AI adoption in marketing is now close to universal, and vendors promise the same thing: read the customer, personalize at scale, cost a fraction of a media team. McKinsey finds fewer than one in ten organizations has scaled that adoption into results a P&L would notice. Twenty states now regulate consent for that data, and the FTC has said plainly there is no AI exemption from the law already on the books.

The pitch decks lead with the first number. They leave out the second, and the gap between them is not a technology problem. Braze’s 2026 customer engagement review names it directly: 93% of marketing leaders believe their AI understands the customer, while only 53% of customers agree.^[3] The gap isn’t the model. It’s the data the model was promised — and how much of that data the vendor was actually allowed to use.

That’s the part worth reading in the contract, not the case study. Sensitive data, browsing history, and geolocation don’t become fair game because a model, not a person, is doing the targeting.^[4] When a company trains on data it wasn’t authorized to hold, the FTC’s remedy isn’t a fine and a warning. It’s deletion of the model itself.^[5] Twenty U.S. states now run their own comprehensive privacy statutes on top of that, each with its own consent thresholds and no federal ceiling coordinating them.^[6] The Multi-State Privacy Agreement IAB updated this year exists because agencies and their downstream ad-tech partners kept discovering, after the fact, that access to the data and consent to use it are not the same clause.^[7]

None of this is a reason to sit out AI. It’s a reason to read what your agency’s proposal actually claims — and what its underlying contracts with data and platform partners actually authorize. A vendor slide promising “hyper-personalization at scale” is not evidence of a consent basis. If the MSA doesn’t specify where the training data came from, whether it includes your first-party customer records, and who’s liable if that data turns out to be non-consented, you’re not buying a capability. You’re inheriting an exposure — one that shows up in your name, not the vendor’s, the day a state attorney general or the FTC comes asking.

A note on role: We don’t audit AI models or write your data policy. We read the commercial terms your agency signs on your behalf, and flag when a capability clause is quietly a liability clause.

---

Sources Cited

1. McKinsey & Company / cmotech.news, “McKinsey says AI could transform marketing but firms lag” (June 2026) — fewer than 10% of organizations have scaled AI across marketing workflows despite an estimated $90B in unlocked marketing returns.
2. McKinsey & Company, Global AI Survey (cited via Whitehat, “AI in Marketing 2026”) — 88% of organizations use AI in at least one function, but only 6% extract meaningful bottom-line value.
3. Braze, 2026 Global Customer Engagement Review (cited via Barchart) — 93% of marketing leaders believe AI accurately understands customer needs vs. 53% of consumers who agree; 27% of consumers refuse to share any data with AI agents.
4. Federal Trade Commission, remarks reported by The Record from Recorded Future News, “FTC’s Khan warns tech industry that agency will strictly enforce AI data privacy” — sensitive health, geolocation, and browsing data are “off limits” for model training; “there is no AI exemption” from existing law.
5. Federal Trade Commission, “AI Companies: Uphold Your Privacy and Confidentiality Commitments” (official FTC guidance, 2026) — the FTC has required deletion of models/algorithms built using unlawfully obtained data.
6. Consently, “US State Privacy Laws: The 2026 Compliance Map” — 20 U.S. states have a comprehensive consumer privacy law in effect as of 2026, each with its own thresholds and no coordinating federal standard.
7. Interactive Advertising Bureau (IAB), “IAB Announces Most Significant Update in Years to Multi-State Privacy Agreement” (March 2026, official press release) — advertisers remain liable for consumer data even when shared with or activated by downstream partners.