Civil Law and Consumer Protection in AI-Driven Hyper-Personalized Markets in Europe

1. Introduction

AI-driven hyper-personalized markets are markets where artificial intelligence analyses large amounts of consumer data and creates highly individualized:

prices;

advertisements;

product recommendations;

search results;

contractual offers;

credit or insurance offers;

discounts;

rankings;

subscription offers;

purchasing incentives.

A simple example is:

Two consumers visit the same online platform and see different products, different recommendations, different discounts, or potentially different prices because an AI system has analysed their individual behaviour.

European civil law faces an important question:

How can consumer autonomy, fairness, transparency and contractual freedom be protected when AI systems know substantially more about individual consumers than the consumers know about the AI system?

This subject combines consumer contract law, GDPR, unfair commercial practices, digital-platform regulation, AI regulation, competition law and civil remedies.

2. Meaning of Hyper-Personalization

Ordinary personalization might mean:

“You bought running shoes, so the website recommends running socks.”

Hyper-personalization goes much further.

AI may analyse:

browsing history;

purchase history;

location;

device information;

search behaviour;

time spent viewing products;

clicks;

social-media activity;

inferred interests;

income-related indicators;

behavioural patterns;

inferred willingness to pay.

The system can then predict:

What this particular consumer is likely to buy, when they will buy it, and how strongly they can be persuaded.

This creates new civil-law concerns because the consumer may not know:

what information was used;

what characteristics were inferred;

why a particular offer was shown;

whether the price was personalized;

whether the recommendation was commercially motivated;

whether the AI manipulated the consumer's decision.

3. Traditional Consumer Law vs AI Hyper-Personalization

Traditional consumer law generally assumes:

Consumer ↔ Trader

with relatively understandable information.

AI-driven markets can instead look like:

Consumer → Data → AI model → Consumer profile → Personalized commercial decision → Consumer

The AI system therefore becomes an important intermediary in the consumer relationship.

The legal challenge is that the consumer may see only the final result, while the underlying decision-making process remains hidden.

4. Main European Legal Framework

Several European legal regimes overlap.

1. GDPR

The General Data Protection Regulation regulates the processing of personal data, profiling, transparency, lawful bases, data subject rights and automated decision-making.

2. Unfair Commercial Practices Directive

Directive 2005/29/EC addresses misleading and aggressive commercial practices.

This is highly relevant to AI systems designed to influence purchasing decisions.

3. Consumer Rights Directive

Directive 2011/83/EU regulates information and consumer rights in distance and online contracts.

4. Unfair Terms Directive

Directive 93/13/EEC protects consumers against unfair contractual terms.

5. Digital Services Act

Regulation (EU) 2022/2065 imposes important transparency and platform obligations, including rules concerning recommender systems and advertising.

6. AI Act

The EU AI Act creates a risk-based framework for artificial intelligence.

Its relevance to consumer protection includes transparency and restrictions concerning certain manipulative or exploitative AI practices.

7. Data Act

The EU Data Act creates additional rules concerning access to and use of data generated through connected products and related services.

5. Consumer Autonomy

One of the most important civil-law concepts is consumer autonomy.

A valid consumer decision should generally be:

informed;

voluntary;

sufficiently independent;

free from unlawful deception;

free from prohibited coercion.

Hyper-personalized AI can potentially interfere with autonomy when it identifies an individual's psychological or behavioural vulnerabilities and targets them specifically.

For example:

An AI system learns that a consumer frequently purchases products when experiencing stress and increases targeted advertising during periods when the consumer is most susceptible to purchasing.

This raises a fundamentally different question from ordinary advertising:

Is the consumer merely being persuaded, or is the consumer being systematically manipulated?

6. Personalization and Information Asymmetry

AI creates a significant information asymmetry.

The trader may know:

what the consumer purchased;

what they searched for;

what they rejected;

how long they looked at an item;

what price they previously accepted;

what advertisements attracted them.

The consumer may know almost none of this.

Civil-law consumer protection therefore attempts to restore informational balance through:

transparency;

disclosure;

access rights;

explanation requirements;

prohibition of misleading practices;

contractual information duties.

7. Hyper-Personalized Pricing

One of the most important issues is individualized pricing.

AI can theoretically estimate the maximum price a particular consumer may accept.

For example:

Consumer A sees:

€50

Consumer B sees:

€65

The system may have generated the difference from behavioural information.

Personalized pricing is not automatically unlawful merely because it is personalized.

The legal issues include:

Was the consumer misled?

Was the personalization disclosed where legally required?

Was personal data lawfully processed?

Was the practice discriminatory?

Was the consumer exploited because of vulnerability?

Was the pricing method unfair?

Was the consumer given the information necessary to make an informed decision?

8. AI Profiling

Profiling means automated processing of personal data to evaluate or predict aspects concerning a person.

AI profiling may predict:

preferences;

economic situation;

interests;

reliability;

behaviour;

purchasing probability;

willingness to pay.

Under GDPR, profiling is subject to important transparency and data-protection requirements.

Article 22 is particularly important where decisions are based solely on automated processing and produce legal or similarly significant effects.

9. Automated Decision-Making

A major distinction must be made between:

Automated recommendation

Example:

“You may also like these shoes.”

and

Automated significant decision

Example:

“Your application for this financial product has been automatically rejected.”

The second situation generally raises much stronger legal concerns.

A consumer may have rights concerning:

information;

human intervention;

contesting the decision;

explanation of relevant processing;

access to personal data.

The exact rights depend upon the legal basis and circumstances of the processing.

10. Dark Patterns and AI

Dark patterns are interface designs intended to steer consumers toward a particular choice.

AI can make dark patterns highly individualized.

Traditional dark pattern:

“Only 2 items left!”

AI-enhanced dark pattern:

The system determines that this particular consumer responds strongly to scarcity messages and displays such messages specifically to that person.

The distinction is important.

AI transforms a general persuasive technique into potentially individualized behavioural manipulation.

European law increasingly addresses these practices through consumer and digital-platform regulation.

11. AI and Vulnerable Consumers

Hyper-personalization becomes particularly sensitive when AI identifies vulnerable consumers.

Potentially relevant vulnerabilities include:

financial difficulty;

age;

disability;

addiction-related behaviour;

emotional vulnerability;

limited digital literacy.

The legal concern is not simply that the consumer receives personalized advertising.

The concern is:

Was the consumer's vulnerability identified and exploited to obtain a commercial advantage?

This is closely connected with the prohibition of aggressive or unfair commercial practices.

12. AI Recommendations and Commercial Intent

A recommendation may look neutral but actually be commercial.

For example:

“Best products for you”

may actually mean:

“Products from sellers who paid the platform for greater visibility.”

Consumer law therefore requires attention to:

sponsored rankings;

advertising;

influencer marketing;

affiliate arrangements;

paid recommendations;

platform commissions.

AI can make these commercial relationships harder to detect.

13. AI and Consumer Contracts

AI may participate in the creation or modification of contracts.

Examples include:

personalized subscription offers;

automatic renewal;

dynamic discounts;

individualized cancellation incentives;

AI-generated terms;

automated customer-service decisions.

Civil law must determine:

When does an AI-generated output become legally attributable to the trader?

Normally, the trader cannot simply avoid contractual responsibility by arguing:

“The AI made the decision.”

The commercial operator generally remains responsible for complying with applicable consumer law.

14. AI-Generated Contract Terms

AI can generate different terms for different consumers.

For example:

Consumer A may receive:

30-day cancellation period.

Consumer B may receive:

14-day cancellation period.

This raises questions concerning:

transparency;

equality;

unfair terms;

informed consent;

discrimination;

contractual interpretation.

The fact that an AI generated the clause does not automatically make the clause legally valid.

15. GDPR and Hyper-Personalization

The GDPR is central because hyper-personalization normally depends upon personal data.

Important principles include:

Lawfulness

The trader needs a valid legal basis.

Purpose limitation

Data should not simply be collected for one purpose and silently repurposed for another incompatible purpose.

Data minimisation

Only necessary data should be processed.

Transparency

Consumers must receive understandable information concerning relevant processing.

Accuracy

Incorrect data can produce incorrect consumer profiles.

Accountability

The controller must be able to demonstrate compliance.

16. Right to Object to Direct Marketing

Consumers have strong protections concerning direct marketing under GDPR.

This becomes important where AI continually profiles consumers to determine which advertisements they should receive.

The consumer's objection rights can therefore limit certain forms of personalized marketing.

17. Data Protection and Consumer Law Overlap

The same AI practice may violate several legal regimes simultaneously.

For example:

AI collects excessive personal data

→ GDPR issue.

AI uses the data to create a hidden consumer profile

→ transparency/profiling issue.

AI uses the profile to manipulate a vulnerable consumer

→ consumer-law issue.

AI presents sponsored results as neutral recommendations

→ commercial-practice issue.

Consumer suffers financial loss

→ possible civil remedy.

This demonstrates why AI consumer disputes cannot always be analysed under contract law alone.

18. Important Case Law

Case 1 — Google Spain SL v AEPD and Mario Costeja González

CJEU, C-131/12, 13 May 2014

This is one of the foundational European data-protection cases.

Principle

The CJEU recognised important rights concerning the relationship between personal data and online search systems.

It established the significance of individual control over personal information in the digital environment.

Importance for AI markets

AI systems depend heavily upon historical digital information.

The case supports the broader principle that individuals cannot be treated merely as passive sources of commercially exploitable data.

It is particularly relevant to:

profiling;

online identity;

data-driven personalization;

control over personal information.

19. Case 2 — Wirtschaftsakademie Schleswig-Holstein

CJEU, C-210/16, 5 June 2018

Facts

The dispute concerned the operation of a Facebook fan page and the processing of visitor information.

Principle

The CJEU recognised joint responsibility in circumstances where different actors participate in determining purposes or means of processing.

Relevance to AI personalization

Modern AI markets often involve:

Platform + advertiser + data broker + AI provider

A platform cannot necessarily avoid responsibility simply because another company technically processes the data.

The case is therefore important for determining responsibility in complex AI ecosystems.

20. Case 3 — Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW

CJEU, C-40/17, 29 July 2019

Principle

The CJEU considered responsibility for personal-data processing involving embedded online technologies.

The case emphasised that different participants in a digital ecosystem may have legally significant roles in data processing.

AI-market relevance

Hyper-personalized advertising often involves:

cookies;

tracking pixels;

advertising technology;

AI profiling;

third-party platforms.

The case helps demonstrate why responsibility cannot always be assigned solely to the final AI provider.

21. Case 4 — Google LLC v CNIL

CJEU, C-507/17, 24 September 2019

Principle

The case concerned the territorial scope of the right to delisting under European data-protection law.

The CJEU distinguished between EU-wide protection and a general requirement to remove results globally.

Relevance

AI systems operate across borders.

A consumer may interact with:

an EU trader;

a non-EU AI provider;

a global platform.

The case demonstrates the importance of determining the territorial reach of European digital rights.

22. Case 5 — Schrems II

CJEU, C-311/18, 16 July 2020

Principle

The CJEU examined international transfers of personal data and the protection required when European personal data is transferred outside the EU.

Relevance to hyper-personalized AI

AI services frequently depend upon international cloud infrastructure.

Consumer data may therefore move between:

EU companies;

US technology providers;

international cloud services;

AI-model providers.

The case highlights the importance of protecting European consumers' personal data even when processing occurs through international technological infrastructures.

23. Case 6 — Österreichische Post AG

CJEU, C-154/21

Principle

The CJEU considered compensation for non-material damage under the GDPR.

The judgment is important for understanding that data-protection violations can potentially result in compensatory claims where the legal requirements are satisfied.

AI relevance

If an AI-driven personalization system unlawfully processes consumer data and causes legally recognised harm, the consumer may potentially pursue remedies under GDPR-based civil liability.

This is important because AI harms are not always purely economic.

24. Case 7 — Nowak v Data Protection Commissioner

CJEU, C-434/16, 20 December 2017

Principle

The CJEU adopted a broad understanding of what may constitute personal data.

AI relevance

AI systems create extensive consumer profiles.

The case supports the idea that information connected to an identifiable individual can fall within data-protection law even where the information does not look like traditional identifying information.

This is particularly important for:

behavioural profiles;

inferred preferences;

predictive analytics.

25. Case 8 — SCHUFA Holding AG

CJEU, C-634/21, 7 December 2023

This case is particularly significant for AI-driven decision systems.

Principle

The CJEU considered automated decision-making and the legal significance of scoring under Article 22 GDPR.

The case demonstrates that a supposedly preliminary algorithmic score can itself be subject to strict GDPR scrutiny where it effectively determines another party's decision.

AI-market relevance

This reasoning can become important wherever a platform says:

“The AI does not make the final decision; it merely generates a score.”

If the score effectively determines the commercial outcome, it cannot necessarily be treated as legally irrelevant.

26. Case 9 — Meta Platforms Ireland v Bundeskartellamt

CJEU, C-252/21, 4 July 2023

This is particularly important for data-driven digital markets.

Principle

The CJEU examined the relationship between competition law and data protection in Meta's processing practices.

The judgment demonstrates that extensive personal-data processing by dominant digital platforms can have significance beyond conventional privacy law.

Relevance to hyper-personalization

A platform may possess enormous amounts of consumer information and use that information to create increasingly powerful personalization systems.

The case therefore demonstrates the interaction between:

data protection;

platform power;

competition law;

consumer autonomy.

27. Case 10 — Glawischnig-Piesczek v Facebook Ireland

CJEU, C-18/18, 3 October 2019

Principle

The CJEU addressed online-platform responsibilities concerning unlawful content and the scope of injunctions.

AI relevance

Modern platforms increasingly use automated systems to:

identify content;

classify users;

rank information;

remove material;

recommend content.

The case provides broader context for understanding how European law imposes responsibilities on digital intermediaries using automated systems.

28. Unfair Commercial Practices

AI-driven personalization may constitute an unfair commercial practice where it:

provides false information;

conceals material information;

creates misleading impressions;

exploits vulnerability;

uses aggressive pressure;

manipulates consumer decisions.

The Unfair Commercial Practices Directive therefore provides an important civil-law-adjacent mechanism for protecting consumers.

29. AI Manipulation

The EU AI framework is particularly concerned with certain forms of manipulation.

The legal distinction is important:

Ordinary persuasion

“This product is popular.”

Personalized persuasion

“People with your interests often buy this product.”

Potentially problematic manipulation

AI identifies a person's vulnerability and deliberately exploits it to materially distort that person's behaviour.

The third situation creates much greater legal concern.

30. Consumer Vulnerability as a Civil-Law Concept

Traditional civil law often recognises weaker parties.

Consumer law developed partly because:

The consumer generally has less information and bargaining power than the professional trader.

AI creates a new form of inequality:

Trader knows the consumer

but

Consumer does not know how the trader's AI understands the consumer.

This can be described as algorithmic information asymmetry.

31. Algorithmic Information Asymmetry

The asymmetry can be represented as:

Consumer behaviour

↓

Data collection

↓

AI profiling

↓

Hidden prediction

↓

Personalized commercial treatment

↓

Consumer decision

The consumer generally sees only the final offer.

The trader sees the entire chain.

Consumer law attempts to reduce this imbalance through transparency and fairness requirements.

32. Personalized Recommendations

Recommendations can be legitimate and beneficial.

For example:

“You previously bought this printer, so these cartridges are compatible.”

But the same technology may become problematic where the platform:

hides cheaper alternatives;

prioritizes sponsored products without adequate disclosure;

exploits known vulnerabilities;

prevents meaningful comparison;

manipulates rankings.

Therefore, personalization itself is not the legal problem.

The legal question is how personalization is designed and used.

33. AI and Consumer Choice Architecture

AI can dynamically change the consumer's digital environment.

For Consumer A:

premium products first.

For Consumer B:

discounted products first.

For Consumer C:

products likely to trigger impulse purchasing.

This creates a new concept:

Dynamic choice architecture

The platform does not simply sell products.

It dynamically designs the decision environment in which the consumer chooses.

This creates major questions concerning consumer autonomy and informed consent.

34. Dynamic Contracts

AI can personalize contractual offers in real time.

For example:

different subscription discounts;

different renewal offers;

personalized bundles;

individualized incentives;

automated retention offers.

Civil courts may need to determine:

What terms were actually presented?

What did the consumer understand?

Was the term transparent?

Was the consumer misled?

Was the term unfair?

Was the AI acting within the trader's authority?

35. Civil Liability for AI Consumer Harm

Potential liability can arise from:

Contract

Failure to perform contractual obligations.

Tort/delict

Damage caused by unlawful conduct.

Consumer law

Unfair or misleading commercial practices.

Data protection

Unlawful processing of personal data.

Product liability

Where an AI-enabled product causes legally recognised damage.

Platform regulation

Failure to comply with applicable digital-service obligations.

36. Burden of Proof

AI creates a major evidentiary difficulty.

The consumer may say:

“The platform discriminated against me.”

But the consumer may not know:

what algorithm was used;

what data was used;

what profile was created;

what variables affected the decision.

The trader may possess all relevant information.

This creates an algorithmic evidence asymmetry.

European legislation increasingly addresses transparency and access to information, but national procedural rules still play a major role in determining how such claims are proved.

37. Explainability

Consumers increasingly ask:

Why did the AI show me this?

There are several levels of explanation:

Basic explanation

“This recommendation was based on your previous purchases.”

Intermediate explanation

“The system considered your purchases, searches and product preferences.”

Advanced explanation

“The following categories of data materially influenced the recommendation.”

European law does not necessarily create a universal right to receive the complete source code or mathematical formula of an AI system.

The relevant legal obligation depends upon the specific legislation and circumstances.

38. Trade Secrets vs Consumer Transparency

AI companies may argue:

“Our algorithm is a trade secret.”

Consumers may respond:

“I need sufficient information to understand and challenge the decision.”

European law therefore requires balancing:

consumer transparency;

data protection;

intellectual property;

trade secrets;

business confidentiality.

The solution is generally not unrestricted disclosure of source code.

Instead, legally required information may be provided without revealing every technical detail.

39. Discrimination in Hyper-Personalized Markets

AI personalization can potentially create discriminatory outcomes.

For example, different consumers could receive different:

prices;

credit offers;

insurance offers;

advertisements;

product availability;

promotions.

Relevant protected characteristics may vary according to the applicable EU and national legislation.

A discrimination claim requires careful examination of:

the protected ground;

the decision mechanism;

the comparator;

causation;

justification;

applicable anti-discrimination legislation.

Not every difference between consumers constitutes unlawful discrimination.

40. Collective Consumer Claims

AI systems can affect millions of consumers simultaneously.

Potential collective claims could concern:

unlawful profiling;

hidden personalized pricing;

misleading AI recommendations;

unlawful advertising;

unfair terms;

data misuse;

dark patterns.

EU representative-action mechanisms can become particularly important where individual claims are too small to justify separate litigation.

41. Remedies

Possible remedies may include:

Injunction

Stop the unlawful AI practice.

Declaration

Declare a contractual term or practice unlawful.

Restitution

Return money unlawfully obtained.

Damages

Compensate legally recognised economic or non-economic harm.

Correction

Correct inaccurate consumer data.

Deletion

Remove unlawfully processed personal data where applicable.

Contractual remedy

Invalidate or modify an unfair contractual term.

Regulatory penalty

Administrative authorities may impose penalties under applicable legislation.

42. Key Difference: Personalization vs Manipulation

Therefore:

European law does not prohibit personalization as such. It regulates the methods, data practices and consequences associated with personalization.

43. Major Civil-Law Issues for the Future

A. AI-generated prices

Courts may have to determine when personalized pricing becomes unfair.

B. AI-generated contracts

Questions of consent and contractual attribution will become increasingly important.

C. Emotional AI

Systems may detect emotional states and adapt commercial messages accordingly.

D. Digital twins

A detailed digital model of the consumer could predict purchasing behaviour.

E. Autonomous shopping agents

AI agents may eventually negotiate and purchase goods on behalf of consumers.

F. Consumer scoring

AI could create detailed commercial scores for individual consumers.

G. Synthetic personalization

AI may generate entirely new consumer preferences or behavioural predictions rather than relying only on historical behaviour.

44. Six Core Cases for Examination

45. Ultra-Basic Legal Structure

AI Consumer Market

↓

Personal Data

↓

Profiling

↓

Prediction

↓

Personalized Recommendation / Price / Advertisement

↓

Consumer Decision

↓

Possible legal questions:

Transparency?

Consent?

Unfair practice?

Manipulation?

Discrimination?

Unfair contract?

Data protection violation?

Damage?

↓

Civil / Consumer / Regulatory Remedy

46. Conclusion

Consumer protection in AI-driven hyper-personalized markets in Europe represents a major development of modern civil and consumer law.

The traditional consumer-protection problem was primarily:

Trader knows more about the product than the consumer.

The AI-era problem is broader:

Trader may know more about the consumer than the consumer knows about the trader's knowledge of them.

European law responds through a combination of GDPR, unfair commercial-practice rules, unfair-contract rules, digital-platform regulation, AI regulation and civil remedies.

The central legal principles are:

Transparency

Consumer autonomy

Fairness

Data protection

Accountability

Protection against manipulation

Protection of vulnerable consumers

Effective remedies

Human oversight where legally required

Responsibility of businesses for AI-enabled commercial practices

The most important jurisprudence includes Google Spain, Wirtschaftsakademie, Fashion ID, Nowak, SCHUFA, Meta Platforms v Bundeskartellamt, Schrems II and Österreichische Post. Together, these cases show how European law is moving from traditional consumer protection toward regulation of data-driven, algorithmic and increasingly autonomous commercial decision-making.