What are privacy implications of segmentation?

Every segment you create is built on data about real people. That's not a reason to avoid segmentation, but it is a reason to be deliberate about what data you collect, how you use it, and what you tell subscribers about it.

Lawful basis (EU/GDPR). If you're sending to subscribers in EU countries, you need a documented lawful basis for processing the data behind your segments. For marketing segmentation, this is usually consent (what subscribers agreed to when they signed up) or legitimate interest (the more nuanced route that requires a balancing test). Behavioral profiling, which is what advanced segmentation often involves, can trigger additional GDPR requirements. If you're building segments from inferred attributes or combining data across multiple sources, check whether your current privacy policy and consent capture covers this use.

CCPA (California). Under CCPA, subscribers have the right to know what data you've collected about them, the right to opt out of its sale or sharing, and the right to have it deleted on request. If you're creating segments from behavioral data on California residents, your privacy policy should clearly describe this. Giving subscribers a way to opt out of behavioral profiling (not just email unsubscribe, but data-based targeting) is good practice regardless of whether you're technically required to.

Data minimization matters practically, not just legally. Only collect the data you actually need to run your segments. If you don't have a use case for income-level segmentation, don't collect income data. Each unnecessary attribute is both a privacy risk and technical overhead you don't need.

Transparency in your privacy policy. If your segments are based on inferred attributes or behavioral patterns (things subscribers didn't explicitly tell you), your privacy policy should say so. "We use information about how you interact with our emails and website to personalize the content and offers we send you" is a reasonable description. Vague or absent disclosure is where companies get into regulatory trouble.

Cross-border segmentation adds one more layer. If subscriber data crosses between regions (EU to US, or vice versa), data transfer restrictions like GDPR's adequacy requirements may apply. Using a US-based ESP to send to EU subscribers is generally fine under standard data processing agreements, but get your legal team or a privacy advisor to review the setup if you're unsure.

For the practical side of collecting consent and managing preference data, the preference center setup guide covers what to document. For more on the GDPR specifics, the regional compliance guide goes deeper.