When the marketing agent decides for each customer individually: What Art. 22 GDPR says

Last night, your marketing agent decided, for every single customer, whether a message goes out today, on which channel, at what time and with what content. Nobody defined an audience, and nobody approved a campaign. The agent learned what works for each person and acted accordingly. From a technology standpoint, that is progress over segments such as “new customers” or “cart abandoners”. From a data protection standpoint, it raises a question you should settle before buying such a tool: is this still marketing, or already an automated individual decision under Art. 22 GDPR?

This article is an evergreen topic, not breaking news. There is no product here that you can use starting today, but there is a legal provision that has applied across the EU since 2018, and a market that is just discovering the term “Agentic Decisioning”. The hook is a press release dated June 23, 2026. We separate what the sources document from what we derive as review questions. This is not legal advice. How your specific case should be assessed is a matter for your legal counsel or your data protection officer.

What “Agentic Decisioning” means: the occasion

On June 23, 2026, the marketing automation vendor MoEngage announced that it had acquired Aampe, a company from San Francisco. The terms of the purchase were not disclosed. According to the announcement, Aampe assigns every individual customer of a brand their own AI agent. According to the press release, each of these agents decides “what to say, when to say it, how often, and on which channel”, that is, what is said, when, how often and on which channel. MoEngage CEO Raviteja Dodda describes it as optimizing “content, timing, channel, and frequency together, continuously, at the individual level”, that is, jointly, continuously and at the level of the individual person.

Learning also happens per person: according to the announcement, an agent builds a “persistent, compounding model of each individual”, a lasting, growing model of the single person. Aampe’s founders are moving to MoEngage, where they will lead the “Agentic Decisioning” area. According to the vendor, control stays with marketing: marketers “define the content, goals, and guardrails”, and the agents handle the rest, “with full transparency into every decision made”.

In terms of numbers, the announcement states that Aampe operates “hundreds of millions of dedicated AI agents” and makes more than 200 billion decisions per week. MoEngage itself says it serves over 1,350 consumer brands. These are vendor claims from a press release that we could not verify independently. We list them because they show the scale, not because we confirm them.

Availability: what is coming for companies

On availability, the source is considerably terser than its tone suggests. According to the vendor, existing Aampe customers carry on unchanged, MoEngage customers get Aampe “natively”, that is, integrated directly, and B2C brands can plug Aampe into their existing platforms. The product is said to be in production “globally”, but no regions or rollout dates are named. Whether and how it will be offered in Germany, Austria or Switzerland is not stated in the text we read. For the DACH region, availability is therefore unknown.

We therefore do not describe this as “usable now”, but as a development that is coming for companies. A marketing tool that makes decisions at the level of the individual person will sooner or later be offered to you as well, either as a standalone product or as a feature in a platform you already use. That is the moment by which the Art. 22 question should be answered.

What Art. 22 GDPR says

Art. 22 GDPR is headed “Automated individual decision-making, including profiling”. Paragraph 1 gives the data subject the right not to be subject to a decision “based solely on automated processing, including profiling” that produces legal effects concerning them or similarly significantly affects them. At its core, there are therefore two conditions that must come together: the decision is made solely by automated means, and it has a legal effect or a similarly significant effect on the person.

Paragraph 2 lists three exceptions: the decision is necessary for entering into or performing a contract with the person, it is authorized by Union or Member State law that contains suitable safeguards, or the person has given explicit consent. Paragraph 3 requires, in the cases of contract and explicit consent, that the controller implements suitable measures. At a minimum, these include the right to obtain human intervention on the part of the controller, the right to express one’s point of view, and the right to contest the decision. Paragraph 4 further restricts decisions based on special categories of personal data under Art. 9.

The question is not whether an agent decides. The question is whether the decision is made solely by automated means and is significant for the data subject.

Why not every marketing message falls under Art. 22

An honest assessment is part of this: Art. 22 is not a ban on personalization. The decision must produce legal effects or “similarly significantly affect” the person. Whether a push notification at 6 p.m. instead of 9 a.m. reaches this threshold is at least questionable, and for many everyday cases the answer is likely no. That is our assessment as a review pointer, not a legal ruling, and it depends on the individual case.

It can look different when the agent determines not only the timing but the content of the offer. Anyone who shows certain people a price, a discount or a financing option and not others, who excludes individual people from an offer or sets terms individually, comes closer to the area where the effect on the person can become significant. We are not claiming that this is automatically the case. We are saying that this is exactly where the review has to start, and before deployment.

What the CJEU decided on the score

A ruling from the credit industry shows how far the concept of a decision can reach. On December 7, 2023, in case C-634/21 (SCHUFA), the Court of Justice of the European Union ruled that even the automated calculation of a score value itself can fall under the prohibition in Art. 22 if the subsequent decision by a third party, such as a bank, is determined to a significant degree by that value. We rely here on the summary by the law firm CMS, not on the text of the judgment. The credit bureau had argued that it merely supplied the value and that the customer made the decision. The Court countered that the protective provisions could otherwise be easily circumvented. What matters is whether the value effectively predetermines the decision.

According to the summary, the term “determined to a significant degree” is not defined, and the Court leaves its interpretation to the national courts. No ready-made rule can be derived from this for marketing agents, because the ruling concerned creditworthiness and not advertising messages. But it shows a way of thinking: if a system supplies a value or a selection and the human behind it effectively just nods it through, the system can be regarded as the actual decision-maker. That is relevant for every approval step. A person who confirms suggestions unread does not turn an automated decision into a human one.

Which agent: Daniel and the line to decision-making

On amazing-agents.com, we assign this topic to Daniel, the analytics specialist in the research team under Nadja. There he collects performance data across all social media channels, builds reports and detects anomalies. That is a role that evaluates and points things out. It does not make decisions about individual people. A clean separation matters to us: the review questions in this article are our approach in the audit. We are not claiming that Daniel independently reviews purchased tools for legal compliance.

What our website says about approvals, we reproduce as it stands there: every agent runs within a defined framework with approval steps for critical actions, emails are created as drafts, for example, and not sent directly, and in the control center, critical actions require your approval. For content, the rule is: no content goes live without the brand check by Magdalena. That describes how we work and is not proof that every conceivable decision is covered.

With and without an approval step: a comparison

Without an approval step, the agent determines for each person what they receive and when, and carries it out. There is no point at which a human would have seen, understood or corrected a decision. If a person complains, it is hardly possible to explain why exactly they received this message, and there is nobody who could change the decision other than the agent itself.

With an approval step, the ground rules are set in advance: which kinds of decisions may the agent make on its own, for example the send time for a message that was planned anyway? Which does it submit to a human, for example individual terms or exclusions? The human sees what is being proposed and can intervene. This corresponds to what Art. 22(3) requires as a safeguard in the cases of contract and explicit consent: the right to human intervention, to expressing one’s point of view and to contesting the decision.

Honesty matters here too: an approval step does not automatically make a decision lawful. It creates the precondition for a deliberate, traceable human decision to exist. Whether an exception under paragraph 2 applies is a separate review.

How we proceed in the audit

We describe our approach without claiming figures or references. You can also follow it without us.

Step one: we clarify what the tool actually decides. Marketing vendors use terms such as “agentic” very differently. We ask: does the tool only select from templates, or does it determine content, terms or exclusions? Does it determine timing and channel, or also whether someone is contacted at all?

Step two: we classify each decision by its effect on the person. A reminder at lunchtime is something different from an individually reduced price or exclusion from a promotion. We flag the second group for legal review.

Step three: we check whether there is actually human involvement. Is there a point at which someone can understand and change a decision? And does this person see more than a list of names and a checkmark?

Step four: we record which legal basis you have for the data processing and whether an exception under Art. 22(2) comes into question. We do not assess that ourselves, but prepare the questions for your legal counsel.

Step five: we write down how a data subject can exercise their rights. Anyone with questions or objections needs a route to a human in the company, and that human needs access to why the decision turned out the way it did.

Step six: we define what the agent may do on its own. The result is a short list with two columns: “Agent may act alone” and “Needs approval”. Everything new starts in the second column and moves to the first only after a trial period.

What you should prepare this week

Since this is about a development that is coming for you, and not a tool you are switching on today, it stays at preparation.

1. List which marketing tools in your setup already make decisions about individual people automatically. This includes recommendations, price promotions, send times and segment assignments. Often only this look shows you how much already runs automatically.
2. Ask your vendors in writing whether their tools make individual decisions within the meaning of Art. 22 GDPR. Also ask what option for human intervention is provided. An evasive answer is also an answer.
3. Talk to your data protection officer before you buy a tool with “agentic” personalization. Reviewing beforehand is cheaper than correcting afterwards.
4. Create a short decision list for each tool. Two columns are enough: what may run automatically and what a human must see.
5. Determine who in the company answers inquiries about individual decisions. If nobody can explain today why a person received a particular message, that is your first action item.

Common objections

“That’s just advertising.” For many cases that is true, and Art. 22 then does not apply. The review serves to identify the cases in which it is no longer just advertising, for example with individual terms or exclusions.

“The vendor has assured GDPR compliance.” An assurance does not replace the question of how you use the tool. In the announcement we read, there is no statement on Art. 22, and a general compliance claim in the footer of a website says nothing about your specific use.

“With us, someone always confirms.” That is good if the person sees what they are confirming and can actually change it. A merely formal confirmation does not help. The CJEU case shows that the factual effect is what counts.

“We are a small company.” Art. 22 has no exception for size. Small companies in particular buy tools whose decision logic they cannot check themselves, and they depend on clear answers from vendors.

Conclusion

“Agentic Decisioning” describes marketing agents that decide per person on content, timing, channel and frequency. The press release of June 23, 2026 shows that the market is moving in this direction, but names neither regions nor dates and says nothing about Art. 22 GDPR. The legal provision applies unchanged. It does not prohibit personalization, but it sets limits where a solely automated decision becomes significant for a person.

Our working rule from this: before buying, clarify which decisions a tool makes, and put an approval step where the effect on the individual person can be significant. The difference that matters is the one between an agent with limits and an approval step and an agent that makes final decisions per person.

A brief overview of sources: MoEngage, “MoEngage Acquires Aampe to Bring 1:1 Agentic Decisioning to B2C Marketing Teams”, June 23, 2026 (vendor press release); Art. 22 GDPR, wording via dsgvo-gesetz.de; CMS, “Das Schufa-Urteil des EuGH und dessen Auswirkungen” (summary on CJEU C-634/21 of December 7, 2023, last updated April 18, 2024). For the description of our agents: amazing-agents.com, sections on agents, control center and frequently asked questions.