Data Protection in the era of AI-powered marketing (III)

Por: Paola Cardozo Solano - PhD Researcher & Lecturer. Vrije Universiteit (VU) Amsterdam, The Netherlands

Third edition. Dara Protection considerations for chatbots and AI-CRM solutions

In the first edition, we explored the transformative impact of Artificial Intelligence (AI) on marketing, highlighting how these sets of technologies have revolutionized the way businesses engage with customers.

Nevertheless, AI’s power to process vast amounts of data, which has created unprecedented opportunities for marketers, has also raised concerns about the potential risks to data protection, privacy, and individual autonomy. Building on these concerns, the second edition focused on the critical issues surrounding data protection in the era of AI-powered marketing. In this post, we turn our attention to two widely adopted solutions in marketing and sales: AI-based Customer Relationship Management (CRM) systems and chatbots. We will first examine their capabilities and benefits from a marketer’s perspective and then shift our focus to the challenges these solutions present through the lens of data protection.

Exploring AI CRM

A regular Internet user is exposed to an average of 4,000 to 10,000 advertisements per day, making the digital landscape highly competitive. Therefore, to effectively stand out, it is fundamental for companies to accurately identify the target audience, i.e. the specific segment of the market that is most likely to make a purchase (Gomez Albrecht et al., 2022). Such a result can be achieved successfully through the processing of a substantial volume of personal data. Customer Relationship Management (CRM) software is specifically designed to process information, including sensitive data, on a large scale with a high level of granularity, for commercial purposes.

An illustrative example can be found in an advertisement by Salesforce, one of the leading CRM providers globally, featured on YouTube, where they promote their software. The scenario depicted in the advertisement progresses as follows: Celeste is interested in getting a scooter; she has seen it 43 times on the website of a scooter dealership company that Carol runs. Thanks to Carol’s CRM, the marketing team got the necessary information to send Celeste an email inviting her to get a test drive, where the sales team offered her nice accessories that they knew she would love. The CRM allowed every department of the company (marketing, sales, commerce, and service), to know Celeste better and to have a peek at her information. As soon as Celeste gets home, she receives a message with tips for her new scooter, some suggestions on additions, a personalized storefront, and an invitation to connect with other scooter lovers by following the brand social media. Carol’s CRM is getting smarter, providing useful analytics for every customer and potential customer, enabling the team to provide captivating, personalized purchase suggestions (Salesforce, 2021).

CRM software can be defined as the set of technological solutions applied to organizational processes designed to manage customer relationships with the ultimate objective of forging lasting connections with specific clients (Choudhury & Harrigan, 2014). Authors such as Saura et al. (2021) identify that due to technological developments, increased storage capacity, and vast amounts of available consumer data, CRM is not used anymore to organize customer information but to manage the interaction between clients and the company. One of the great benefits of this software is that it allows for the management of customer, vendor, and sales contacts, as well as relationships, interactions, activities, and teams, all in one platform (Zoho, 2015).

AI optimizes this process as it can identify trends and patterns more effectively. In their study, Saura et al., (2021) explore AI-based CRM and its applications, emphasizing its role in enhancing business intelligence strategies through customer data analysis. These AI-driven solutions are useful tools for marketers and companies as they allow them to understand their customers’ preferences better, share data among businesses, automate tasks, and generate predictions on purchasing behavior, loyalty, marketing and sales strategies (Saura et al., 2021).

Data protection considerations for AI-CRM solutions

As Ma & Sun (2020) explain, powerful and rapidly-evolving machine learning methods make large-scale, specific targeting and personalization possible. Where rich data exist, segmentation can get to the point where every customer constitutes a microsegment. Behavior data allows for delivering the right offering “to the right consumer at the right time in the right context” (p.490).

CRM software constitutes an example of these capabilities. AI-powered CRM software can gather personal data about customers and prospects in the like of names, identification numbers, financial information, preferences, information about lifestyle, sexual orientation, among other data depending on the needs of the company using the software and the kind or products it sells. Then, the platform creates and manages specific content tailored for the client, and allows the firm to engage with the client or potential client on the channels the person has agreed to be contacted (Microsoft, 2022) (Sage CRM, 2018)(Salesforce, 2021).

It is also possible to integrate the CRM into products such as e-mail marketing, offered by other providers or by the same provider, then personal data will be exchanged with other platforms or actors (Sage CRM, 2018). The platform can store the personal information of the data subjects, analyze it, provide predictions and insights, and transfer that information from the country of origin to the country where the CRM software provider’s servers are located (Luyt, 2023).

Therefore, it holds particular significance for the field of data protection to investigate marketing software of this nature. The extended use of AI-CRM software raises questions about the protection of customer data, including aspects such as obtaining potential customer consent, ensuring data security, practicing data minimization, managing data transfer, facilitating the exercise of data subject rights, maintaining transparency in data processing, and defining the responsibilities of the software provider and the user.

Importantly, a critical concern arises regarding the potential invasion of an individual’s personal sphere. With access to detailed information about customers or potential customers, companies can effectively tailor messages, even anticipating consumer desires before they are fully aware of them. Marketers can leverage this deep understanding of preferences and predicted behaviors to influence customer behaviors and decisions.

In sum, AI-powered CRM helps firms in managing information about their clients throughout the customer journey, allowing them to generate predictions on purchasing behavior, and to establish long-term relationships with their target audience.  However, there are several concerns related to data protection, such as the monitoring of the customers’ behavior, that can result in manipulation of their thoughts and preferences.

Exploring Chatbots in Marketing and Sales

The fashion retailer Lacoste USA Inc. was sued in 2022 after allegations that the AI-driven chatbot HeyDay, provided by Hootsuite and installed on Lacoste’s website, harvested data from the chat transcripts and shared private information with other companies, such as Meta, without the visitors’ consent. The lawsuit claims that Meta’s subsidiaries, including Facebook and WhatsApp, exploit the harvested data for targeted advertising, resulting in users being bombarded with advertisements (TFL, 2023).

Currently in vogue, chatbots are software that interacts with users on a specific topic to answer questions or provide information. They are digital assistants based on natural language processing (NLP), that communicate with users through audio or text (Guida, 2021). In addition, chatbots can use data analytics and machine learning algorithms to analyze user behavior and preferences. This enables them to deliver personalized responses and recommendations that are specifically tailored to each individual user (Lypchenko, 2023).

In the context of marketing, chatbots are defined as “electronic conversation agent that uses AI to automate the interaction between a company and customers” (de Cosmo et al., 2021, p. 85). Given these features, companies are increasingly adopting chatbots as they positively impact quality and efficiency. According to Lin et al. (2022) chatbots are crucial to reducing costs, interacting with multiple clients, improving response times, and offering 24/7 assistance. Other advantages are scalability, increased engagement, reduced response time, consistent branding, multilingual support, and continuous learning, and can be integrated with messaging apps such as Facebook Messenger, Telegram, and WhatsApp (Lypchenko, 2023).

Interestingly, some authors argue that “a well-prepared chatbot of charming personality” (Kaczorowska-Spychalska, 2019, p. 257), can help to generate better results than traditional advertising, efficiently leading a potential client through all the stages of the customer journey. Traditionally, in advertising, interactivity is one-way, flowing from the company to the consumer. However, in the case of chatbots, interactivity becomes two-way, allowing consumers to actively participate in the communication process (de Cosmo et al., 2021).

Considering the data flow, it is interesting to note that to optimize the advantages of AI technology, companies integrate chatbots with other systems, including CRM software, e-commerce platforms, and customer service tools. This integration enables chatbots to access the necessary data for marketing and customer interaction purposes. (Warren, 2023).

Data protection considerations for chatbots

Chatbots that use machine learning, as explained by Quach et al. (2022), require a significant amount of data, often collected from consumer interactions without their awareness. This data can include, for example, medical conditions and financial information, and even they can “extract sensitive information (…) from seemingly innocuous data” (2022, p. 1308). Therefore, data protection concerns surrounding chatbots arise during the training stage and persist throughout the phase of user interaction. These concerns extend to the subsequent analysis and use of information that provides value to the companies utilizing chatbot technology.

Processing user data in AI-based services such as chatbots poses a threat to individuals whose information is used to train and operate the system. Such data may encompass an individual consumer’s preferences and private information shared with chatbots, a concern that has been prevalent since the early days of chatbot technology (Jurafsky & Martin, 2008). ELIZA, the first chatbot, was designed to imitate interaction with a psychotherapist. Described as a simple program, people engaged with ELIZA as a social entity, believing that it really understood their problems (Jurafsky & Martin, 2008).

Consequently, if a chatbot imitates human interaction, it can be anticipated that individuals will develop a greater sense of trust and feel comfortable sharing highly personal information, including sensitive details. While such inputs can be immensely valuable for marketers, as they can gain a profound understanding of user preferences, it also opens the door for the exploitation of customer vulnerabilities. Companies not only need to be transparent in informing users that they are interacting with an AI, but they must also provide information about the data processing involved. An example is the chatbot Alexa, which, notably, is connected to Amazon’s CRM. Alexa helps the company in personalizing the customer profile and storing their data, making it possible to track users’ desires and creating marketing campaigns; however, users are unaware that Alexa gathers data even when they are not interacting with it (Kouroupis et al., 2021, p.9).

In her work, Tucker (2018) provides a summary of the primary data protection violations associated with AI, transgressions that can also be observed in chatbots, as presented  here. Firstly, data persistence is highlighted, i.e. where data can exist longer than the human that created it due to the low cost of data storage; in this case, conversations with chatbots can remain for years considering the difficulties users face to exercise the right to erasure (Ogundele, 2022). Secondly, data repurposing is discussed, emphasizing the uncertainty faced by data subjects regarding how their data will be processed in the future, allowing for infinite reuse. Chatbots that use machine learning are trained with interactions, which ultimately feed and refine the algorithm. Lastly, data spillovers are addressed, highlighting the potential repercussions for individuals who did not contribute to the creation of the data. This can occur, for example, when information about other individuals is inadvertently disclosed to a chatbot.

Regarding the recommended features that should be embedded to safeguard customers’ rights as data subjects when interacting with chatbots, Ogundele (2022) emphasizes critical measures such as implementing end-to-end encryption, pseudonymization, self-destructing messages for sensitive information, and establishing mechanisms to ensure that data sharing with third parties (e.g., cloud services and hosting services) comply with data protection regulations.

Then, on the one hand, chatbots play a crucial role for firms in terms of cost reduction, making it possible to engage with a large number of clients, improve response times, and offer 24/7 assistance. Chatbots powered by ML capabilities assist companies by continuously learning from customer interactions and providing insights based on these engagements. On the other hand, the imitation of human interaction by chatbots can foster a greater sense of trust, encouraging the sharing of sensitive information. Additionally, chatbots can collect and store personal data for extended periods, potentially repurpose the data without users’ knowledge, and inadvertently process and disclose sensitive information.

In conclusion, this edition reaffirms the imperative need for the mentioned data protection aspects to be addressed during chatbot and AI-CRM development, rather than as a contingency to be borne by the firms acquiring these solutions. Despite the significant benefits they offer to firms, data protection concerns arise as chatbots and CRM software process vast amounts of personal customer data, including sensitive information, and can potentially infringe upon customers’ data protection and autonomy. Therefore, providers should acknowledge that data protection is of utmost importance when developing their solutions. Safeguarding fundamental rights should be a top-level consideration, especially considering the widespread utilization of their products.

Hence, data protection expectations and transparency in data processing must be addressed by companies deploying AI-CRM systems and chatbots, providing users with relevant information and allowing them to exercise their rights. To address these concerns, software developers need to embed data protection into their solutions, allowing their clients to effectively implement GDPR principles and protect the customers’ rights as data subjects.

In our next blog post, we will dive into the key principles of the GDPR and how they apply to AI-driven marketing practices. Keep posted to learn about the legal framework that governs customer data use and how businesses can ensure their AI marketing strategies comply with these regulations.

Bibliography:

Choudhury, M., & Harrigan, P. (2014). CRM to social CRM: the integration of new technologies into customer relationship management. Journal of Strategic Marketing, 22. https://doi.org/10.1080/0965254X.2013.876069

de Cosmo, L. M., Piper, L., & Di Vittorio, A. (2021). The role of attitude toward chatbots and privacy concern on the relationship between attitude toward mobile advertising and behavioral intent to use chatbots. Italian Journal of Marketing, 2021(1), 83-102. https://doi.org/10.1007/s43039-021-00020-1

Gomez Albrecht, M., Green, M., & Hoffman, L. (2022). Principles of Marketing. Rice University. https://assets.openstax.org/oscms-prodcms/media/documents/Principles_Marketing-WEB.pdf

Guida, S. (2021). Privacy policies between perception and learning through legal design: Ideas for an educational chatbot combining rights’ awareness, optimized user experience and training efficacy. In O. Gigliotta & M. Ponticorvo (Eds.), Proceedings of the Third Symposium on psychology-Based Technologies (Vol. 3100). CEUR. https://ceur-ws.org/Vol-3100/#paper15

Jurafsky, D., & Martin, J. (2008). Speech and Language Processing: An Introduction to Natural Language Processing, Computational Linguistics, and Speech Recognition (Vol. 2).

Kaczorowska-Spychalska, D. (2019). How chatbots influence marketing. Management, 23(1), 251-270. https://doi.org/10.2478/manment-2019-0015

Kouroupis, K., Vagianos, D., & Totka, A. (2021). Artificial Intelligence and Customer Relationship Management. East European Yearbook on Human Rights, 4(1), 5-24. https://doi.org/10.5553/EEYHR/258977642021004001002

in, X., Shao, B., & Wang, X. (2022). Employees’ perceptions of chatbots in B2B marketing: Affordances vs. disaffordances. Industrial Marketing Management, 101, 45-56. https://doi.org/10.1016/j.indmarman.2021.11.016
Luyt, D. (2023, febrero 13). Privacy issues with CRM software. Michalsons. https://www.michalsons.com/blog/privacy-issues-with-crm-software/63973

Lypchenko, S. (2023, abril 19). Chatbots for Marketing: Roles, Benefits, and Future Trends. https://gowombat.team/blog/posts/the-future-of-chatbots-for-marketing-how-ai-is-changing-theindustry?latest

Ma, L., & Sun, B. (2020). Machine learning and AI in marketing – Connecting computing power to human insights. International Journal of Research in Marketing, 37, 481-504.

Microsoft. (2022, A 12). General Data Protection Regulation overview—Finance & Operations |  Dynamics 365. https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/gdpr/gdpr-guide

Ogundele, T. (2022, septiembre 26). A Beginner’s Guide to Privacy and Security Issues in Chatbots. Medium. https://medium.com/@tolul/privacy-and-security-issues-in-chatbots-3511596d4241

Quach, S., Thaichon, P., Martin, K. D., Weaven, S., & Palmatier, R. W. (2022). Digital technologies: Tensions in privacy and data. Journal of the Academy of Marketing Science, 50(6), 1299-1323. https://doi.org/10.1007/s11747-022-00845-y

 Sage CRM. (2018, abril 25). How personal data flows into Sage CRM. https://www.sagecity.com/sage-global-solutions/sage-crm/b/sage-crm-hints-tips-and-tricks/posts/how-personal-data-flows-into-sage-crm

Salesforce (Director). (2021, marzo 24). What is CRM and How Does it Work? | Salesforce. https://www.youtube.com/watch?v=SlhESAKF1Tk

Saura, J. R., Ribeiro-Soriano, D., & Palacios-Marqués, D. (2021). Setting B2B digital marketing in artificial intelligence-based CRMs: A review and directions for future research. Industrial Marketing Management, 98, 161-178. https://doi.org/10.1016/j.indmarman.2021.08.006

TFL. (2023, March 7). Lacoste Named in California Data Privacy Lawsuit Over AI Chatbot. The Fashion Law. https://www.thefashionlaw.com/lacoste-named-in-california-data-privacy-lawsuit-over-ai-chatbot/

Tucker, C. (2018). Privacy, algorithms, and artificial intelligence. In A. Agrawal, J. Gans, & A. Goldfarb (Eds.), The economics of artificial intelligence: An agenda (pp. 423–437). University of Chicago Press. http://www.nber.org/chapters/c14011

Warren, T. (2023, June 5). How to Train Your Chatbot. Smart Customer Service. http://www.smartcustomerservice.com/Columns/Vendor-Views/How-to-Train-Your-Chatbot-158979.aspx

 Zoho (Director). (2015, July 31). What is CRM? | A guide to CRM software by Zoho CRM. https://www.youtube.com/watch?v=hnEQq7kNFWo