Generative AI tools have become part of the work of those managing ads. But what you write in a prompt may be stored, analysed or used to improve the model, depending on each tool’s terms. Knowing what data should never go into a prompt is a basic safety rule.
The essentials in a definition
When using AI tools in advertising, some data should never enter a prompt: customers’ personal data, confidential information, credentials, sensitive data and protected content you have no right to share. The GDPR requires legal basis and minimisation, the AI Act reinforces governance, and NIST advises usage policies. A simple rule avoids leaks.
Where what you write goes
Some tools store conversations, others let you turn off storage, others process only during the session. Terms vary, and change over time. In free tools, data is more often used to improve products. In business versions there are usually stronger contractual guarantees.
Even so, what is shared leaves the company’s direct control.
Data that must never go in
Customers’ personal data (names, emails, phones, addresses) and complete lists. Sensitive data (health, finance, beliefs). Passwords, access keys and credentials. Contracts and confidential information of clients or the company. Information on prices, margins and strategy that must not leave. Data under contractual confidentiality.
If in doubt, do not share.
Safe prompts
- Never include personal data or credentials
- Anonymise and aggregate before use
- Use only approved tools
- Train teams and suppliers
How to work safely
Anonymise and aggregate data before using it. Replace names with placeholders. Use summaries instead of lists. Choose tools with suitable terms and data control. Define a simple internal policy: which tools are approved, what data is prohibited, who approves exceptions.
Train the team and agencies.
What is written in a prompt can leave the company; write as if it were public.
Verify and review
Review the terms of the tools you use, especially when they change. Include the AI policy in contracts with agencies and suppliers. Run periodic audits and update the rules. If there is an incident, treat it as a data incident.
Convenience does not justify the risk.
Decision table
| Type of data | May it enter? | Alternative |
|---|---|---|
| Customers’ personal data | No | Anonymise or use aggregated data |
| Credentials and access keys | Never | Secrets manager |
| Company confidential information | Only in approved tools with safeguards | Non-sensitive summaries |
| Sensitive data | No | Fictitious examples |
Common mistakes to avoid
- Pasting customer lists into a public assistant. It may be a leak and an infringement.
- Sharing tool accounts. Use individual access and clear policies.
- No policy. The team decides alone and there is inconsistency.
How to measure the result
Track training completed, incidents or near-incidents reported and periodic review of the policy.
Limits and exceptions
Full anonymisation is hard, and AI tool terms change, so the policy should be conservative and reviewed regularly. It is not always clear how data are used by suppliers. When in doubt, do not share and seek legal and technical support, training the team on real risks.
Illustrative example
Illustrative example: a company defines a one-page AI-use policy: which tools are approved, what data never enters and how to anonymise. It trains the team and includes examples of good and bad uses. When someone wants to analyse a customer list, they use an aggregated summary without identifiers. Risk falls and usefulness is kept.
In practice: checkpoints
Never paste customer lists, contact details, health or financial data, confidential contracts or credentials into tools that you have not approved. Use anonymised or synthetic examples, check each tool’s data policy and settings, and define in writing which tools are allowed for which tasks. Train the team, review the rules every quarter and log exceptions, so convenience does not overrule privacy.
Frequently asked questions
Can I paste a customer list?
No. Use anonymised, aggregated data.
Are paid versions safe?
They usually have better guarantees, but check the terms.
Do I need a policy?
Yes, even a short one: approved tools, prohibited data and an owner.
Which tools can I use?
Those approved by the company, with contractual privacy and data-use guarantees; check the terms.
How do I anonymise?
By removing direct and indirect identifiers and aggregating; when in doubt, do not share.
Never put personal data, credentials, confidential information or sensitive data in a prompt; use approved tools, anonymise and have an AI-use policy.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- Artificial Intelligence Act (AI Act)
- NIST: AI Risk Management Framework
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.