How To Personalise Email Without Making It Creepy

Email personalisation is meant to make a message more relevant. At its best, it saves the recipient time: it remembers an item they deliberately saved, recognises the product they already own, or sends guidance that follows naturally from an action they took.

It becomes creepy when the email appears to know more than the recipient knowingly shared, reveals a level of observation they did not anticipate, or turns a weak prediction into a confident statement about them. The commercial cost is larger than an awkward moment. People unsubscribe, complain or simply stop trusting the sender. Those reactions can also harm inbox placement.

The practical aim is not to remove personalisation. It is to use it with restraint: be useful, be intelligible about the data involved, and leave people in control.

The simplest test: does this reduce effort or reveal surveillance?

Before approving a personalised message, ask one question from the recipient’s point of view: does this help me do something I was already likely to do, or does it show me how closely the brand has been watching?

Compare these examples:

• Helpful: “Your annual software subscription renews next month. Here is how to review your plan.”
• Unsettling: “We noticed you opened our pricing page three times from Manchester late last night.”
• Helpful: “You left this item in your basket. It is still available.”
• Unsettling: “Still deciding about the navy jacket in size 12? We saw you compare it with two others.”

Both versions may draw on behavioural data. The difference is whether the copy foregrounds the observation itself. A recipient normally understands why an account reminder refers to their account. They may not expect an email to narrate their browsing pattern, location, device or presumed state of mind.

A useful internal rule is: use data to choose the message more often than to describe the person. Segmenting an audience so that a new customer receives setup advice is usually better than telling them, “Because you have only used feature X once…”

Personalisation has different risk levels

“Personalisation” covers several distinct practices. Treating them as equally harmless is where programmes go wrong.

Data or method	Typical use	Recipient expectation and risk
Declared information	Name, stated interests, communication preferences	Usually expected when it was collected for that purpose. Still validate fields and avoid overusing a first name.
Direct relationship data	Purchase, membership, booking, renewal or support history	Often useful and understandable when the email relates directly to that relationship.
Current context	Local event, account status, items explicitly saved	Can be relevant, but location and timing need particular care.
Observed behaviour	Website visits, clicks, app use, email opens	Higher risk. Explain the tracking, limit its use and avoid copy that makes monitoring conspicuous.
Inferences	Predicted budget, life stage, interests, likelihood to buy or churn	Easy to get wrong and more likely to feel presumptuous. Use cautiously, if at all.
Third-party enrichment	Data appended from brokers, public sources or partner datasets	Usually the least expected and hardest to explain fairly. It deserves especially close scrutiny.

In UK data protection guidance, profiling for direct marketing can include analysing interests, habits and behaviour, then making predictions or assumptions. The ICO says organisations must be fair, transparent, use an appropriate lawful basis, keep profile data accurate and not excessive, and respect objections to direct marketing and related profiling. Read the ICO’s guidance on profiling for direct marketing.

That is a useful standard even where a particular campaign is not legally difficult. If a team cannot describe a proposed segment plainly to a customer, it should not hide behind the word “personalisation”.

Start with data the recipient recognises

The safest source of relevance is usually information supplied by the person or generated through a clear, direct relationship. A recipe publisher can send vegetarian recipes to someone who selected “vegetarian” in a preference centre. A retailer can provide care instructions for an item it sold. A B2B platform can send an administrator information about a plan their organisation uses.

Those examples work because the connection between data, purpose and email is obvious. They also have a natural expiry date. A purchase made four years ago should rarely determine today’s recommendations; an interest chosen during sign-up may no longer be current.

This is why preference centres are more valuable than a long list of hidden behavioural rules. They let subscribers state what they want: product categories, content themes, message frequency or the kinds of updates they wish to receive. They make relevance easier to explain and give the subscriber a way to correct the record.

Use declared preferences as a starting point, not a licence to collect every possible signal. Under the UK GDPR’s data-minimisation principle, personal data should be adequate, relevant and limited to what is necessary for the stated purpose. The ICO’s explanation of data minimisation is a helpful prompt: first define the purpose, then decide the minimum information needed to achieve it.

Do not turn uncertain signals into personal claims

Most discomfort comes from a gap between what a system infers and what a human would confidently say. An abandoned-basket event may be meaningful. An “open” is much weaker evidence. An image may have loaded automatically, through a privacy service, or without the recipient reading the message.

Apple’s Mail Privacy Protection can hide a recipient’s IP address and prevent senders from seeing whether an email was opened. Apple’s description of Mail Privacy Protection makes clear why open-based automations should not be treated as a reliable record of attention.

Rather than writing “We saw you were interested”, use a less invasive prompt such as “Here are a few ways to compare your options” or “If you are still considering it, this guide may help.” Better still, use stronger, deliberate signals: a preference selected, a product registered, a quotation requested, an event booked or a meaningful click.

The same principle applies to inferred identity and sensitive circumstances. Avoid campaigns that expose or imply health conditions, financial stress, pregnancy, relationship status, religion, political views or other sensitive traits. Even where a marketer believes the data is accurate, the recipient may not have agreed with the inference, may share an inbox, or may simply not want a commercial sender to surface it.

Be transparent where the decision is made, not only in a privacy policy

A privacy notice matters, but transparency works best when it appears at the moment someone provides information or enables a feature. If a sign-up form asks for interests, say that they will be used to tailor emails. If a product alert requires browsing or wish-list activity, explain that nearby in plain language. If tracking technologies are used in email, consider how they are described and whether the required permissions have been obtained.

For UK senders, email marketing is governed by PECR alongside the UK GDPR where personal data is used. The ICO emphasises that organisations must be fair, lawful and transparent, and that fairness means avoiding uses people would find unexpected, misleading or detrimental. The ICO’s guidance on electronic mail marketing and data protection also notes that tracking pixels can fall under the separate PECR rules for storage and access technologies.

This is an area where a one-line explanation can improve both trust and data quality. For example:

• “Choose the topics you would like us to email you about.”
• “Save products to receive availability and price updates.”
• “We use your previous purchases to suggest compatible accessories. You can change these preferences at any time.”

These statements are specific enough for a person to understand the exchange. “We may use your information to improve your experience” is not.

Design segments around a job, not around every available field

A robust segment should answer a straightforward question: what does this group need from this message? It should not exist merely because the marketing platform can combine twenty fields.

For example, a learning provider might sensibly distinguish between people who have registered for a course, started it and completed it. Each group has a different practical need. It is much less defensible to target “low confidence learners” based on reduced logins, an old survey response and a device-level assumption.

Good segments tend to be:

• Purpose-bound: the information used has a clear connection to the email’s content.
• Time-bounded: old signals expire instead of becoming permanent labels.
• Small enough to be meaningful: a segment can be broad; it does not need to identify a person’s every characteristic.
• Auditable: a marketer can show what data placed someone in it, when that data was collected and how they leave it.

Set expiry rules in the system rather than relying on good intentions. A cart reminder might be valid for a few days. A product-interest segment may be useful for a few months. A person who has not engaged for a long time should not continue to receive increasingly elaborate personalisation designed to force a response.

Frequency can make even good personalisation feel intrusive

Personal relevance does not excuse contact pressure. Several triggered messages in quick succession can feel like surveillance even when each individual message is reasonable: a browse reminder, basket reminder, price alert, replenishment prompt and general promotion may all be competing for the same inbox.

Build a contact policy that considers messages across the whole programme, rather than allowing each team or automation to send independently. A useful policy can include precedence rules: an order update takes priority over a promotion; a recent purchase suppresses a cross-sell campaign; a person who ignores a reminder does not receive repeated variants of it.

This is good customer experience and sound deliverability practice. Google advises senders to make subscription and unsubscription easy, to consider removing recipients who do not read messages, and to monitor spam reports. For bulk senders, its guidelines also require one-click unsubscribe for marketing and subscribed messages, alongside a visible unsubscribe link in the message body. Google’s email sender guidelines provide the current requirements.

Do not interpret non-engagement only as a creative problem to solve with more targeted messaging. It may be a preference signal. Reduce cadence, offer a frequency choice, run a measured re-permission campaign where appropriate, or suppress the address from promotional mail.

Make it easy to change the relationship

An unsubscribe link is the minimum, not the whole experience. A subscriber may want fewer emails, a narrower category, a pause, or to keep practical account communications while stopping promotions. Giving those options can preserve a willing relationship, provided the choices are clear and honoured.

When someone opts out or objects to direct marketing, make sure the decision reaches every sending system, agency feed and manual-export process. Suppression is operationally important: the ICO recommends keeping a suppression or “do not contact” list so that organisations can check future lists and avoid sending marketing by mistake. See the ICO’s guidance on respecting marketing preferences.

That means treating identity resolution carefully. If a person opts out through one address, do not casually decide that a second address, household address or newly appended record is an invitation to resume promotional contact. Respect the scope of the preference and the reasonable expectations behind it.

Review the programme as a recipient would

Before launch, review a sample of campaigns and automations with people outside the campaign team. Give them the email, the segment definition and the data source. Ask:

• Would a recipient understand why they received this?
• Does the email reveal a fact or inference they did not knowingly provide for this purpose?
• Could the assertion be wrong, out of date or sensitive?
• Would the message still be useful if the explicit personal reference were removed?
• Can the recipient readily change the preference or stop the messages?

Also review the outcome data without letting a single conversion metric settle the question. Unsubscribes, spam complaints, reply sentiment, conversion quality and subsequent engagement can reveal whether relevance is earning trust or spending it.

If complaint rates rise, or if a sender is recovering from poor inbox placement, it is usually sensible to simplify. Send first to clearly engaged, permissioned audiences; reduce cadence; remove weakly supported behavioural triggers; and verify that authentication, suppression and unsubscribe handling are working properly. An independent deliverability audit can help establish whether a complaint or placement problem is being driven by audience quality, contact pressure, infrastructure, or a combination of these factors.

Personalisation should feel like good memory

The standard is not whether a brand can target an individual. It is whether the message feels like a useful continuation of a relationship the person recognises.

Use information that people deliberately gave you or reasonably expect you to remember. Keep it accurate and current. Let it influence relevance quietly rather than performing knowledge of the recipient. Explain important uses at the right moment, limit tracking and inference, control frequency, and make preferences easy to exercise.

Done well, personalisation makes an email easier to use. Done badly, it makes the recipient wonder what else the sender knows. That is a poor trade for any permission-based email programme.

Frequently asked questions

Is using a recipient’s first name in an email creepy?

Usually not, provided the name was collected fairly, is accurate and is used naturally. First-name personalisation becomes awkward when it is repeated excessively, inserted into a sensitive message, or exposes poor data quality through incorrect names and placeholders.

Can we personalise marketing emails using browsing behaviour?

It may be possible, but it needs careful legal and practical assessment. Be clear about the tracking and any required permissions, limit the data to a defined purpose, avoid revealing detailed observation in the copy, and do not treat weak signals such as email opens as proof of interest.

Should abandoned-basket emails say exactly what a person viewed?

Usually, no. A straightforward reminder about an item left in a basket can be helpful. Listing every page viewed, exact size comparison or browsing time can make the monitoring feel more visible than the benefit warrants.

How does personalisation affect email deliverability?

Personalisation does not create inbox placement by itself. It can support engagement when it is relevant and expected, but intrusive targeting, excessive reminders and poor preference handling can lead to unsubscribes and spam complaints. Those signals can damage delivery performance.

Sources and further reading

• ICO: Collect information and generate leads for direct marketing — Information Commissioner’s Office
• ICO: Guidance on direct marketing using electronic mail — Information Commissioner’s Office
• ICO: Respect people’s preferences — Information Commissioner’s Office
• Google: Email sender guidelines — Google
• Apple: Use Mail Privacy Protection on iPhone — Apple