AI in marketing: What can you do with customer data, profiling and AI content?
Short answer
AI for copy and campaigns without personal data is minimal risk. If you use customer data for segments and personalised offers, that is profiling: you need a legal basis, you must inform customers, and they can always object to direct marketing. Electronic marketing generally requires consent. AI images and video that resemble real people or events (deepfakes) must be labelled from 2 August 2026. And AI that manipulates people into decisions that harm them is prohibited.
Solutions
See how GoalCube is used for online shop customers, subscribers, donors and influencer partnerships.
What to do
- Separate content from customer data.Copy and images need no personal data.
- Check the legal basis and consent.For profiling and emails.
- Send segments, not names.The AI doesn't need to know who your customers are.
- Label deepfakes.From 2 August 2026.
- Avoid dark patterns.Manipulation that causes harm is prohibited.
What the law says
- Articles 21 and 22 GDPR
- The right to object to direct marketing; profiling.
- Articles 5 and 50 AI Act
- Ban on harmful manipulation; labelling of deepfakes.
- Article 13 of the ePrivacy Directive (2002/58/EC)
- Consent to electronic marketing.
Questions and answers
Do AI-written newsletters need labelling?
Not as a rule. The labelling requirement covers deepfakes and text on matters of public interest that has not been edited by a person.
Can we use AI to predict who will buy?
Yes, with a legal basis and information to customers. That is profiling.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.