The regulatory constraint
Personalization is built on the consent record, and no model or log was permitted to expand PCI cardholder-data scope.
How we work in this industrySituation
Three AI programs — service deflection, product content generation and on-site personalization — were running across 640 stores and the e-commerce channel with no shared measurement and no control groups.
A privacy review had flagged that the personalization model was reading a customer attribute set that included segments from customers who had exercised an opt-out.
Approach
Rebuild the personalization feature store on the consent record, so opted-out customers are structurally excluded rather than filtered at query time.
Stand up holdout groups for each program and route the results into the merchandising and finance reviews that already existed.
Attribute contribution margin, not clicks, and put the tool-level cost next to it so renewals could be argued on evidence.
What we built
- Consent-aware segmentation with an exclusion audit that runs before every campaign build.
- Holdout-based measurement for deflection, content and personalization inside the existing analytics stack.
- A tool-level cost and margin view reviewed monthly by merchandising and finance together.
“We could not tell whether any of it was working, and the privacy finding meant we could not just keep going while we figured it out. Holdouts settled both arguments in one quarter.”
VP, Customer Analytics — national specialty retailer