Balancing Personalization and Privacy in Event Marketing

In March 2026, California’s privacy regulator announced a $1.1 million fine against PlayOn Sports, whose GoFan service sold digital tickets to high school football games, homecoming, and prom. It was the agency’s first decision involving students and schools, and it followed a settlement with the company.

The problem was in the ticket itself. According to the regulator, people had to click “agree” to advertising trackers before they could use their tickets, with no proper way to opt out.

“You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising.”

Michael Macko, head of enforcement, CalPrivacy

PlayOn’s case involved students, but anyone who markets events will recognize the tools: pixels on registration pages, tracking links in emails, and data shared with sponsors. Event teams use them for good reasons. Regulators now check whether people can see that tracking and switch it off, and your legal team, sponsors, and procurement teams can ask the same questions.

Events have a lot at stake here. Registration forms collect names, job titles, and employers, and parts of that often flow to sponsors, exhibitors, and technology partners. An attendee who registers is trusting the organizer with their professional identity, and a speaker who shares the event is lending it their name.

That puts event marketers in a balancing act. Personalization is what gets people to register, and privacy is what keeps their trust and keeps your legal team comfortable. The two pull against each other when every personal touch depends on collecting more data about the reader.

In events, the most personal message usually comes from a person instead: a colleague’s invitation, a speaker’s post, an exhibitor’s note to a client. Those invitations draw on who is sending them and what the event offers, so they need very little data about the person receiving them. This article covers both sides of the balance: how to personalize through people, then how to handle the data you do collect, protect your advocates, and work within the rules in each region.

Personalization that comes from people

Many attendees first hear about an event from someone they know. In the Freeman Trends Report: The Pre-Event Edition (Q4 2026), colleagues, vendors, and professional organizations tied as attendees’ top sources for discovering events. Once registered, 58% of attendees said they encourage peers to sign up, even without an incentive.

Freeman also asked which attendee information would encourage people to register. Sixty percent chose the types of organizations attending, and only 22% chose attendee numbers. People want to know who will be in the room, and you can tell them that without knowing anything more about them.

Peer invitations are personal by nature. When a speaker shares a card with their name, photo, and session title, the message carries their reputation, and no one had to be profiled to make it relevant.

That makes peer-to-peer marketing a good fit for privacy-first teams. Advocates choose what to share and who to share it with. The message travels through relationships they already have, and the organizer works with people connected to the event instead of bought audience lists.

Much of this sharing happens in private spaces such as messaging apps. Snöball’s 2026 Peer-to-Peer Event Marketing Benchmark Report puts that at 32.6% of shares.

How to personalize through the sender

In peer-to-peer marketing, the personal detail comes from the person sharing and from the event itself. That leaves plenty of room to be creative.

• Match the message to the messenger. A speaker wants their session called out, an exhibitor their booth, an attendee their company. Give each role its own message and design.
• Speak their language. At international events, let advocates share in their own language. A speaker in Dubai can post in Arabic while a partner in Montreal posts in French.
• Put a real face on camera. A speaker explaining why they’re excited to be on stage carries credibility a template can’t match. Give advocates a prompt and a time limit, and let them record a short clip.

If you run campaigns with Snöball, Snöflex handles role and language choices, and Reel Snö lets advocates record a short video inside their share card. For more ideas, see 67 Ways to Personalize Your Referral Campaigns.

Handling the data you do collect

That covers the personalization side. On the privacy side, peer-to-peer marketing reduces what you need to know about the people you invite, but registration still collects personal data. In Cisco’s 2024 Consumer Privacy Survey, 75% of consumers said they won’t buy from organizations they don’t trust with their data. Registering for an event is a similar decision.

Five habits cover most of what attendees expect:

• Ask what matters. Collect interests at registration and use them visibly, so attendees see the value of sharing.
• Collect only what you need. Every form field should earn its place.
• Say who sees what. Tell attendees which sponsors, exhibitors, and vendors get their data, and for how long. Make sponsor sharing a separate opt-in.
• Make control easy. Opting out, getting fewer emails, or deleting data shouldn’t be a hassle.
• Prove your security. Independent audits such as SOC 2 Type II give buyers evidence they can check for themselves.

How HumanX puts this into practice

HumanX, an AI conference, personalizes the experience from a visitor’s first look at the website through the event itself. In a Snöball Sevinar, Head of Technology Alex Anikeev walked through how the team built it. It shows both sides of the balance at work: personal recommendations from the first visit, with a reason attached to each one so people can see how their information is used.

1. Before the ticket

   The HumanX Pack

   Any website visitor can build a free Pack. The form asks for an email, name, company, and title, plus one open question about what brings them to HumanX. Alex calls it “the most important field,” because two people with similar titles can have very different goals. One might want to meet startups, while another wants to learn about internal processes.

   Their goal, in their words + One of 10 personas → Two-way AI match → Picks with reasons

   HumanX sorts each person into one of 10 personas, then uses AI to match that persona and goal to its content: three people to meet, plus sessions, sponsors, partners, and media. The people matching works in both directions. “We want to match you with the people who will want to match with you,” Alex said.

   Each pick comes with a reason, along with what the person will learn and take away. Without that, a list of names becomes homework, and “no one likes the homework.” Visitors see three recommendations by default and six if they log in, and they get a link they can send to a boss to make the case for going.

2. At registration

   Step one is just an email

   The first step of the form asks for an email and agreement to the terms. HumanX then prefills the next step with what it already knows from its website forms and event app, and returning attendees see last year’s headshot appear. For people it doesn’t know yet, it uses Apollo to fill in details from their email address. All anyone has to do is glance over the form and fix anything outdated or incorrect.

3. After registering

   Agenda Picks

   Attendees get a step-by-step event guide: a non-conflicting schedule of sessions and activities, such as sponsor booth visits, each with a reason to go.

Of the 211 people without tickets who generated a Pack, 30 have since registered. Alex called the Pack “one of the steps in their journey” rather than the sole reason.

What to borrow for your own event

• Ask for the goal. One open question tells you why someone is coming, which a job title can’t.
• Show what you know. Prefilled details sit in front of the attendee, who can check and correct them. If you pull data from an outside source, tell people and check the approach with your legal team.
• Give the reason. A reason attached to each pick shows people how their answer is being used and lets them judge the match.
• Put the value first. Visitors get useful picks before they buy a ticket and more if they log in, so sharing their details comes with a clear return.

Protect the advocate

Consider a keynote speaker three weeks before a major conference, finishing slides, booking travel, and keeping up with clients. The campaign emails keep coming: reminders to share, leaderboard updates. Each one is well meant, but the timing is hard. If the only way to slow them down is to unsubscribe, the event can lose one of its most trusted voices.

Event privacy usually centers on attendees. But speakers, exhibitors, sponsors, and past attendees lend an event their names and networks, and they deserve the same control.

What advocate control looks like

One practical answer is a preference center: a page linked from every email where advocates set their own terms. Our speaker could switch to weekly emails and stay involved.

When someone leaves, ask why, and give them options such as “I’m no longer interested” or “I never signed up.” The second is worth investigating. Their choices should apply across campaigns without manual updates, and data removal should anonymize their record where appropriate.

Why it builds trust on both sides

For advocates, control turns participation into a choice. For organizers, a record of those preferences and changes helps demonstrate accountability to clients, procurement teams, and regulators. If you use a peer-to-peer solution, check that preference controls and tracking suppression are built in.

Measuring results without surveillance

Privacy-first teams can still see what’s working. They can measure:

• Registrations by advocate, through personalized share links or codes in the event’s own systems.
• Campaign results, showing which messages and formats drive interest.
• Self-reported discovery, through a “How did you hear about us?” question that picks up private sharing analytics can miss.

When an advocate switches tracking off, some of their activity will go uncounted. That is a fair trade for keeping their trust. Recognize them in ways that don’t rely on tracking, such as speaker spotlights or VIP access.

How the rules differ by region

PlayOn is not an isolated case. Most regions are moving toward clearer consent, opt-outs that work, and proof of both, though Europe is also weighing new exceptions for low-risk cookies. This summary is for marketers, not legal advice, and several of these rules are still in draft.

North America

California regulators issued more than $4.22 million in privacy penalties in the first quarter of 2026 (Paul, Weiss). In Quebec, regulator guidance under Law 25 says tools that identify, locate, or profile people should be off by default, which points toward express consent, though how this applies to cookies is still debated (Canadian Marketing Association; McCarthy Tétrault). Audit the pixels on registration pages and honor browser opt-out signals.

Europe

Consent is still required for non-essential tracking. In October 2026, EU member states backed six purposes for which cookies would need no consent, but this is a negotiating position and not yet law. Get consent before any non-essential tracking on event websites.

Asia-Pacific

India’s data protection rules are due to take full effect on May 13, 2027, though the government has proposed an earlier date for some obligations. Australia’s draft reforms would require clear opt-out information in each direct marketing message, except where laws such as the Spam Act already apply (Corrs Chambers Westgarth). Build consent records now for Indian and Australian audiences.

Middle East

Saudi Arabia has enforced its data protection law since 2024, and draft amendments released for consultation in October 2026 would tighten marketing consent (Clyde & Co). Keep proof of consent and act on withdrawals quickly.

In every region, a clear record of how consent was collected and how opt-outs were honored helps you answer regulators and clients.

A checklist for your next event

• Map your data, from registration and badge scans to share links, sponsor reports, and third-party apps. Remove what you don’t need.
• Separate your consents for event updates, sponsor contact, and personalization, and keep a record of people’s choices.
• Give advocates a preference center for email frequency, tracking, and their own data.
• Test every opt-out, including browser signals such as Global Privacy Control, and make it easy for people to change their minds.
• Vet your vendors for independent security audits, such as SOC 2 Type II, and appropriate data-processing practices.
• Set a high privacy baseline across your events, then check for additional requirements in the markets where you operate.

This checklist is for marketers, not legal advice.

Getting the balance right

PlayOn’s case came down to everyday marketing tools that gave people no real way to say no. The risk sat in ordinary habits, and so does the fix: ask for less, explain more, and let people change their minds.

Personalization and privacy work together when the personal detail comes from people and the data you do collect is handled in the open. Build your campaigns around the colleagues and speakers your audience already trusts, give everyone real control, and you will have a clear answer when your legal team, a sponsor, or a procurement team asks how your marketing works.