Skip to content
All Blogs

The five privacy personas and how to adapt to each

Author: Laura Ballam


Marketing is ever-changing, and the current privacy evolution may be the biggest yet. It’s also presenting a massive opportunity for marketers to step up and stand out, adapting their focus to be more customer-focused than ever dreamed possible.

Contrary to popular opinion, it's not the end of days for marketers. It’s an opportunity to do it the right way. And the brands that do are going to be the ones that end up winning against their competitors. This is a huge opportunity to gain competitive advantage for organizations that rethink their entire technology stack and ensure they've got vendors that align with this go-forward strategy.

Privacy is a consumer preference, just like color, style, and communication style. Marketers must tailor their privacy experience the same way they do the customer experience. In that spirit, Stephanie Liu, Privacy & Marketing Analyst at Forrester has identified five distinct privacy personas, in terms of how willing they are to share their personal information:

  1. Reckless Rebels: Readily share data, don’t have too many concerns about their privacy. They're the most likely to say they're comfortable sharing location data if they get something in return.
  1. Conditional Consumerists: Love to shop and love loyalty programs, they love tech, but they're also very privacy-aware. They’re the most likely to use ad blockers but they’ll share data if you give them an incentive like those loyalty program perks.
  1. Data-Savvy Digitals: Similar to conditional consumerists, except the perks don't work for these folks. These are people who don't share data if they don't have to.
  1. Nervous Unawares: The least tech savvy, the least aware of the data economy. These consumers want to protect themselves, but don't know how to.
  1. Skeptical Protectionists: The oldest segments, they trust the fewest companies and actively limit their data sharing.

According to Forrester, these five personas are defined by four different factors:

  • Willingness to share information: Does a loyalty program entice them? Are they willing to sign up for that loyalty program and share some information to get the points and the perks, etc.?
  • Privacy awareness: Do they read privacy policies? Are they aware their information and activities are collected by the sites and apps they use?
  • Comfort with the data economy: are they comfortable with companies sharing and selling their information? Are they comfortable sharing their location data knowing that's probably going to be it resold to other parties
  • Protective behaviors: Are they taking measures to limit data collection by apps and sites? Are they trying to limit how much personal information they share?

What does this mean for marketers?

If you're not thinking about data from the perspective of Forrester’s five privacy personas, you're risking the trust of those consumers who might be providing you data without any concern because they love your brand, they feel comfortable doing it, and there's a perceived value in exchange for it.

You must think through the personas and define strategies for what you're going to do in each of those situations - and what you're even able to do from a legal perspective. At the end of the day, marketing is trying to increase relevance, but to increase that relevance, you can't always be on a one-to-one basis, depending on how an individual is behaving or the consent they’re providing in that moment. Having a dynamic personalization strategy in place for each persona will ensure you’re maximizing every opportunity to deliver a relevant experience for every individual.

What does it mean for personalization strategies moving forward?

The idea of treating everyone like what Liu defines as a Reckless Rebel, who shares data carelessly and likes personalization, is very outdated. Forrester’s five privacy personas represent a wide variety of attitudes. And these attitudes are constantly evolving as consumers gain more and more control over their experiences – when they share data, and when they don’t share data. Not everyone wants to engage in a world of consented and transparent data collection. And that’s ok – but marketers need to understand, accept, and adapt to that reality.

The characteristics of each persona will dictate what you can and should do with your various marketing initiatives. If you think about campaigns you want to run as an advertiser or as a marketer, they're only going to work for certain individuals because some of them rely on different levels of data being shared to execute effectively.

There are two key segments identified by Forrester that marketers need to be highly aware of - Conditional Consumerists and Data-Savvy Digitals. These are people with major purchasing power. More than half of each segment are the primary contributors or payer of their household expenses, and 61% of each persona say that they're the primary decision maker for household purchases.

They control a lot of the buying decisions, but they're also really hard to reach. They're very privacy savvy and they're the least likely to say they engaged with email ads. Only about a quarter will actually open those ads. Treating these major buyer segments like Forrester's Reckless Rebels won’t work.

Even when it comes to personalization in your owned properties, like your websites and mobile apps, it’s dependent on what that person is willing to share. That will ultimately dictate whether the things you’re trying to do to provide a positive experience for consumers will be effective.

Even more complex, what an individual is willing to share can vary daily depending on whether they decide to accept cookies or not within a given browsing session. And it most definitely can vary from organization to organization, so while an individual may be categorized as one of Forrester's Reckless Rebels on a trusted brand site they’ve done business with for years, they may be identified as one of Forrester's Data-Savvy Digitals with a different brand.

People may also behave differently with different brands or find themselves in different personas, depending on how they perceive a brand to be using their data. Especially the savvier personas. If an organization tries to personalize but does a terrible job, or offers a subpar product when they’ve already purchased the higher end version, then the perception is that the company is foolish and/or aren’t doing a good job with their data, so why would they share more?

To keep people engaged, to build and keep their trust and build that relationship, you must rethink your marketing strategy. You must leverage strategies and technologies that will work in every single one of those categories. So, what does that look like?

For Forrester's Reckless Rebels, it’s pretty unlimited. You can capture data across all channels, domains, and devices to build comprehensive identity profiles that fuel your personalization efforts. Just remember to maintain focus on delivering value and using data ethically and logically to create a relevant customer experience.

For the middle of the spectrum, it's important to think about the right moments to personalize - i.e., personalize the personalization. Ask the consumer for input instead of assuming that everyone wants full-scale personalization. Look for opportunities to ask what products they’re interested in and how you can best serve them. This is especially helpful when you remember consumers have different levels of comfort with different brands.

Even with Forrester's Skeptical Protectionists you can deliver a relevant experience. If somebody opts out and shuts everything off and turns the room dark, there's still an opportunity to present that individual with reasons why they might want to share something with you later in the journey. Presenting them opportunities to inch back in as you build their trust doesn't have to be all or nothing. It just has to be really well thought out from a brand to consumer perspective.

if you want to maintain your relationship with consumers it comes down to respect and compliance. This includes respecting that behaviors and preferences may change across different channels and devices. An individual who opts in on their laptop may block everything on their mobile.

The technologies you're using to capture data or to contextualize those experiences must be able to manage that. They must be able to change how they're behaving in-the-moment and be able to remember that, persist it, and really embrace privacy restrictions.

What do you do as a marketer or advertiser when consumers opt out?

When you have visitors who’ve turned off all data capture, the ones that don't want to share data, what do you do? In one environment in Europe, a client indicated that their consumers opt out of tracking one way or another over 60% of the time.

For a marketer, that's a massive challenge. What are you going to do when you don't know anything about those individuals, when you're not able to capture information? A lot of people have written about a cookieless future, and cookieless technology. But when you drill into it and you start reading it, it still sounds a lot like a cookie – because it is. No one has been able to deliver a solution. Until now.

Celebrus CX Vault is a true cookieless solution – no BS.

If you go to a website where Celebrus is deployed and the customer's got this functionality running, when you opt out of tracking the opted-out session begins on that website or mobile app, and Celebrus does two things. First, we completely sever the connection. Then we put a vault in your device for that session, for that domain. That vault contains two things:

  1. A list of machine learning algorithms that run based on contextual relevance. Insight is gathered from the session as you journey the website or the mobile app, as you look at products or add things to your cart, or perhaps interact with forms or watch videos and other content. The machine learning models that CX Vault provides out-of-the-box create signals.

These aren't individual signals. They're just signals of interest and intent based on the content you're consuming which is then paired with a ruleset.

  1. A ruleset that states if certain signals happen, an action should be taken. Maybe it’s showing a certain page, or directing you to a certain channel. Maybe it’s showing the consumer a personalized experience where content is pre-sorted in a different way to show them something they care about. But everything, including the ruleset and activation, happens within the device.

The critical piece is that as all of this is happening, the data is never captured, never shared, never stored, and cookies are never set. It's entirely managed by the consumer on their device for that channel on that domain. It doesn’t remember who you are. It doesn’t build an identity. It doesn’t even put a cookie or a device ID on the device.

It runs completely severed and provides an opportunity for any brand to be able to take that segment of people where the room is dark, and at least try to guide them to whatever it is they're interested in. This is patented. It's the only patented cookieless solution in the space today that actually puts privacy first.

The brands that embrace privacy-first will be the winners

At the end of the day, you've got different privacy personas and you must come up with solutions for each one because all of them, regardless of how they feel about data sharing and privacy, still expect to have a good digital experience with you.

Brands and marketers have been treating everyone like a Reckless Rebel who’s willing to share data and loves personalization. Which is fine for about a third of US online adults. But it leaves the two thirds who don’t love hyper-personalization out in the cold.

Remember, it doesn't have to be all or nothing. Done right, brands can help graduate people into different categories for different types of things they're interested in.

Marketing has never looked at it like everyone’s in the same bucket when they try to build personas or segments for targeting, so trying to do that with consent doesn't make any sense. It’s much more effective to overlay these privacy personas against a marketing strategy to ensure you're doing whatever it is you can for each of them. And over time, figure out what persona your ideal consumer base generally tends to fall within.

It's pretty easy to get to this level of privacy-focused personalization if you think about it as a journey of getting to know consumers with a compliance-first mindset, then use that to then dictate how you interact with those individuals and how you can add value regardless of where they fall on the spectrum. It doesn't always have to rely on data collection and sharing that information – you can provide a relevant experience while still completely respecting privacy.

Subscribe to our blog for regular updates!