Personalization, Consent, and Data Minimization
Personalization can improve usefulness but increases privacy risk and system complexity. Establish a purpose for each data field, retention limits, user controls, and deletion behavior. Do not treat every conversation as permission to store a permanent profile. Separate user-provided preferences from model-inferred guesses and preserve provenance.
Use tenant-aware storage and authorization filters for embeddings or profile records. Avoid logging raw sensitive prompts by default; redact or tokenize identifiers where possible. Review provider retention and training terms for the specific product configuration rather than assuming every API has the same data handling policy.
Preference record with provenance
{
"userId": "user_123",
"preference": "prefers concise explanations",
"source": "explicit_user_setting",
"createdAt": "2026-10-28T00:00:00Z",
"expiresAt": null
}💡 Explicit user preferences are more reliable than hidden inferences. Define access and deletion behavior for the record and avoid collecting fields that are not needed.
Key Takeaways
- Minimize collected and retained data.
- Distinguish explicit preferences from inferred guesses.
- Plan deletion and access controls for profile data.
Knowledge Check
Which is the better basis for a durable personalization preference?