AI, Marketing Analytics and the Future of Regulation

Introduction

Marketing is increasingly conducted through data-intensive systems that infer interests, predict behaviour, select audiences, generate content and sometimes make decisions without direct human intervention. These systems can improve relevance and efficiency, but they also create legal and ethical risks. A marketing model may exclude protected groups, infer sensitive characteristics, use personal data without a valid legal basis, reproduce copyrighted material, or make decisions that cannot be meaningfully explained or challenged.

The central governance question is therefore not simply whether an AI system is accurate. It is whether the system is lawful, fair, proportionate, explainable, secure, contestable and accountable throughout its lifecycle. This chapter treats AI marketing as a socio-technical activity: outcomes depend on data, models, interfaces, organisational incentives, vendors, human decisions and regulatory institutions.

Regulation is developing through several overlapping layers: data-protection law, consumer-protection law, equality and anti-discrimination law, intellectual-property law, sector-specific rules, platform policies, employment rules and emerging AI legislation. Requirements differ by jurisdiction. Managers must therefore avoid assuming that one compliance assessment is globally sufficient.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish profiling, targeting, recommendation, automated decision-making and generative AI.
2. Evaluate marketing systems for bias, privacy, explainability, intellectual-property risk and accountability.
3. Apply quantitative compliance metrics, while recognising their assumptions and limitations.
4. Design governance controls across the AI system lifecycle.
5. Analyse a complex marketing scenario and anticipate regulatory developments.

1. The AI Marketing System

1.1 From segmentation to adaptive prediction

Traditional segmentation groups customers using variables such as age, location, purchase history or attitudes. Modern systems may instead estimate a probability of purchase, churn, response, fraud or lifetime value for each individual or device. An advertising platform can then select an audience, bid for an impression, personalise an offer and measure a conversion in milliseconds.

Important distinctions include:

• Profiling: automated processing used to evaluate or predict personal aspects, such as preferences, behaviour, reliability or economic position.
• Targeting: selecting people or contexts for a message, offer or intervention.
• Personalisation: adapting content, price, timing or presentation to an individual or group.
• Recommendation: ranking products, content or actions for a user.
• Automated decision-making: a decision produced wholly or substantially by automated means, especially where it has legal or similarly significant effects.
• Generative AI: systems that produce text, images, audio, video or code from prompts or other inputs.
• Synthetic media: AI-generated or AI-altered media that may imitate real people, events or evidence.

A system may be low-risk when it recommends colours for an email template, but high-risk when it determines eligibility for insurance, credit, housing-related advertising or essential services. Risk depends on context, impact, scale, affected populations and the possibility of manipulation—not only on technical sophistication.

1.2 The lifecycle perspective

A useful governance model follows six stages:

1. Purpose definition: identify the marketing objective and whether the use is necessary and proportionate.
2. Data acquisition: establish source, provenance, permissions, quality, retention and lawful basis.
3. Model development: select variables, labels, objectives, training data and evaluation methods.
4. Deployment: integrate the model with advertising platforms, customer systems and human workflows.
5. Monitoring: test performance, fairness, privacy, security, drift and complaints.
6. Retirement: remove data and access appropriately, preserve required records and document lessons.

A compliant output cannot cure an unlawful data source. Similarly, a fair model can produce unfair outcomes if a platform delivers advertisements unevenly or if staff apply recommendations selectively.

2. Privacy, Consent and Data Governance

Marketing analytics commonly uses first-party data, inferred data, third-party data, cookies, mobile identifiers, location information, purchase records and interaction logs. The relevant legal questions generally include:

• What personal data is collected or inferred?
• Is the purpose specified and compatible with the original collection context?
• What legal basis supports processing?
• Is consent informed, specific, freely given and withdrawable where consent is required?
• Are sensitive or special-category attributes involved, directly or through proxies?
• Is data minimisation applied?
• How long is data retained?
• Can individuals access, correct, delete or object to processing?
• Is cross-border transfer lawful?
• Are vendors and data brokers appropriately controlled?

A major difficulty is inferential privacy. A company may not collect ethnicity, health status or financial distress directly, yet a model may infer them from browsing, purchasing, location or language. The absence of a sensitive field does not eliminate discrimination or privacy risk.

Privacy impact assessment should be connected to actual design decisions. For example, a team should compare an aggregate campaign-level model with an individual-level model, and a short retention period with indefinite retention. The less intrusive option should normally be preferred where it meets the legitimate objective.

Data governance should include a data inventory, provenance records, access controls, purpose limitation, retention schedules, deletion procedures, vendor due diligence and documentation of model inputs. Privacy-enhancing techniques—such as aggregation, pseudonymisation, access separation, secure computation or differential privacy—can reduce risk, but pseudonymisation is not equivalent to anonymisation and controls must be tested against realistic re-identification threats.

3. Bias, Discrimination and Fairness

3.1 Sources of bias

Bias can enter through:

• historical discrimination in training data;
• under-representation or measurement error;
• labels that reflect unequal institutional decisions;
• proxy variables, such as postcode or language;
• optimisation for engagement rather than social value;
• unequal access to devices, platforms or consent choices;
• feedback loops, in which prior targeting determines future data;
• human override practices and vendor delivery algorithms.

Marketing systems can discriminate even when protected attributes are excluded. A postcode, purchasing pattern or device type may correlate strongly with a protected characteristic. Moreover, advertising delivery can create unequal opportunity: two groups may receive different exposure to employment, education, housing or financial offers.

3.2 Fairness metrics

No single fairness metric is universally correct. The relevant metric depends on the decision, legal context, harm and business purpose.

For a binary outcome, the selection rate for group g is:

where Ŷ is the predicted or selected outcome and G identifies group membership. The demographic parity difference is:

A value of zero indicates equal selection rates between groups A and B, but it does not prove fairness. Different base rates, legitimate qualifications or unequal error costs may make demographic parity inappropriate.

For people who truly qualify for an outcome, the true-positive rate is:

where Y is the actual outcome. Equal opportunity requires comparable true-positive rates across groups. False-positive rates may also matter where an erroneous selection causes harm.

Calibration asks whether a predicted probability has the same meaning across groups. If a model assigns a 0.70 probability, approximately 70% of comparable cases should experience the outcome in each group. When base rates differ, calibration and certain parity conditions may be mathematically incompatible. Consequently, managers must choose metrics through a documented harm and rights analysis rather than selecting the most favourable statistic.

3.3 Testing advertising systems

Testing should examine both model and outcome:

• representation and missingness by group;
• error rates and calibration;
• reach, frequency, spend and conversion by group;
• exposure to opportunities and harmful content;
• price, offer and ranking differences;
• performance after platform delivery, not merely before deployment;
• intersectional groups, such as age combined with gender or disability;
• temporal drift and small-sample uncertainty.

Small samples can make observed differences unstable. Confidence intervals, minimum cell sizes and qualitative review are therefore important. Statistical parity is not a substitute for legal analysis, stakeholder consultation or investigation of causal mechanisms.

4. Explainability, Contestability and Automated Decisions

Explainability has at least three audiences:

1. Individuals need understandable information about relevant data, purpose, consequences and available remedies.
2. Managers and compliance officers need evidence that the system is operating within approved purposes and controls.
3. Technical reviewers need sufficient detail to reproduce, validate and challenge model behaviour.

A technically accurate explanation may still be legally or ethically inadequate if it is too complex, delivered too late or omits the opportunity to contest the decision. Explainability should therefore be paired with contestability: notice, human review, correction, appeal, escalation and remedy.

Organisations should distinguish explanations of the general system from explanations of an individual outcome. A feature-importance chart may describe model behaviour but not establish that a decision was justified, lawful or causally fair. Post-hoc explanations can also be unstable or misleading. Where stakes are high, interpretable models, constrained models or meaningful human review may be preferable to opaque optimisation.

Human oversight must be substantive. A person who merely approves an automated recommendation without time, authority, competence or relevant information is not an effective safeguard. Oversight roles should specify when staff must intervene, what evidence they may review and who is accountable for the final decision.

5. Generative AI and Synthetic Media

Generative AI changes marketing production and risk in five areas:

• Accuracy: fabricated claims, invented citations and misleading product descriptions.
• Disclosure: consumers may not know that content, testimonials, influencers or images are synthetic.
• Bias: outputs may stereotype groups or reproduce exclusionary representations.
• Privacy: prompts or training data may contain personal or confidential information.
• Intellectual property: outputs may reproduce protected expression, trademarks, likenesses or confidential material.

A marketing organisation should maintain an approved-use policy. It should define prohibited inputs, permitted tools, review thresholds, disclosure requirements, records of prompts and outputs, ownership assumptions, and escalation procedures for suspected infringement or harm.

Synthetic media is especially sensitive where it imitates a real person, creates a false endorsement or depicts a realistic event. Consent and rights of publicity may be relevant even when copyright is not. Provenance technologies, watermarks or content credentials can support transparency, but their absence does not prove that content is authentic and their presence does not prove that it is accurate.

Human review should verify factual claims, comparative advertising, regulated-product statements, image rights, accessibility, cultural representation and audience appropriateness. Reviewers must assess the final published asset, not only the prompt or draft.

6. Intellectual Property and Data Rights

AI marketing raises several distinct intellectual-property questions:

• Was training or retrieval material lawfully obtained and used?
• Does generated output reproduce protected expression or a distinctive brand element?
• Who owns or controls the output under the applicable jurisdiction and tool contract?
• Does an image or voice imitate a person without permission?
• Are trademarks, music, fonts, photographs and stock assets properly licensed?
• Does a vendor retain prompts, customer data or outputs for further training?

Copyright protection for machine-generated material varies by jurisdiction and usually turns on human authorship or creative contribution. A business should not assume that payment for an AI service guarantees exclusive ownership or indemnity. Contract review should address training, confidentiality, warranties, indemnities, audit rights, data retention and allocation of responsibility.

7. Accountability and Governance Architecture

Accountability means that an organisation can identify who decided to use the system, who designed and supplied it, who monitors it and who remedies harm. A practical governance architecture includes:

An algorithmic impact assessment should record intended benefits, affected groups, foreseeable harms, alternatives considered, residual risk, safeguards, approval authority and review date. High-impact uses require stronger controls, independent testing and senior approval.

8. Compliance Metrics and Monitoring

Metrics should measure both technical behaviour and organisational control. Useful indicators include:

• percentage of AI systems inventoried and risk-classified;
• percentage with documented purpose, legal basis and data provenance;
• privacy and fairness test completion rate;
• model drift and performance degradation;
• demographic parity difference, equal-opportunity difference and calibration gap where appropriate;
• opt-out, deletion and access-request completion times;
• synthetic-content disclosure rate;
• substantiated complaints and average remediation time;
• percentage of vendors with contractual AI controls;
• number and severity of incidents;
• proportion of high-risk decisions receiving documented human review.

A compliance rate can be expressed as:

where N_c is the number of applicable cases meeting the control and N_a is the total number of applicable cases. The metric is meaningful only when the denominator is complete, the control is clearly defined and sampling is reliable. A 100% documentation rate does not establish that the documents are accurate or that outcomes are fair.

Monitoring should use thresholds and triggers. For example, a material change in data distribution, a significant fairness gap, a privacy incident, a new use case or a major model update should trigger reassessment. Dashboards must distinguish leading indicators—such as overdue reviews—from lagging indicators—such as confirmed consumer harm.

9. Regulatory Trajectory

The future regulatory environment is likely to combine risk-based AI regulation with existing privacy, consumer-protection, equality and intellectual-property law. Common developments include stronger transparency duties, restrictions on certain biometric or manipulative practices, obligations for high-risk systems, model documentation, incident reporting, supplier accountability and provenance or labelling expectations for synthetic content.

The precise legal rule depends on jurisdiction, sector and use. A multinational firm should build a control baseline that meets the strictest applicable requirements where feasible, while maintaining a jurisdictional obligations register. Regulatory anticipation should examine proposed laws, regulator guidance, enforcement decisions, standards and platform rules—not merely enacted statutes.

A sound strategic principle is compliance by design. Before deployment, the firm should ask whether the proposed benefit can be achieved with less data, less personalisation, less retention or a less intrusive channel. This turns compliance from a final approval function into a product and marketing design constraint.

10. Illustrative Case: The Meridian Advantage Campaign

Background

Meridian, a fictional financial-services marketer, develops an AI system to identify consumers likely to respond to a “financial resilience” product. It combines website behaviour, purchase data, location, device information and a third-party audience segment. It does not directly collect race, disability or health status.

Problem

The campaign produces higher conversion rates overall, but an audit finds that low-income neighbourhoods receive more high-cost offers, while affluent neighbourhoods receive more favourable products. The model also generates synthetic testimonials and uses a voice resembling a popular public figure. Complaints reveal that customers do not understand why they were targeted or how to opt out.

Analysis

The absence of protected fields does not eliminate proxy discrimination. Location and purchasing data may reproduce socioeconomic and protected-group disparities. Optimising conversion alone may reward harmful targeting. The synthetic testimonial creates authenticity and consumer-protection concerns, while voice imitation raises consent and publicity issues. Third-party data provenance and lawful basis are uncertain. The system may also require enhanced review because financial marketing can have significant consequences.

Approach

Meridian should pause the highest-risk targeting, preserve relevant records and conduct an impact assessment. It should:

1. identify all data sources, vendors, purposes and retention periods;
2. remove unnecessary attributes and test less intrusive models;
3. compare offer allocation, reach, error rates and costs across relevant groups;
4. prohibit targeting based on inferred vulnerability unless clearly lawful, necessary and ethically justified;
5. replace synthetic testimonials with verified, consented testimonials or clearly labelled fictional demonstrations;
6. obtain explicit permission before using an identifiable voice or likeness;
7. provide understandable targeting notices and accessible opt-out mechanisms;
8. require human approval for high-impact offers;
9. establish complaints, correction and redress channels;
10. monitor outcomes after relaunch and report to a governance committee.

Outcome

The revised campaign uses broader product eligibility, aggregated audience signals, conservative frequency limits and verified creative assets. Conversion falls modestly, but complaint rates decline, product distribution becomes more balanced and the organisation can explain its decisions and evidence its controls.

Learning points

The case demonstrates that compliance is not equivalent to model accuracy. It requires analysis of the complete delivery system, inferred characteristics, creative content, vendor relationships, consumer understanding and remedy. It also shows why fairness, privacy, intellectual property and accountability must be assessed together.

11. Best-Practice Framework for Managers

A graduate-level manager should be able to implement the following sequence:

1. Define the decision and harm: specify what the system does and who may be affected.
2. Map the data: record sources, permissions, inferences, vendors and retention.
3. Classify risk: consider sensitivity, scale, reversibility, vulnerability and legal consequences.
4. Assess alternatives: compare automated, human-assisted, aggregate and less intrusive designs.
5. Test before launch: evaluate accuracy, subgroup performance, privacy, security and content integrity.
6. Explain and obtain meaningful choice: communicate purpose, consequences and available controls.
7. Assign accountability: name owners, reviewers, escalation routes and remedies.
8. Monitor continuously: test drift, disparities, complaints, incidents and changes in law.
9. Document decisions: preserve evidence sufficient for internal and external scrutiny.
10. Retire responsibly: withdraw unsafe models, delete data where required and communicate material changes.

Challenges and Limitations

Governance metrics can create false confidence. Fairness definitions may conflict; protected-attribute data may be unavailable or legally sensitive; causal effects may be difficult to identify; vendors may limit access to platform data; and a model can be fair in development but unequal after delivery. Explainability can expose trade secrets or overwhelm consumers. Privacy controls can reduce measurement quality, while aggressive personalisation can undermine autonomy even when technically lawful.

Regulation also cannot answer every ethical question. A practice may be legal yet manipulative, socially divisive or inconsistent with a brand’s responsibilities. Ethical review should therefore consider dignity, agency, distributive justice, accessibility, sustainability and the interests of people who are not customers but may be affected by marketing systems.

Chapter Summary

AI marketing systems profile audiences, predict behaviour, personalise communications and generate synthetic content. Their risks arise across the lifecycle, from data acquisition and model design to platform delivery and post-deployment monitoring. Privacy requires lawful purpose, minimisation, transparency, retention control and respect for individual rights. Fairness analysis must examine proxies, delivery outcomes, intersectional groups and competing metrics rather than relying on one parity statistic. Explainability is valuable only when accompanied by meaningful human oversight, contestability and remedy.

Generative AI adds risks involving accuracy, disclosure, privacy, bias, copyright, trademarks, likeness and confidentiality. Effective accountability requires named owners, impact assessments, vendor controls, monitoring and documented decisions. Compliance metrics can reveal control performance, but their definitions and denominators must be scrutinised. The most resilient strategy is compliance by design: use proportionate data, test alternatives, anticipate regulatory change and treat consumer welfare as a core marketing outcome.

Key Terms

Profiling: Automated processing used to evaluate or predict personal characteristics or behaviour.

Targeting: Selecting audiences or contexts for marketing communication.

Automated decision-making: A decision produced wholly or substantially through automated processing.

Generative AI: AI that creates new text, images, audio, video or other content.

Synthetic media: AI-generated or AI-altered media that may imitate real people or events.

Proxy variable: A variable correlated with a protected or sensitive characteristic.

Algorithmic bias: Systematic distortion that produces unjustified differences in outcomes or treatment.

Demographic parity: Similar selection rates across defined groups.

Equal opportunity: Similar true-positive rates across groups.

Calibration: Consistency between predicted probabilities and observed outcomes across groups.

Explainability: The capacity to communicate and technically justify how a system operates or reaches an outcome.

Contestability: The ability to challenge, review and seek correction of an automated outcome.

Data minimisation: Limiting data collection to what is necessary for a specified purpose.

Data provenance: Evidence about the origin, transformation and permitted use of data.

Model drift: Change in data or relationships that reduces model validity over time.

Human oversight: Competent, authorised intervention in system operation or outcomes.

Algorithmic impact assessment: Structured evaluation of benefits, harms, rights and safeguards.

Compliance by design: Integrating legal and ethical controls into system and campaign design.

Accountability: The obligation to assign responsibility, provide evidence and remedy harm.

Review Questions

Short Answer Questions

1. Distinguish profiling from automated decision-making.
2. Why can excluding race or gender from a dataset fail to prevent discrimination?
3. What is the purpose of model calibration?
4. Identify two risks associated with synthetic testimonials.
5. Why is human approval alone insufficient as a governance control?

Long Answer Questions

1. Explain how privacy, fairness and consumer-protection risks interact in behavioural advertising.
2. Compare demographic parity, equal opportunity and calibration, including circumstances in which their objectives may conflict.
3. Design a governance architecture for a high-impact personalised marketing system.
4. Discuss the intellectual-property and accountability implications of using generative AI to produce campaign assets.
5. Evaluate how a multinational company should anticipate divergent AI regulation across jurisdictions.

Analytical / Application Questions

1. An advertising model has equal overall accuracy across two groups but gives one group substantially fewer employment-advertisement impressions. Analyse the possible causes, metrics and remedies.
2. A retailer wants to use customer-service conversations to generate personalised offers. Prepare an impact-assessment plan covering lawful purpose, privacy, bias, explainability, security and retention.
3. A campaign uses an AI-generated influencer who resembles a real celebrity. Recommend whether and how the campaign could proceed, addressing consent, disclosure, intellectual property, consumer deception and governance.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes profiling from automated decision-making?

A. Profiling always involves generative AI, whereas automated decision-making does not.

B. Profiling evaluates or predicts personal aspects, while automated decision-making produces a decision through automated means.

C. Profiling is anonymous, whereas automated decision-making always identifies a person.

D. There is no meaningful distinction between the concepts.

Correct Answer: B. Profiling evaluates or predicts personal aspects, while automated decision-making produces a decision through automated means.

Question 2

A model has selection rates of 0.60 for group A and 0.45 for group B. What is the demographic parity difference, using SR_A − SR_B?

A. 0.15

B. 0.45

C. 1.05

D. −0.15

Correct Answer: A. 0.15

Question 3

Why can a model discriminate even when it excludes race as an input?

A. Models cannot operate without race as an input.

B. Accuracy automatically creates discrimination.

C. Other variables may act as proxies for race or other protected characteristics.

D. Excluding race guarantees demographic parity.

Correct Answer: C. Other variables may act as proxies for race or other protected characteristics.

Question 4

What is the central purpose of contestability?

A. To increase advertising frequency.

B. To allow affected people to challenge, review and seek correction of an outcome.

C. To prevent all use of automated systems.

D. To conceal model logic from consumers.

Correct Answer: B. To allow affected people to challenge, review and seek correction of an outcome.

Question 5

Which practice best reflects data minimisation?

A. Collecting every potentially useful variable indefinitely.

B. Collecting only data necessary for a specified and justified purpose.

C. Purchasing more third-party data to improve accuracy.

D. Keeping all raw prompts permanently.

Correct Answer: B. Collecting only data necessary for a specified and justified purpose.

Question 6

Which is the strongest reason that a 100% compliance-documentation rate may be misleading?

A. Documentation is never relevant to compliance.

B. The documents may be incomplete, inaccurate or based on an incorrect denominator.

C. Documentation automatically creates bias.

D. Documentation prevents model monitoring.

Correct Answer: B. The documents may be incomplete, inaccurate or based on an incorrect denominator.

Question 7

Which issue is most directly associated with an AI-generated celebrity voice used without permission?

A. Model calibration only

B. Data minimisation only

C. Rights of publicity, consent and potential consumer deception

D. Equal opportunity measurement only

Correct Answer: C. Rights of publicity, consent and potential consumer deception

Question 8

What does calibration require in a predictive model?

A. Every group must receive the same number of advertisements.

B. A predicted probability should have a comparable meaning across groups.

C. All groups must have identical base rates.

D. The model must use protected characteristics.

Correct Answer: B. A predicted probability should have a comparable meaning across groups.

Question 9

Which action is the best example of substantive human oversight?

A. Automatically approving every model recommendation.

B. Assigning a reviewer who lacks authority to change outcomes.

C. Giving a trained reviewer time, relevant information and authority to intervene.

D. Removing all records after deployment.

Correct Answer: C. Giving a trained reviewer time, relevant information and authority to intervene.

Question 10

What is the most appropriate first response when an audit identifies potentially discriminatory high-impact targeting?

A. Increase campaign spending to obtain more conversions.

B. Pause or restrict the risky use, preserve evidence and conduct an impact assessment.

C. Delete all monitoring data immediately.

D. Remove the protected attributes and assume the problem is solved.

Correct Answer: B. Pause or restrict the risky use, preserve evidence and conduct an impact assessment.