Ethical PR: Data Privacy Risks in 2026

Identity resolution gives PR pros amazing new ways to understand audiences and craft messages, but it’s also an ethical minefield. We can now stitch together all sorts of data to get a full picture of a person or household, which is great for personalization but creates huge data privacy headaches. So how do we, as practitioners, actually use these powerful audience insights without trampling on people’s rights and destroying the public’s trust in our brands?

The Double-Edged Sword of Identity Resolution in PR

The upside of identity resolution in public relations is obvious: you get a much sharper, more accurate picture of who you’re talking to. Instead of guessing, you can build campaigns with real precision, hitting the right people with a message that resonates on the platforms they actually use. It works by collecting and connecting identifiers like email addresses, device IDs, IP addresses, and even offline purchase records into one unified profile. For instance, if you’re launching a sustainable product, you could identify consumers who’ve already looked at eco-friendly content on different sites, letting you target your outreach with incredible relevance. It’s effective, too, a 2025 eMarketer report found that 72% of marketing and PR pros saw identity resolution make their campaigns significantly better.

But that power is exactly what creates the ethical problems, and the biggest one is data privacy. When you track people across a dozen different touchpoints without getting their explicit, informed consent, it feels creepy and invasive. This isn’t just a theory. We’ve all seen brands try to get personal and end up crossing a line, triggering public outrage and regulatory fines. The job for us isn’t just getting the tech to work. We have to get a gut feeling for where the public’s lines are on data use. One person’s helpful personalization is another’s major privacy breach. And with the huge number of data points we’re working with, even with the best intentions, it’s easy for things to go wrong.

Then there’s the problem of bias. If your source data for identity resolution is skewed, your PR messaging will just amplify existing societal biases. The algorithms, after all, only know what you feed them. So if your historical data over-represents some demographics and ignores others, your audience segments and messaging will be just as unbalanced. This can mean you end up alienating whole groups of people or, in a worst-case scenario, reinforcing ugly stereotypes. You have a moral responsibility to use diverse, representative data sources and to constantly check your algorithms for bias.

Working through Consent and Transparency in Data Collection

Any ethical use of identity resolution in PR has to start with consent and transparency. Big regulations like the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have completely changed the game for handling personal data. These laws demand clear, affirmative consent for collecting and using data, putting people back in control of their own information. For PR teams, that means you have to stop relying on people passively accepting a wall of text in the terms and conditions and start actively getting explicit permission, especially when you’re connecting data from different platforms or using third-party lists.

Being transparent means telling people in plain English how you collect data, what you use it for, and who gets to see it. A privacy policy link buried in your website’s footer just doesn’t cut it anymore. PR pros need to be out there educating their audiences about their data practices. Think simple pop-up notices, a dedicated privacy dashboard on your site, or even a short video explaining your approach. The whole point is to build trust. When a brand is upfront about how it uses data, even if the use is extensive, people are much more willing to go along with it than if they feel like they’re being spied on.

Think about what this means on the ground: if your PR campaign is going to mix data from your CRM with website analytics and social media activity, you need a paper trail for where every single data point came from and the consent you got for it. Doing this protects your brand’s reputation. It’s a strategic imperative. One mistake in how you handle data can wipe out years of accumulated trust and throw you into a massive public relations crisis. I always tell my clients that being proactively clear about data can turn a huge risk into a competitive advantage, showing everyone you’re a responsible steward of their information.

Third-Party Data and Vendor Due Diligence

A lot of PR identity resolution work depends on third-party data providers. These companies collect incredible amounts of information, giving you insights you could never get on your own. But bringing in third-party data adds a whole new level of ethical risk. How do you know for sure that the data you’re buying was collected ethically and legally? The only way is through serious vendor due diligence.

Before you sign a contract with any data provider, your PR team has to dig into their methods for data collection, consent, and security. This means you have to demand they show you where their data comes from, you have to read their privacy policies, and you have to check for compliance certifications like ISO 27001 or see if they follow frameworks like the IAB Europe Transparency & Consent Framework (TCF). Just taking a vendor’s word for it is a terrible idea. If your data provider did something unethical, even if you didn’t know about it, it’s your brand that will take the heat. In the end, the responsibility for ethical data sourcing sits with the brand.

Also, your contracts with these providers need to be airtight. They should spell out exactly what you can and can’t do with the data, how long you can keep it, and give you the right to audit them. What happens to all that data when your campaign is over? Is it deleted for good or just sitting on a server somewhere? These details are everything for staying ethical and out of legal trouble. The IAB has some great guides on data ethics that can give you a solid framework for checking out potential partners. The real question is about how data was sourced and how it’s protected, not just what data you can get your hands on.

Internal Controls and Data Governance for PR Teams

Even with good vendors and following the law, you need strong internal controls and data governance to make identity resolution ethical. This is about having clear, written policies for how data is handled inside your own team. Who on the PR team can see personally identifiable information (PII)? What kind of training have they had on data privacy? How do you stop a data breach before it happens, and what’s the plan if one does?

A huge piece of this is data minimization, only collect the data you absolutely have to for the campaign’s goal. Every extra bit of data you grab just adds to your risk. You should also be using anonymization and pseudonymization whenever you can, especially when you just need broad audience insights instead of one-to-one targeting. For example, instead of digging into individual survey responses, a PR team can aggregate the data to spot trends across demographic groups, which gets the job done without exposing anyone’s personal information.

You also have to run regular internal audits on your data practices. These audits need to check data access logs, make sure everyone’s following the rules (both internal and external), and look for weak spots. Data privacy isn’t a one-and-done thing. The rules are always changing because the tech is always changing, so your policies will be out of date fast. Your PR team needs a culture where data privacy is baked into every single step of campaign planning and execution. This kind of proactive work, especially regular training for everyone who touches data, is your best shield against making a costly ethical mistake.

Building Trust Through Responsible Data Use

In the end, getting identity resolution right in PR is about building and keeping the trust of your audience, not just dodging fines. People are more aware than ever of their digital footprints, and using data responsibly can give you a real edge over the competition. Brands that actually show they’re committed to protecting user privacy will earn loyalty and get people talking. A late 2024 Nielsen study even found that 68% of consumers are more likely to buy from brands they feel are transparent about data use.

This requires a philosophy of privacy by design. Every PR campaign you dream up, every data collection tool you use, must have privacy built-in from the very beginning. It’s about asking tough questions upfront. Do we really need to collect this? Is there a less invasive way to hit our goal? How would our audience react if they knew exactly how we’re using their information right now? Asking these questions consistently pushes you toward strategies that are more ethical and, frankly, more effective in the long run.

The long-term reputation you get from being a good data steward is worth far more than any short-term win from a shady data practice. In our world, bad news about data misuse spreads like wildfire and can do permanent damage to a brand. Getting this right is an investment in your brand’s future goodwill. Data is a powerful tool, and with great power comes great responsibility.

When you apply identity resolution strategically, backed by strict ethics and transparent practices, you can create deeper connections with your audience and build stronger brands. Making data privacy a priority secures your brand’s future in a world that’s only getting more data-savvy, particularly as AI tech valuations keep climbing and shaping PR strategy. Knowing how to manage this data is also going to be critical for anyone in e-Commerce PR mastering international reach over the next few years.