Ad personalisation is the practice of choosing which advertisement a particular person sees on the basis of data held about that person, rather than on the basis of the content they are reading or watching. The inputs can be browsing history, app activity, past purchases, a customer list uploaded by an advertiser, demographic inference, or a conversation with a chatbot. The output is an advertisement selected for a profile rather than for a page. Platform interfaces spell the term with a z, and the Consent Mode signal that governs it in Europe is written ad_personalization.

The practice exists because advertisers pay more for it. It survives in its present shape because roughly two decades of regulation, litigation and platform policy have built a permissions layer around it, and almost every operational decision in programmatic buying now runs through that layer before an advertisement is chosen.

How an impression is personalised

Three things have to happen before a personalised advertisement renders. Data has to be collected and tied to an identifier. That identifier has to be matched to one or more audience segments. And a bid request carrying both has to reach a buyer permitted to act on them.

Collection runs through cookies, mobile advertising identifiers, hashed email addresses, and publisher-generated identifiers, fired by a pixel or a software development kit embedded in a site or app. Segment membership is then held on the buy side. Google's advertising policies split the resulting audiences into two classes: advertiser-curated audiences, which cover Customer Match lists, data segments, audience expansion, lookalike segments and custom segments, and predefined Google audiences, which the company builds itself. The distinction matters downstream: advertiser-supplied lists are treated as the riskier of the two and lose permissions that Google's own segments keep.

Transport is standardised. In an OpenRTB bid request, the user object carries the identifier alongside a data array; each Data object names a provider and holds Segment objects of id, name and value, with an ext.segtax field declaring which taxonomy those segment identifiers belong to. Consent travels in the same request, through a consent attribute carrying the Transparency and Consent Framework string and a gdpr flag on the regs object. A bidder reading a request without those permissions is expected to drop the profile and bid on context alone.

That produces a ladder of serving modes rather than a switch. Personalised ads sit at the top. Below them are non-personalised ads, which use contextual and coarse geographic signals only; limited ads, a European mode triggered by an ltd=1 parameter in the ad tag and opened to programmatic demand in 2024; and restricted data processing, the equivalent for United States opt-outs. Those three modes mark the outer boundary of the practice inside Google's systems.

Origin and evolution

Targeting by person rather than page predates the web, but the modern version dates to the second half of the 2000s. The Federal Trade Commission held a behavioural advertising town hall in November 2007 and published revised self-regulatory principles on 12 February 2009, warning the industry it was close to legislation. Google launched interest-based advertising in beta on 11 March 2009 with roughly 30 top-level and 600 detailed interest categories and a user-facing Ads Preferences Manager, according to Search Engine Land's report at the time. Trade bodies answered on 2 July 2009 with their own Self-Regulatory Principles for Online Behavioral Advertising, and the AdChoices icon programme followed in October 2010.

European law then changed the default. The General Data Protection Regulation applied from May 2018 and made consent the practical basis for cross-site profiling. IAB Europe answered with the Transparency and Consent Framework, which the Belgian data protection authority found incompatible with the regulation in February 2022. Apple's App Tracking Transparency arrived with iOS 14.5 in April 2021 and cut identifier access sharply, with reported opt-in rates of 11 to 15 per cent after launch. Google added the ad_user_data and ad_personalization parameters to Consent Mode in December 2023, made them mandatory for European traffic from March 2024, and began disabling personalisation and remarketing for non-compliant accounts on 21 July 2025.

The replacement technology failed. Privacy Sandbox, announced in 2019, was meant to deliver interest-based targeting without third-party cookies. Google retired Topics, Protected Audience and seven other APIs on 17 October 2025, citing low adoption, six months after abandoning cookie deprecation itself.

What it is worth, and who says so

The commercial case rests on a price gap that is measured inconsistently. Google research found that impressions without a cookie earned publishers 52 per cent less, and figures circulating in the industry put personalised inventory 50 to 70 per cent above non-personalised alternatives. The UK Competition and Markets Authority, testing Privacy Sandbox in 2023 and 2024, measured publisher revenue per impression about 30 per cent lower without third-party cookies.

Independent estimates are lower and scattered. A survey of the literature in the 2024 paper Paying for Privacy: Pay-or-Tracking Walls lists four studies of advertisement prices without tracking: falls of 8 per cent, 5.7 per cent, 52 per cent and 18 per cent, depending on whether the data came from one publisher or an exchange, and whether prices were measured as paid by advertisers or received by publishers. The range spans an order of magnitude, and every large figure in the debate originates with a party that sells personalised inventory.

Meta supplies the largest self-reported numbers. Its Less Personalized Ads option, introduced for European users in November 2024, uses about 90 per cent less data, and the company reported 70 per cent fewer onsite conversions and 61 per cent fewer offsite conversions against personalised delivery, alongside a near 800 per cent rise in advertisements closed as irrelevant or repetitive. Those are Meta's own measurements, filed while contesting a European Commission decision.

Where it is switched off

Restrictions operate by category and by age rather than by technique. Google's personalised advertising policy names sensitive interest categories covering health, negative financial status, race and ethnicity, religious belief, criminal history, political affiliation, trade union membership and sexual behaviour, and bars advertiser-curated audiences for advertisers promoting products inside them. The company extended that reading to Demand Gen and Discovery campaigns on 3 June 2026, which use advertiser-curated audiences by default. Its published policy also states that users under 18 are ineligible for personalised advertising of any kind, including predefined Google audiences, and the company began using machine learning age estimation to enforce that in the United States from 30 July 2025.

European law reaches the same outcome from a different direction. Article 26(3) of the Digital Services Act bans advertising based on profiling that uses special category data, and Article 28(2) bans profiling-based advertising to recipients a platform knows with reasonable certainty are minors. The European Data Protection Board confirmed in Guidelines 3/2025 that the first prohibition applies regardless of any derogation available under data protection law.

Limitations and disputes

The unresolved question is whether the consent underpinning the practice is valid. The Court of Justice held in July 2023 that a dominant platform needs consent to combine data across services, and in October 2024 that personalised advertising cannot use unlimited quantities or types of personal data even where consent exists. Meta's consent-or-pay model has drawn a 200 million euro Commission fine and a BEUC finding that its fourth interface iteration still buries the less personalised option behind a separate tab.

Implementation is a second weakness. Consent Mode signals must reach Google's tags in the correct sequence or nothing registers, and PPC Land documented a case in which conversions collapsed by 90 per cent overnight because a banner recorded choices without transmitting them. Roughly 40 per cent of the lost data was recoverable.

Consumer evidence is mixed rather than damning. A Digital Advertising Alliance survey published on 24 February 2026 found 85 per cent of Americans recognised the AdChoices icon and 88 per cent expected interest-based advertising, a result published by the body that runs the icon.

Not the same as

Contextual advertising selects on page content and needs no profile. Dynamic creative optimisation assembles the advertisement itself from components once a person has been selected, as with LinkedIn's Ads Personalization tool, which inserts job title or company into copy. Retargeting is one input, covering people who already visited an advertiser. Consent Mode is the plumbing that signals permission, not the targeting itself.

Recent developments

The signal base is widening while the cookie base narrows. Meta began feeding conversations with its assistant into personalisation on 16 December 2025 with no opt-out, covering more than a billion monthly users. OpenAI's advertising manager now matches advertisements to the current conversation and, for users who enable personalised advertisements, to past chats, memory and prior advertisement interactions.

Controls are being consolidated at the same time. Google is collapsing the account, property, link and event level personalisation settings in Analytics so that the ad_personalization signal alone decides the question, with no date published. Europe's legislative answer is unsettled: the EU Council removed the automated consent signal from the Digital Omnibus on 18 June 2026 after lobbying in which Google featured, leaving Parliament as the only route to restore it.

Timeline

  • November 2007: The Federal Trade Commission holds its behavioural advertising town hall.
  • 12 February 2009: FTC staff publish revised self-regulatory principles for online behavioural advertising.
  • 11 March 2009: Google launches interest-based advertising in beta with about 30 top-level interest categories.
  • 2 July 2009: Advertising trade bodies publish the Self-Regulatory Principles for Online Behavioral Advertising.
  • October 2010: The AdChoices icon programme launches.
  • 25 May 2018: The General Data Protection Regulation applies.
  • August 2019: Google announces Privacy Sandbox.
  • 26 April 2021: App Tracking Transparency ships with iOS 14.5.
  • 2 February 2022: The Belgian data protection authority rules the Transparency and Consent Framework incompatible with the GDPR.
  • 4 July 2023: The Court of Justice rules in C-252/21 that gatekeeper data combination requires consent.
  • December 2023: Consent Mode v2 adds ad_user_data and ad_personalization.
  • March 2024: Consent Mode v2 becomes mandatory for personalised advertising on EEA and UK traffic.
  • 4 October 2024: The Court of Justice limits the quantity and type of data usable for personalised advertising in C-446/21.
  • November 2024: Meta launches Less Personalized Ads in the European Union.
  • 22 April 2025: Google abandons third-party cookie deprecation in Chrome.
  • 21 July 2025: Google begins disabling personalisation and remarketing for non-compliant EEA and UK advertisers.
  • 30 July 2025: Google starts machine learning age estimation for advertising protections in the United States.
  • 11 September 2025: The European Data Protection Board adopts Guidelines 3/2025 on the DSA and the GDPR.
  • 17 October 2025: Google retires Topics, Protected Audience and most other Privacy Sandbox APIs.
  • 19 November 2025: The European Commission publishes the Digital Omnibus proposal.
  • 16 December 2025: Meta begins using assistant conversations for advertising personalisation.
  • 24 February 2026: A Digital Advertising Alliance survey reports 85 per cent recognition of the AdChoices icon.
  • 3 June 2026: Google clarifies that Demand Gen and Discovery campaigns may be restricted in sensitive interest categories.
  • 18 June 2026: The EU Council removes the automated consent signal from the Digital Omnibus.

Summary

Who: Advertisers and their agencies define the audiences; demand-side platforms match them to impressions; publishers, consent management platforms and browser or operating system vendors control the signals that permit the match. Regulators in Europe and competition and privacy authorities elsewhere set the outer limits.

What: Selection of an advertisement for a person rather than for a page, using identifiers, behavioural histories and uploaded customer data, transported through bid request fields and gated by consent signals including ad_personalization and the Transparency and Consent Framework string.

When: Commercially established between 2007 and 2009, reshaped by the GDPR from 2018, by App Tracking Transparency from 2021, and by Consent Mode v2 enforcement from 2024. The technical replacement for third-party cookies was abandoned in 2025.

Where: Across search, display, video, social, retail media and connected television, with the strictest permission architecture in the European Economic Area, the United Kingdom and Switzerland, and category and age restrictions applied globally by platform policy.

Why: Personalised inventory sells at a premium, though estimates of that premium range from single digits to more than 50 per cent and the largest figures come from parties that sell it. The regulatory counterweight is that the same data supporting the premium can reveal health, belief, finances or age, which is why the restrictions are drawn around categories of person rather than around the technique itself.