The Consent Gap: How Broken Data Permissions Create Creepy Customer Experiences

Customers value personalization when it feels within the boundaries they have set.

Customers do not "experience" your data architecture—but they sure as heck experience its failures.

This Signal & Noise exclusive is brought to you by Tealium.

Most brands do not set out to make customers uncomfortable. They invest heavily in personalization, customer data, journey orchestration, and increasingly, AI, not because they want to appear intrusive, but because they want to be more relevant, useful, and responsive. That's the goal, right? And yet, customers recognize the failure immediately, sometimes almost farcically. They opt out of targeted advertising, only to see the same campaign appear somewhere else. They buy a product, then receive a stream of acquisition messages for it. They change a preference, but the brand’s next interaction makes clear that no one—or no system—got the memo. It's infuriating and trust-destroying.

These moments are usually described as personalization gone awry from a Customer Experience (CX) perspective, which is true. From a marketer's perspective, they are more accurately understood as a consent gap: the distance between what a customer believes they have permitted and what the enterprise actually activates. The issue is when permissions fail to travel along with customer data, brands create experiences that feel repetitive, tone-deaf, and occasionally unsettling, or even creepy. The way CX works, the customer does not see the disconnected identity graphs, platforms, and workflows behind the experience. None of this stuff matters to them and is what we call "offstage." They simply conclude that the brand knows too much—or does not care enough—to use that knowledge responsibly.

The Difference Between Relevant and Creepy Is Permission

Personalization itself is not the problem per se. When push comes to shove, most people actually appreciate a brand remembering a preference, making a useful recommendation, or removing unnecessary friction from a transaction. Most of these things not only improve the shopping experience, but when it is done well, personalization can make an experience feel thoughtful and almost effortless.

The trouble begins when the value exchange becomes unclear, unequal, or just plain weird. A customer may understand why a retailer recommends products based on a recent purchase—in fact, many people like recommended products. But they may be far less comfortable when that same retailer appears to know something they never knowingly shared, or continues to act on information after they have explicitly limited its use. That is the point at which relevance starts to feel like surveillance or creepiness.

This is why consent cannot be treated like a binary legal event—one click, one banner, one record stored somewhere in the enterprise. Problem solved, right? Nope. Consent is ultimately contextual. This means that customers make different choices depending on the channel, the purpose, the information involved, and the value they anticipate receiving in return. For example, a person might welcome personalization on a retailer’s website, while summarily rejecting targeted advertising across the open web. They might be entirely comfortable sharing purchase history to improve customer service, but have no interest in having sensitive information influence an AI-driven recommendation.

The distinction may seem subtle inside an organization, but it is certainly not subtle to the customer. The line between relevant and creepy doesn't boil down to how much data a brand possesses, but whether the brand has permission to use that data in that particular moment—and whether it can honor the boundaries the customer has set.

The Consent Gap Is Created at Activation

This is where the conversation gets more complicated and more interesting. The underlying issue is, despite years of MarTech investment, most enterprises still do not have a single customer database, a single activation channel, or even a single definition of the customer. They probably do have a cloud data platform (Snowflake or Databricks), a CDP, a CRM, marketing automation tools, advertising platforms, analytics systems, customer-service applications, mobile apps, and now, increasingly, AI agents and recommendation engines. Customer data moves constantly between these systems, often at different speeds and for different purposes depending on the need.

In a perfect world, consent moves with it. When a customer updates a preference, limits a category of data use, or opts out of a channel, that decision should be reflected immediately across every downstream system that might act on their data. In reality, this is where things start to break down. A preference may be captured correctly in a consent-management platform, but fail to update an audience in a media-buying tool. It may be reflected in email, but not in a mobile application, or reach the data cloud, but never make its way into the AI experience now making recommendations on the brand’s behalf.

The resulting problem is not necessarily that one team made a bad decision. More often than not, it is that no one designed the system to treat consent as a live operational signal. In other words, the customer’s preference becomes just another record stored somewhere in the stack, rather than a rule that should actively govern what data can be collected, shared, modeled, and activated.

That is what I'm deeming the" consent gap." It opens whenever a brand can recognize a customer across channels well enough to personalize an interaction, but cannot—or does not—carry that customer’s permissions across those same channels with equal precision.

The consent gap opens when a customer’s choices do not travel with their data.

Four Experiences Customers Immediately Recognize

When reading this article, the concept of a consent gap probably seems abstract, especially when discussed in the context of enterprise architecture. It becomes very concrete, however, when viewed through the customer’s eyes. End of the day, most people have experienced some version of the following four scenarios:

1. The Opt-Out That Does Not Stick

   A customer takes the time to opt out of targeted advertising, only to keep seeing the exact same campaign across other sites, devices, or channels. Barf. They do not know whether the issue is a disconnected advertising platform, an incomplete identity graph, a delayed audience refresh, or just general incompetence. Nor should they have to. From their perspective, the brand ignored a clear request and trashed its reputation.

   
   

2. The Customer Who Is Still Treated Like a Prospect

   Someone makes a purchase and then immediately begins receiving acquisition messaging for the product they just bought. This is one of the oldest failures in digital marketing, yet it remains surprisingly common. A purchase signal may have reached the commerce platform but not the media audience, email engine, or journey-orchestration system. The result is not only wasted spend for the brand, but also an experience that makes the customer feel invisible and often infuriated.

   
   

3. The AI Assistant That Knows Too Much

   This is the newer—and potentially more consequential—version of the problem. Because of the way they are designed, an AI assistant can draw on customer context from multiple systems to make a recommendation, answer a question, or shape an interaction. This is one of the features that makes they so useful. But what happens if it references information the customer thought they had limited, removed, or never agreed to use in that context? The experience quickly moves beyond annoying and into deeply unsettling.

   
   

4. The Endless Consent Loop

   Finally, there is the opposite issue: brands that repeatedly ask customers for preferences because their systems cannot recognize, retain, or synchronize the choices already made. Customers are asked to log in again, reselect communication preferences, or accept the same prompt on every device. It may seem safer than overusing data, but it also signals that the brand lacks a coherent understanding of the relationship. NextDoor is probably the worst global offender in this category. Ever try managing your preferences or opting out of their communications? Good luck.

   
   

End of the day, none of these failures necessarily starts with bad intent—often to the contrary. The issue is they started with fragmented systems, disconnected permissions, and an enterprise architecture that treats customer data as more important than the customer’s instructions about how that data should be used.

When permissions break down, customers notice—often before the brand does.

When Data Distrust Creates Customer Distrust

There is an internal version of this problem that many organizations already understand. When teams do not trust their data, they hesitate to act on it. Who can blame them? This means dashboards get ignored and decisions slow down. Analysts spend their time reconciling discrepancies instead of finding insight. As Brad Millett recently argued in a thoughtful piece for BlastX, data distrust becomes a hidden tax on every customer-experience decision because people stop trusting the foundation beneath the work.

While none of this is good, the external version of this imbroglio is arguably even more consequential. When customers do not trust how a brand uses their information, they do not simply question a dashboard or ask for another validation pass. They disengage, withhold information, and (and least try to) opt out. They stop opening emails, stop responding to offers, and start interpreting every attempt at personalization through a more skeptical lens.

For a brand, this is a vicious cycle that's difficult to escape. A brand collects data in order to become more relevant. But if that data is used without sufficient clarity, context, or permission, the brand creates the very distrust that makes customers less willing to share information in the future. The result is poorer data, weaker personalization, and an even more fragmented relationship.

That is why consent should not be looked at like a trifling legal inconvenience standing between a brand and better customer intelligence. Consent is the critical mechanism that makes the value exchange sustainable and effective. Customers are far more likely to share information when they understand what they are receiving in return, believe the brand will use it responsibly, and know they can change their mind without having to fight the entire enterprise.

When teams cannot trust the data in front of them, every customer decision slows down—and every experience becomes harder to get right.

Relevance Requires Restraint

There is an age-old assumption in marketing that more data inevitably leads to better personalization. More signals should mean more accurate recommendations, more timely offers, more responsive service, and ultimately, more conversions and better outcomes. Sometimes this is true. But customer experience does not necessarily improve simply because a brand has more information at its disposal.

The best experiences are proportionate, not merely informed. This means they use the right information for the right purpose at the right moment. They don't try to turn every behavioral signal into a marketing opportunity, and they don't try to use every available piece of data simply because a system makes it possible.

In fact, one of the most important capabilities in modern marketing may be knowing when not to act. A customer who has just purchased definitely does not need another acquisition message. Nor does a customer who has limited a category of data use want the brand to find a neat technical workaround. A customer who shares information for a service issue should not be surprised down the road to see it shape an unrelated advertising or AI experience—no thank you!

No, not THAT kind of restraint!

No, this is not an argument against personalization. It is an argument for better personalization— grounded in judgment, context, and restraint. The brands that earn durable customer trust will be the ones that make the value exchange obvious: here is what you shared, here is why we are using it, and here is what you receive in return.

What Marketing Leaders Need to Fix

Fixing the consent gap does not begin with a better privacy policy, a new preference center, or another point solution added to the marketing stack. All of these things are what I would call table stakes—part of the minimum requirement for any organization to do personalization right. The right approach starts with an honest look at how customer data actually moves through the enterprise—and a determination whether customer permissions actually move with it.

The first step is pretty straightforward, if rarely easy: map where consent is collected, where preferences are stored, which identities they attach to, and every system that can activate the resulting data. This includes the data cloud (CDW), CDP, CRM, marketing platforms, advertising systems, analytics tools, customer-service applications, mobile environments, and AI agents. At every point, teams should be able to answer three questions: What data is being used, what customer permission applies, and how is that permission being enforced?

Due to its expansive, cross-disciplinary nature, this work cannot sit exclusively within legal or privacy teams. Marketing, CX, data, product, technology, and AI leaders all have a role to play. The goal is not to create another slow approval process that prevents teams from doing their jobs, but rather to build consent into the operating model early enough so that personalization can move at customer speed without creating new trust gaps downstream.

This is where a real-time customer data architecture matters. When consent is treated as a live signal—not a static record—it can be enforced at collection, reflected in profile updates, and carried through audience creation and activation. That is how brands begin to close the gap between what customers ask for and what the enterprise actually does.

Closing the consent gap begins with a shared, honest map of where customer data goes—and whether permissions travel with it.

The Future of Personalization Is Permissioned

The future of personalization will not belong to the brands that collect the most customer data, deploy the most sophisticated AI, or create the largest number of micro-segments. I believe it will belong to the brands that use customer intelligence with the most judgment.

That means building an enterprise where consent is more than a banner, a preference center, or a policy document. It must become a live permission layer that travels with customer data wherever it goes—into the cloud, through the CDP, across advertising and marketing platforms, into customer-service systems, and increasingly, into AI-driven experiences.

The payoff is significant. Brands that close the consent gap can reduce compliance risk, eliminate wasted marketing spend, and create more relevant experiences. More importantly, they can demonstrate something customers increasingly value: that personalization does not require surveillance, and that intelligence does not have to come at the expense of control.

Customers do not need to understand the architecture behind every interaction. They simply need to feel that a brand respects their choices. In the end, that is the test. The future of personalization is not knowing everything about a customer. It is knowing what you are allowed to do—and having the discipline to honor it.

------------------------------------------------

Rio Longacre

Rio is an executive with 20+ years at the intersection of strategy consulting, AdTech, data, and media. He's a trusted advisor on customer experience, digital strategy, and marketing transformation. He's a partner at Credera, Omnicom's consulting arm. He's also a podcast host, writer, and public speaker focused on the future of advertising and AI-driven infrastructure.