Personalization without being creepy
The line is not public versus private. A fact can be entirely public and still cost you the account, because two things have to pass: the context it belongs to, and the channel it reached you by. Here is the five-second test, the hard cases sorted, and what the rules actually say.
By Rahul Bageria, co-founder · Updated August 2026 · 11 min read
The hard cases, sorted
Twelve facts people argue about, with a verdict and a reason on each. How much research an account earns is a separate question, answered in our cold email personalization guide.
| The fact you want to use | Verdict | The reason |
|---|---|---|
| A job posting the company published this week | Fair game | Published on purpose, about work, rewards close reading. |
| A round, an acquisition, a launch, a filing | Fair game | Published deliberately, for strangers, about the business. |
| A talk, a podcast, a professional byline | Fair game | Published by them, in their field, for their peers. |
| Their role, and what it now owns | Fair game | The EDPB calls professional-role data more public in nature. |
| A visible stack: a tool named in a job ad | Fair game | The company chose to show it, and names nobody. |
| A LinkedIn post they wrote this month | Only with a condition | Take up the argument. Never recite the feed. |
| A LinkedIn post from four years ago | Only with a condition | The ICO's checklist asks how old the information is. |
| A job change | Only with a condition | Reference the mandate, never the move. |
| A conference badge scan | Only with a condition | Only from your own booth, on its own subject. |
| An anonymous hit, written up as "I saw you looking" | Never | Not evidence of intent, and possibly the wrong person. |
| An email open, a race time, a weekend, a child | Never | Wrong context. Being public somewhere is not the test. |
| A field your provider cannot source | Never | Article 14(2)(f) makes naming the source your obligation. |
Sources: the ICO's business-to-business marketing and legitimate interests guidance, read August 2026, the B2B page under ICO review after the Data (Use and Access) Act; EDPB Guidelines 1/2024, version 1.0; UK GDPR Article 14. We are operators, not lawyers, and none of this is legal advice.
Creepy is not about the data
Nothing in the fact makes a sentence creepy. The feeling comes from a gap, and once you see it the hard cases sort themselves.
The provenance gap is the distance between what a reader knows they told the world and what your sentence proves you know. Creepiness is them closing that distance mid-line, with no way to tell how much else you hold.
Aguirre traced it in 2015 to the reader's "sudden realization of the covert data collection". In their field test relevance lifted click-through, then one personal detail was added and it fell back sharply. Display advertising, not cold email: take the shape, never the rate.
Two things follow, and both invert the standard advice. More personal is not more risky; less explicable is. The reader runs this test whether you do or not.
Creepy is not a property of the fact. It is a property of the gap between what they told you and what you know.
The line is not public versus private
Public is a fact about the internet. Expected is a fact about the person. Ask two questions, and both have to pass. Helen Nissenbaum named this pair in 2004 as contextual integrity.
- •Is this a fact about them at work, in this role?
- •A race time fails. A migration they own passes.
- •Being public has no bearing on the answer
- •The EDPB calls professional-role data more public
- •Did it reach you the way they meant?
- •A careers page invites strangers. A badge scan does not.
- •The ICO: never assume public domain means agreement
- •Inferred is judged harder than stated
The ICO's sharpest illustration is one conference list, read twice. An organizer emailing delegates about its own next event is expected. That same organizer selling the list on is "likely to be unfair". Same data, same people, and only the channel changed.
One sharpening for LinkedIn. The ICO says people use professional networking sites in a "personal, albeit professional, capacity", so a DM is not automatically B2B marketing. That leaves what our post on LinkedIn versus cold email says about PECR intact, and adds a second check.
The disclosure test
Take the sentence you are unsure about. Attach ", and I know that because ___", fill the blank honestly, and read the whole thing back.
An illustrative walkthrough of the method, not a specific client result. We report real numbers only when they are real.
A clause you would want to hide
Someone at your company read our pricing page on Tuesday, and I know that because a script matched an anonymous visitor to a cookie graph.
- ✕You would never say the clause out loud
- ✕The clause is also why the name may be wrong
- ✕Cut the sentence, not the clause
Write the sibling fact instead
You price per seat and you are hiring two implementation leads. Is packaging on the roadmap this quarter?
- ✓Both facts they published themselves
- ✓Points at the problem the visit implied
- ✓The source is obvious, so no clause is needed
A true fact in the wrong context
Congratulations on the move to Austin, and I know that because a data vendor flagged a change of address.
- ✕Nothing in it is about their job
- ✕Public somewhere is not expected here
- ✕A vendor field is not a reason to write
A clause that survives being said
You moved off Salesforce, and I know that because your ops posting asks for HubSpot admin experience.
- ✓Reads better with the clause than without it
- ✓Someone did the reading, and it shows
- ✓Checkable by the reader in one second
Note what the test does not ask. It never asks you to put the source in the email. It asks whether the reason survives the reveal. A 2019 field study found the same: exposing a flow readers judge unacceptable makes an ad work worse.
The odd part is how close that rehearsal sits to a duty you already have. Where data did not come from the person, Article 14(2)(f) requires you to say "from which source the personal data originate", and Article 21(4) puts the right to object in the same breath.
The creepy sentence is almost always the one the researcher was proudest of. Twenty minutes of digging creates a debt that wants repaying inside the email. Run the test at the exact moment you feel pleased with yourself.
What the rules actually say, and what they do not
Two frames, and neither one is the creepiness test. A message can clear both and still lose you the account.
It governs how you send, not what you say about them
The FTC's own guide is blunt: "The law makes no exception for business-to-business email." Its duties are all about the envelope: honest headers, an ad disclosure, a postal address, a working opt-out. Nothing in 15 U.S.C. 7704 governs what you say about a recipient.
Where you got it, and being able to say so
You must name the source "and if applicable, whether it came from publicly accessible sources", within a month or at first contact. Quoted from the UK GDPR at legislation.gov.uk, which on these paragraphs matches the EU text.
An unqualified right to be left alone
A person can object to direct marketing at any time and processing must stop. Article 21(4) requires that right flagged "clearly and separately from any other information", not buried in a footer. Quoted from the same UK GDPR text at legislation.gov.uk, where 21(2) to (4) match the EU wording.
Compliance is not the same as expected
Two vendor misreadings die here. Guidelines 1/2024 says data "commonly processed in a given sector" is not necessarily expected (paragraph 52), and that meeting the notice duties "is not sufficient in itself" to make it expected (paragraph 53).
The two frames do different jobs. CAN-SPAM asks how you sent it and how they leave. The GDPR asks where you got it and whether they would be surprised. Neither is the creepiness test, and the reader gets there first.
Want outbound that is specific without being strange?
Book a Fit CheckWhen the best fact is one you should not use
The test is not a delete key. A fact that fails it still has a job, one level down, and most people throw away good research for want of this move.
-
1
Let it choose the account
A fact that fails the test is still a good reason to put a company on this week's list. Selection is private. Copy is not.
-
2
Let it set the timing
The same fact can say write on Tuesday rather than in six weeks. Our inbound-led outbound play has run this rule for a year without naming it.
-
3
Write the line from its public sibling
Almost every disqualified fact has a published one beside it pointing at the same problem. Open on that. Same relevance, none of the surprise.
For a fact that survives but sits near the line, do not soften it. A 2008 study of highly personalized email found people push back when the firm does not justify why the message fits. State the reason plainly, and put a real offer under it.
The four sentences that always fail
Four shapes cover nearly every creepy first line we read, and each fails the test for a different reason.
"I saw", "I noticed", "I came across" report your activity rather than theirs. A flat statement about the account has no provenance problem, because the provenance is obvious.
Old is not news, and quoting it proves only that you kept scrolling. The ICO's own checklist asks how long ago the information was collected.
A race time, a home move, a child, a commute. Wrong context whatever field your provider put it in, and the category that ends relationships rather than starting them.
Reading three of their posts back to them is not engagement, it is a log. Take up one argument they made, or leave the feed alone.
Naming the visitor is the one you cannot take back
Writing to someone because a pixel named them burns trust no follow-up repairs, and it may be the wrong someone: RB2B's own documentation says shared logins and devices can misattribute a visit. The split between company level and person level is settled on our website intent signal page.
How to check before you send
Four passes, in this order. The first two take a minute a campaign, and the audit is column-level rather than copy-level.
Audit the merge fields, not the copy
If a first line varies by a field the reader never gave anyone, you have industrialized the problem. One creepy variable ships four hundred times before anybody mentions it.
Run the test on the riskiest sentence
Out loud, once, on the line you were most pleased with. Wanting to hide the clause is the finding, and the check is over in five seconds.
Delete every sentence that starts with you
"I saw" and "I noticed" put your afternoon in the reader's inbox. Rewrite each as a flat statement about them and the provenance question disappears.
Where did this field come from?
Most cannot answer per field. Treat that as a buying criterion, not a compliance footnote: Article 14(2)(f) makes the answer your obligation, and the test makes it your copy problem.
- 1 Both context and channel must pass. Public passes neither.
- 2 If you would hide the clause, cut the sentence.
- 3 A failed fact still picks the account and the week. It just cannot write the line.
- 4 Nobody replies to say you were creepy, so the rule has to run before the send.
Questions founders ask
What makes personalization feel creepy?
How do I know if a specific line crosses the line?
Is it creepy to mention someone's LinkedIn post in a cold email?
Can I say I saw someone visit our website?
Is publicly available information always fair to use?
Does the GDPR change what I can personalize?
Co-founder of Real Good GTM. He has been the first business hire and Chief of Staff at seed-stage B2B startups, building outbound pipeline before any playbook existed. This post is the rule he applies to every first line before it goes out, written down properly for the first time.
Connect on LinkedInPut the test to work
The effort question, the sentence question, and the signal this rule gets used on most.
Cold email personalization
The ladder and the tiers: how much research each account earns.
Read the guideCold email opening lines
How a fact that passes becomes a first sentence worth reading.
Read the postThe website intent signal
Company level versus person level, and acting on a visit without naming it.
Read the signalWant outbound specific enough to work, and sourced well enough to say out loud?
Book a fit check. We'll look at the facts your market actually publishes, the ones your data provider cannot explain, and tell you straight if outbound is not the right motion for you yet.
Book a Fit CheckNo hard sell. No fake numbers. Real good work speaks for itself.