First-Party Data Strategy: Marketing After Cookies
Why Google keeping third-party cookies changes nothing, the zero-party and first-party layers worth building, and how to activate data you actually own.
How to use AI in marketing without regulatory or trust damage - EU AI Act duties, disclosure rules, data governance and the review habits that hold it together.
Updated
Marketing teams adopted generative AI faster than their governance did. Most of the time that gap costs nothing, and then a chatbot goes unlabelled in a regulated market, a synthetic voice ships without disclosure, or a model invents a statistic that ends up in a press release. This category is about closing the gap without strangling the work.
I hold one position across everything here: the practices regulators now require - knowing what AI you use, reviewing what you publish, disclosing what’s synthetic - are the same practices that protect quality and audience trust anyway. Compliance done properly is mostly good editing with a paper trail.
Three fronts matter to a working marketer. The law: the EU AI Act’s transparency obligations apply from August 2026, and they name marketing surfaces directly - chatbots, AI-generated content, deepfakes. The platforms: Google, Meta and the ad networks now run their own AI disclosure regimes, which in practice bind faster and tighter than any statute. And the audience: no rule forces a reader to keep trusting a site that publishes unreviewed model output, which is the enforcement mechanism with no appeal process.
GDPR for marketers: what the law actually requires - the data half of the legal map: the two lawful bases marketing runs on, the absolute right to object, what Article 22 and the EDPB’s AI opinion mean for your tools, and the fines that made it real.
CCPA for marketers: what California’s law requires - the US state half of the privacy map: why your adtech stack counts as selling data, the GPC signal you must honor automatically, and what the Sephora, DoorDash and Honda fines actually punished.
EU AI Act for marketers: a compliance checklist - which of Article 50’s five transparency duties actually fall on a marketing team, the editorial-review exemption that saves content marketing, and a seven-step checklist to run this month.
FTC rules for AI in advertising: what’s illegal now - the US half of the map: the fake reviews rule, the substantiation duty on claims your AI wrote, what visibly changed in 2025, and the seven-item audit I’d run anyway.
Dark patterns in AI marketing: tactics to avoid - fake urgency, confirmshaming and hard-to-cancel flows, the two largest FTC penalties in history that they drew, why AI ships them by default, and the guardrails that keep them out of your funnel.
Do you have to tell customers you used AI? - the disclosure question split into its three real parts: what the law requires, what the platforms require, and what the trust research says a label costs - with the three-tier policy I run.
AI hallucination guardrails for marketing teams - why models invent facts by design, the court ruling that made a chatbot’s inventions the company’s problem, and the three-layer guardrail system: prompt rules, a verification gate, and contained live surfaces.
AI bias in ad targeting: how algorithms discriminate - the study that found neutral targeting still delivers along race and gender lines, the DOJ settlement that made it official, where bias enters campaigns you run today, and the audit that needs no data scientist.
AI governance for marketing teams: a working framework - the one-page version of NIST, ISO 42001 and the AI Act for a marketing team: three risk tiers, a five-question tool intake, an escalation matrix that knows whose problem each incident is, and the records that prove reasonable care.
First-party data strategy: marketing after cookies - why Google keeping third-party cookies changes nothing, the zero-party and first-party layers worth building, consent as a design requirement, and the activation moves that make owned data pay.
Brand safety and generative AI - the reputational layer above accuracy: the three surfaces where AI can hurt a brand, what the documented incidents teach, what audiences actually think of AI-made marketing, and the approval system that holds.
Governance is ultimately a leadership question - budget owners will find the wider framing in the CMO playbook, including what stays human no matter how good the tooling gets. More guides are coming here, starting with consent management. For the full picture, start with the complete guide to AI marketing.
Part of our complete guide to AI marketing.
All articles
Why Google keeping third-party cookies changes nothing, the zero-party and first-party layers worth building, and how to activate data you actually own.
A marketing-sized AI governance framework - risk tiers, tool approval, escalation and records - built from NIST, ISO 42001 and the EU AI Act without the binder.
Who the CCPA covers, why your adtech stack counts as selling data, the GPC signal you must honor, and what the Sephora, DoorDash and Honda fines teach.
The GDPR rules that bind marketing work - lawful basis, the absolute right to object, profiling limits, AI tools - read from the text, with the real fines.
Ad delivery can discriminate even when your targeting is neutral. The research and the Meta settlement that prove it, and the audit a marketer can run.
Brand safety used to mean where your ads ran. With generative AI the risk comes from inside: the incidents so far, what audiences think, and my guardrails.
A court has already ruled your chatbot's inventions are your problem. Why models make things up, and the three-layer guardrail system that catches it.
What the law actually requires you to disclose, what the platforms require, what the trust research says it costs - and the disclosure policy I run.
Fake urgency, confirmshaming, hard-to-cancel flows - the manipulation tactics that now draw nine-figure fines, why AI ships them by default, my guardrails.
What US law actually forbids when AI touches your ads - fake reviews, unsubstantiated claims, deceptive AI hype - and what changed in 2025. A working read.
Article 50 took effect on August 2, 2026. Which of the five transparency duties actually apply to marketing teams, and the checklist I'd run this month.