, maybe we should ask compliance? — after the marketing has launched, the data has been collected, and the model has run for three months.

That's too late.

4. The Ethics of AI Marketing Hide in the Dark Corners of the Algorithm

The law is the floor; ethics is the higher bar.

The easiest ethical trap to fall into in AI marketing is algorithmic bias.

Your recommendation model is trained on the past year of customer behavior. If, over the past year, men made up 70% of your customer base, what happens?

The model will automatically treat "male preferences" as "mainstream preferences," and sideline female customers, elderly customers, and low-income customers. When they open your app, all they see are products that have nothing to do with them. Over time, they leave.

You think the model isn't smart? No — the model is systematically discriminating against a group of people.

This has already been punished in Europe. A company called OPTISTA was hit hard by regulators because its algorithm offered different prices to customers of different genders and ethnicities.

Article 22 of GDPR is explicit: individuals have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning them or similarly significantly affect them.

In plain English — your AI can't secretly tag people, set prices, or throttle traffic without telling them.

5. Cross-Border Transfer: The Invisible Bomb Everyone Ignores

And here's something 90% of Chinese companies going overseas still haven't grasped — cross-border data transfer.

You collect European users' data in China and store them on servers inside China, or, the other way around, you use a U.S. SaaS tool to process Chinese customer data.

You think this is just an IT department detail?

Honestly, in GDPR this is Chapter V — an entire chapter dedicated to "third-country transfers." The rule is: personal data of EU citizens can only be transferred to countries the EU considers to provide "adequate protection," or you have to use tools like Standard Contractual Clauses (SCC) or Binding Corporate Rules (BCR) as a backstop.

China is not on that adequacy list.

The U.S. isn't either (though the EU-US Data Privacy Framework is propping it up for now).

What does this mean? It means if your company has European customers and you send their data back to China, you'd better have a lawful transfer mechanism. Otherwise one fine lands, and every cent you made in front goes down the drain.

6. In Three Years, "Compliance" Will Become "Competitive Advantage"

At this point, I want to look at this from a different angle.

Most Chinese companies treat compliance as a cost — spend money, hire people, write processes, add cookie banners, drag down conversion rates.

But I recently saw a counterexample.

A Chinese SaaS company targeting the European market had spent two years getting GDPR compliance completely dialed in. On the compliance front, their product was more thorough than 80% of local European competitors — explainable algorithms, one-click data export, one-click account deletion, a clean consent-management interface.

The result?

European customers picked them — not because they were cheaper, not because they had more features, but because "this Chinese company is actually more rigorous than our local ones."

This suddenly made something click for me —

When everyone treats compliance as a burden, choosing to do it well turns it into your moat.

Over the next three years, data compliance will shift from "cost center" to "trust center." And trust, in the AI era, is the scarcest currency.

7. Three Judgments to Leave You With

If you're also doing AI marketing, here are three plain judgments for you:

1. Data governance comes before model selection. Models can be swapped out; data governance has to be done from day one.

2. Compliance is not the legal department's job alone. It's a shared understanding across product managers, engineers, operations, and marketing.

3. Treat "can the user take their data back at any time" as your product acceptance criterion. If you can do that, you're ahead of 90% of your peers.

Back to my friend running the maternal-and-baby e-commerce business.

I told him: you can do this project, but you have to do three things first — run a DPIA first, build a solid consent mechanism first, and figure out the lawful path for cross-border transfer first. Once those three are done, you'll sleep at night.

He listened, went quiet for a moment, and said:

"You're right. I used to think this was 'legal blocking us.' Now I get it — this is 'our lifeline for the next three years.'"

Exactly.

Innovation and protection have never been opposites.

Innovation built on strong protection is the innovation that actually goes the distance.

Here's hoping your AI project runs fast — and runs steady.