Why Marketers Should Keep Customer Data Out of AI Prompts

Somebody on your team has already pasted a CRM export into an AI chat window to "just get the subject lines done faster." It worked, everyone cheered, and 40,000 email addresses went to a third party with no one signing off.

This article argues for a simple habit: keep customer data out of AI prompts, and send segments and pseudonymous IDs instead. You will get the case, the best objection answered, and a small scrubbing script.

Why customer data in AI prompts is a real exposure

A prompt is a data transfer. The moment a name, email or purchase history leaves your systems, you have a new recipient to account for, and GDPR asks you to justify that.

Three things go wrong in practice:

• Data minimisation. GDPR requires personal data to be adequate, relevant and limited to what is necessary. A campaign brief does not need anyone's home address.
• No paper trail. A personal AI account is not a vendor you vetted. There is usually no data processing agreement, and you cannot easily answer a deletion request for something sitting in a chat history.
• Copies you cannot recall. Prompts can end up in logs, shared chats and browser extensions. Once pasted, you do not control where the data lives.

The fines GDPR allows are large, but the more common cost is quieter: a campaign paused while someone works out what was shared.

What to send instead of raw customer data

The model needs patterns, not people. Send what the task actually uses:

• Segment labels ("lapsed 90 days, bought twice, EU") instead of rows of customers.
• Aggregates ("38% opened the last email, mostly mobile") instead of per-person logs.
• Pseudonymous IDs where you need to match output back to a record.
• Merge tags such as {{first_name}} in the copy, filled in by your email tool after generation.

Add a pre-prompt scrubbing step

Put a small filter between your data and any prompt. The key idea is an allowlist: only named columns get through, everything else is dropped by default.

import csv
import hashlib
import hmac
import os
import re

SECRET = os.environ['PSEUDO_KEY'].encode()  # keep this out of the repo
ALLOWED = {'plan', 'region', 'last_order_days', 'segment'}
EMAIL = re.compile(r'[\w.+-]+@[\w-]+\.[\w.-]+')
PHONE = re.compile(r'\+?\d[\d\s().-]{7,}\d')

def pseudo_id(email):
    digest = hmac.new(SECRET, email.strip().lower().encode(), hashlib.sha256)
    return 'cust_' + digest.hexdigest()[:12]

def scrub_text(text):
    text = EMAIL.sub('[EMAIL]', text)
    return PHONE.sub('[PHONE]', text)

def scrub_rows(path):
    with open(path, newline='', encoding='utf-8') as f:
        for row in csv.DictReader(f):
            clean = {k: scrub_text(v) for k, v in row.items() if k in ALLOWED}
            clean['id'] = pseudo_id(row['email'])
            yield clean

The id is a keyed hash (HMAC), so nobody can rebuild the email from it without your secret. Keep the lookup from ID back to customer on your side, and join the model's output to it afterward. Adjust ALLOWED and the email column name to match your export.

The regexes are a safety net, not a guarantee. They will not catch a name typed into a free-text notes field, so keep those columns off the allowlist.

The objection: won't the output get worse?

This is the strongest argument against, so test it honestly. Ask the model for a win-back email using "Maria, 34, Lyon, bought running shoes in March," then again using "lapsed runner, 6 months, France, one purchase." For almost every marketing task the two outputs are equally good, because the copy is written for the segment anyway.

Where you truly need personalisation, do it after generation with merge tags. The model writes the template, your email platform fills in the name. You lose nothing the reader would notice.

Know the limit of pseudonymisation

Be straight with your legal team: pseudonymised data is still personal data under GDPR if anyone can re-identify it with extra information. The scrub lowers risk and satisfies minimisation, but it does not make the data anonymous. If a campaign genuinely needs raw personal data in a model, that is a job for an approved vendor with a signed processing agreement, not a personal chat tab.

First step this week

Ask your team one question: "What have you pasted into an AI tool this month?" Then pick the most common task, put the scrubber in front of it, and share the allowlist as the team default.

For anyone putting AI into production, the cheapest privacy control is deciding what never enters the prompt, because data you never sent cannot leak.