Authors: Marco Almada, Juliano Maranhao, Giovanni Sartor

I. Overview

Content personalisation consists of tailoring the information displayed to each individual based on information about him or her. For example, a newspaper website might suggest to its readers news items that are most likely to be relevant to their interests, based on their reading habits. Similarly, an eCommerce website may suggest that users look at products bought by other consumers with similar purchase habits. Various goals may drive a business decision to use content personalisation, such as providing users with information goods that fit their interests and preferences, increasing the uptake of advertisement or other persuasive messages, or promoting user engagement with a platform. Personalisation may deliver value to users, as they are presented with content that is relevant to their interests and might have escaped their attention in an information-rich environment. However, personalisation technologies can also negatively affect individual interests and social values. Personalisation can be used for the purpose of behavioural manipulation, since content selection and curation may be driven by the goal to influence users’ behaviour – e.g., their purchasing or voting choices – towards outcomes that do not fit their best interests. Content personalisation may reduce pluralism in the public sphere due to over-selection of content: certain users may not be exposed to points of view that are different from their own, so that they are confirmed rather than challenged in their opinions. Personalisation may also affect the quality of the information provided to users, as they may prefer, or in any case engage more with, information that attracts their curiosity or appeals to their prejudices.

Given the reliance of content personalisation on personal data, data protection law can address some of the risks introduced by personalisation technologies. Since all forms of personal data processing require a legal basis, we argue below that content personalisation is only lawful if it does not manipulate individual behaviour or does not contribute to the erosion of the public sphere. Even if content personalisation meets these standards, data controllers must still observe certain requirements, such as data protection by design and by default, and provide data subjects with the rights protected by the GDPR.

Not all individual and societal risks from content personalisation can be addressed by data protection law. In fact, many of the salient risks associated with tailored online environments – such as the impact of excessive personalisation on the public sphere – may persist even if the GDPR is scrupulously observed. Nevertheless, existing data protection law is a relevant instrument for preventing the misuse of content personalisation for manipulative, societal negative effects or otherwise unlawful purposes.

II. Defining content personalisation

Content personalisation refers to a broad range of practices that use technological means to adapt the content of communications to the identity of receivers. To analyse content personalisation as a goal-driven activity, we must consider both senders and receivers. In a commercial domain, the sender’s ultimate goals pertain to obtaining commercial advantages, or possibly political advantages (e.g., in the context of electoral campaigns). In the advertising domain, the purpose is to make it so that receivers of the personalised message purchase offered goods or services at the proposed (possibly personalised) conditions. In those services that do not consist in advertising but are still paid by advertising – such as search services, social networks, online news or content repositories –, the senders’ main goal is to keep receivers on the service as much as possible, so that they can be exposed to advertising. In the domain of political propaganda, the goal is to influence opinions and voting behaviour of the receivers. In paid services, the purpose is to keep users on the services, by providing them with content that they may want to consume (more than content offered by competitors).

The senders’ goals can only be achieved to the extent that the targeted messages succeed in engaging receivers, fitting, at least to some extent, the preferences of the latter. This leads to an overlap between the goals of the senders and the goals of the receivers. However, senders may consider such interests only instrumentally, i.e., to the extent that this contributes to pursuit of their final goals. Thus, advertisers may not recommend to each consumer the product that best fits his or her interests, at the most convenient price; it may rather propose the product that the targeted customer, stimulated by the message, may be interested in purchasing at the highest price that he or she may be ready to pay. Similarly, in the case of the provision of news, feedback and other content in an advertising-driven service, news providers may not recommend to each receiver the items that best fits his or her information needs (e.g., being most informative and reliable); they may rather propose the items that are more likely to engage the receiver, so that he or she may pay attention to such items, and possibly want further engagement with similar ones. In the case of political advertising, senders may not recommend to each receiver the political party or candidate that best fits his or her reasoned preferences; it is sufficient that the message fits the opinions of the receiver and is likely to induce the desired political attitude or voting behaviour. The alignment of messages to the senders’ goals – and at the same time, to the extent instrumentally needed, to the receivers’ interests of the – may take place automatically, i.e., through methods based on machine learning and in particular to reinforcement learning: the system will learn to suggest whatever content leads to more clicks, purchases, or engagement. As we shall see in the following, the goals pursued through personalisation and their relation to the receiver’s interest are central also for assessing the use of personal data for personalisation purposes.

[…]