AI personalisation and CRO: what an SME can actually personalise

Personalisation promises that every visitor sees the right message and the right product. In practice most SMEs stumble on the very first question: which data do I actually have, and what can I do with it without an enterprise budget? This article is the AI layer on top of our step-by-step guide to conversion optimisation. No repeat of the CRO basics, but an answer to four concrete questions: what do you personalise, which data do you need for it, what can you do yourself, and how do you know whether it works. If your webshop is structurally underperforming, start with the diagnosis in why your webshop is not converting.

What exactly is AI personalisation in conversion optimisation?

AI personalisation is automatically adapting what a visitor gets to see, based on data about who that visitor is and what they did before. The difference with ordinary segmentation: with segmentation you write the rules yourself, with AI personalisation a model derives them from behavioural data. The gain sits not in the technology, but in the relevance of what you show.

That distinction determines what you need. Segmentation runs on rules you can write out (“anyone who already bought does not see a welcome discount”) and works from day one. A model that learns patterns by itself needs history: without enough orders and behaviour it has nothing to learn from. For most SME webshops the first layer is therefore rule-based, with the AI layer on top of it. None of that changes the order of CRO: first measure where visitors drop off, only then personalise.

The gap between ambition and practice is wide. Between October and November 2025 Salesforce surveyed some 4,450 marketing decision makers for its Tenth Edition State of Marketing Report (published in February 2026): 75% use AI, while 84% admit they still send generic campaigns. More technology does not automatically produce more relevance.

“We are using the most powerful technology in history to send more one-way spam, faster. You can’t give a customer a personalized recommendation or reply if your AI doesn’t actually know who they are.”

— Bobby Jania, CMO Agentforce Marketing at Salesforce

What can you actually personalise on a webshop?

Four layers, in rising order of difficulty: product recommendations, email segmentation, message per traffic source, and real-time adaptation of the site itself. The first three run on data you already have and on tools you probably already pay for. The fourth needs a personalisation engine, test volume and maintenance.

What you personalise	Data you need for it	Realistic for an SME?
Related products on the product page	Purchase history in your own shop	Yes, Shopify generates them automatically
Complementary products (“goes with this”)	Manually set product relations	Yes, free via the Search & Discovery app
Email segments on purchase and click behaviour	Order history and email engagement	Yes, standard work in Klaviyo
Predicted customer value and churn risk	500 customers with an order, 180 days of history	Yes, once you reach that threshold
Message per traffic source or campaign	UTM parameters and separate landing pages	Yes, without a personalisation tool
Real-time adaptation of banners and content blocks	Behavioural data in the session plus consent	Limited, from a lightweight tool and enough traffic
Prices or catalogue per individual visitor	Large data volumes and custom development	No, that is enterprise territory

One form of personalisation is often forgotten: showing social proof to the people who need it. New visitors need reviews and guarantees, returning customers rarely do. The Spiegel Research Center at Northwestern University found in 2017 that the purchase likelihood of a product with five reviews was up to 270% higher than for the same product without reviews. An important caveat with that figure: the research observed products while they were collecting reviews and randomised nothing, so products that sell well anyway also collect reviews faster. Read it as a strong association, not as a guaranteed effect.

What data do you need before personalisation delivers anything?

Three things: first-party data about purchases and behaviour, a measurement setup you can tie to a customer identity, and valid consent for the tracking you use for it. If one of the three is missing, you are personalising on noise and your reporting will not show whether it worked.

That consent is not a side condition but a data condition. If you work with consent mode and part of your visitors refuse marketing cookies, you do not see that part of your audience in your behavioural data and cannot personalise for them either. That is exactly the reason to build as much as possible on data sitting in your own systems: orders, customer accounts and email behaviour do not depend on a cookie banner.

A detail that catches recently migrated webshops out: Shopify does not use orders imported from another platform in its recommendation algorithm. Anyone who just moved over from WooCommerce or Magento therefore starts with an empty memory and needs a few months of sales before the recommendations become meaningful. So plan personalisation for phase two of a replatforming, not for the launch.

What can you do yourself, without a personalisation platform?

More than most webshops use. Shopify generates related products automatically, complementary products you set up for free, and your email tool does segmentation and predictions on your order history. For a webshop with a few hundred orders per year, that is where most of the achievable gain sits.

Shopify’s recommendations API knows two types: related and complementary. Only the first is built automatically, based on products historically purchased together, products with similar descriptions and products from the same collection. Complementary products (“goes with this”) you set up yourself, and that can be done for free with Shopify’s own Search & Discovery app, which also covers filters, synonyms and search boosts. For most shops that is the first intervention with the highest return per hour of work, because it touches every product page.

The strongest layer sits on the email side. Klaviyo only switches on its predictive analytics (expected customer value, churn risk, expected date of the next order) once you meet a set of hard conditions: at least 500 customers who placed an order, at least 180 days of order history with recent orders, and a share of customers with three or more orders. On Klaviyo’s free plan, capped at 250 profiles, you cannot reach that threshold by definition. If you are not there yet, classic segmentation on purchase behaviour and engagement is your best move; how to build those flows is covered in our guide to email marketing automation, and the wider automation picture sits with marketing automation.

Where does enterprise territory begin?

As soon as you want to personalise in real time, across channels and at individual level with a dedicated engine. Dynamic Yield, owned by Mastercard since April 2022, publishes no prices and works exclusively through a demo request. That is the signal: no self-service, so not a product for an SME that wants to start today.

There are lighter tools with public pricing. Personyze, for instance, has a free plan (5,000 pageviews, three campaigns) and paid plans from 149 dollars per month, with the cap expressed in pageviews. That makes it a realistic test environment, although the question remains whether you have enough traffic to prove the return.

Be careful too with the figures that circulate in sales pitches. McKinsey wrote in 2021 that personalisation typically drives a 10 to 15% revenue lift, and that faster-growing companies drive 40% more of their revenue from personalisation than slower-growing competitors. That is an estimate from a consultancy that sells personalisation projects, without a published sample or methodology, and from before the generative AI wave. Usable as a direction, not as a business case for your webshop.

Want to know whether your webshop has enough data to personalise? ClickForest runs conversion optimisation for webshops of SMEs in Flanders. See our CRO approach or book a free video call.

How much traffic do you need to test personalisation?

That depends on your baseline conversion and on the effect you want to be able to see, not on a fixed number. The lower your conversion and the smaller the difference you want to detect, the more visitors you need. Calculate it upfront with a sample size calculator instead of believing a rule of thumb.

The formula behind every calculator sits in the standard work by Ron Kohavi and colleagues from 2009: the number of visitors per variant scales with the variance divided by the square of the difference you want to detect. In practice that means halving the difference you want to detect makes your test four times as large. Their own example: with a baseline conversion of 5% and a target detection of 5% relative improvement you need just under 122,000 visitors per variant; if you only need to see an improvement of 20%, that drops to roughly 7,600.

Put your own numbers beside that. Contentsquare’s Digital Experience Benchmark 2026 (99 billion sessions, mostly larger sites) measured 3.4% conversion on desktop against 2% on mobile. With such a baseline and a modest test ambition, the required volume quickly runs into tens of thousands of visitors per variant. That is no reason not to personalise, but it is a reason to treat personalisation you cannot test as an assumption rather than as a proven improvement.

“Decide on a sample size in advance and wait until the experiment is over before you start believing the ‘chance of beating original’ figures.”

— Evan Miller, statistician and author of the most widely used sample size calculators

Testing itself has come closer. On 5 June 2026 Shopify added rollouts and experiments to Markets, letting you pit two theme or checkout configurations against each other: rollouts from the Basic plan, experiments from Grow, and only for the online store checkout. Google Optimize, for years the free standard, has not existed since 30 September 2023 and GA4 never got a replacement of its own; Google now points to third-party testing tools. In any case, run a test for at least one to two full weeks and extend in whole weeks, so that differences between weekdays do not leak into your result.

What are you allowed to personalise under the GDPR?

Personalising on behavioural data requires consent. The ePrivacy Directive demands that you only place or read information on a visitor’s device after they have consented, and the GDPR obliges you to explain that you profile and what the logic behind it is. Strictly necessary functionality falls outside that consent requirement, personalisation trackers do not.

One thing that often gets overstated: article 22 GDPR, on decisions based solely on automated processing. The guidelines of the European privacy regulators (WP251rev.01, 2018) state that targeted advertising based on profiling in many typical cases has no similarly significant effect, unless the profiling becomes highly intrusive, for example by tracking people across websites and devices. A product recommendation in your webshop usually falls outside that article; your consent and information obligations do still apply in full.

New from 2 August 2026: article 50 of the AI Act requires that people know they are talking to an AI system, unless that is obvious in itself. If you run a chatbot on your webshop, make sure it says so. The stricter rules for high-risk AI moved with the June 2026 amendment to 2 December 2027 and 2 August 2028, and a recommendation system in a webshop does not fall under those anyway. This article is not legal advice: have your setup reviewed as soon as you go beyond recommendations and email segmentation.

When does personalisation backfire?

When the visitor feels watched. Research in the Journal of Retailing (Aguirre et al., 2015) showed that personalised ads perform better when people know their data was collected, and worse when that happened covertly. Openness about your data source is therefore not a legal formality but a conversion factor.

The researchers call it the personalisation paradox: the same personalised message can work or backfire, depending on the context in which the data was collected. Covert data collection creates a feeling of vulnerability, and trust signals can partly offset that effect. A Harvard Business Review article from January 2018 arrives at two practical prohibitions: do not personalise on information you collected about someone on another site, and do not personalise on something you inferred but the visitor never told you themselves.

Translated to a webshop: personalise on what someone did in your shop, state why they are being shown something (“because you viewed this category”), and always leave a route to the full catalogue open. Personalisation you cannot explain to the customer is usually personalisation you cannot defend to a regulator either.

What should you remember about AI personalisation and CRO?

AI personalisation is not a separate discipline next to conversion optimisation, but a layer on top of it. The order stays the one from the step-by-step guide: first measure where your visitors drop off and fix the basics, then personalise where it makes a difference. Start with what you already have (recommendations in Shopify, segments in your email tool, separate landing pages per channel), work out upfront whether you can measure a difference, and be open about the data you personalise on. Where the wider market is heading is covered in our e-commerce trends for Belgium.

ClickForest helps SMEs in Flanders with conversion optimisation and personalisation, tied to their e-commerce approach. Not sure whether your webshop has enough data and volume to personalise? Book a free video call and we will go through it together.