Less, But Better: Why Data Minimization Makes Publisher Personalization Stronger

What scholarly publishers gain when they stop collecting reader data they never use

How much of your reader data do you actually use?

If you ask a society or publisher about its reader data, you will usually hear about volume first: decades of membership records, registration forms that ask for job title, department, institution type, career stage and a long list of subject interests, alert lists in the hundreds of thousands, and web analytics that log every page view. The harder question, and one I rarely hear asked, is how much of that information has ever been used to decide who receives what. Our last post made the case that connected reader data is the real foundation of personalization in scholarly publishing, and this one picks up where that left off, because connecting systems tends to reveal how much of what sits inside them nobody is using.

Publishing is far from alone here. When Veritas surveyed more than 2,500 IT decision makers across 22 countries for its Global Databerg Report, respondents estimated that 52% of the data their organizations stored was "dark," with no known value, and that another 33% was redundant, obsolete or trivial, which left roughly 15% that anyone would call business critical. A few years later a Splunk-commissioned survey of more than 1,300 business and IT leaders landed in nearly the same place, with dark data averaging about 55%. If you have ever scrolled across the columns of a membership export, you have probably seen your own version of this, perhaps a field left over from an old conference campaign or interest checkboxes that no email has ever been segmented on.

What is data minimization? The law is catching up with what librarians already believed

Data minimization usually gets filed under compliance, which undersells it, because at heart it is a simple question about purpose: why are we keeping this? Article 5 of the GDPR answers that question by requiring personal data to be adequate, relevant and limited to what is necessary for the purpose it was collected for. In the US, Maryland's Online Data Privacy Act, in force since October 1, 2025, ties collection to what is reasonably necessary and proportionate to deliver a product or service the consumer actually asked for, and it bars collecting sensitive data beyond what is strictly necessary even when the person consents, which is why some privacy lawyers describe it as going further than the GDPR.

None of this would surprise a librarian. In 2015, librarians, publishers and systems providers agreed on the NISO Consensus Principles on Users' Digital Privacy, which say that the benefit of collecting someone's personal data has to be weighed against its impact on that person, and that data should be gathered only for purposes the user has been told about. The American Library Association's privacy guidelines for library systems go a step further and tell libraries to collect the minimum personal information needed to provide a service. Libraries negotiate and renew publisher licenses, so these principles describe how the people across the table already think.

Why reading data deserves extra care

What a researcher reads can say a great deal about what they are working on. A few months of article views might point to a new line of inquiry, an upcoming grant application or a difficult clinical case well before any of it shows up in print, and the research community has long treated that information as sensitive for exactly this reason. In 2021 the German Research Foundation (DFG) published a briefing paper warning that when publishers and platforms aggregate usage data, they can build detailed profiles of individual researchers and entire institutions, and the DFG has since said directly that tracking and sharing such data threatens researchers' anonymity and conflicts with academic freedom. You don't have to agree with every point in that paper to see what it means for email, since a reader who suspects they are being watched indiscriminately has good reason to pull back.

Research on consumer trust suggests much the same thing. In Cisco's 2024 Consumer Privacy Survey, which covered more than 2,600 people in 12 countries, over three quarters said they would not buy from an organization they did not trust with their data, and 49% of respondents aged 25 to 34, an age group full of postdocs and early-career faculty, had already switched providers over data policies or data-sharing practices. Researchers are hardly typical shoppers, yet I would be surprised if those same instincts played no part when they decide whether to renew a membership or stay on an alert list.

Every unused field still carries risk

The financial side of the argument is easy to follow. IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record $4.99 million, up 12% on the year before, and the 2025 edition found that customer personally identifiable information was exposed in 53% of breaches, at an average of $160 per record. A record containing only a name and email address doesn't expose much, but once you add a mailing address, phone number, date of birth and several years of detailed reading history, the damage that one record could do in the wrong hands grows considerably, and if most of those extra fields never shape a single email, you are carrying that risk without getting anything back for it.

Data also goes stale, which is the cost people tend to overlook. Over a career, researchers move between institutions, drift into neighboring fields and sometimes leave the bench for administration, so a specialty captured at registration gets a little less accurate every year nobody updates it. I would argue that outdated data can do more harm than no data at all, because a rule built on a specialty that changed five years ago will keep sending the wrong articles with complete confidence, whereas a rule with nothing to go on simply falls back on what the editors chose to feature.

What working with less looks like: behavioral signals, progressive profiling and retention windows

Collecting less does not have to mean knowing less about your readers, provided you lean on signals that stay current. Behavioral data, such as which articles someone clicks from an email and whether they go on to read the full text, comes from a service the reader signed up for, updates itself every time they engage and, as we argued in our post on meaningful personalization, often reveals interests a registration form would never capture. If you pair that with a handful of preferences the reader chooses and can change whenever they like, you end up with a profile that is smaller than the one most organizations hold today and considerably more accurate.

A few habits make this manageable. Begin by asking the same three questions of every field you collect: what decision does it drive, who keeps it accurate, and when should it expire? If nobody can answer all three, that field is probably ready to retire. It also helps to move toward progressive profiling, where in place of a long registration form you ask one question at the point the answer becomes useful, so a reader tells you their subfield when they sign up for a topic alert rather than on the day they create an account. And it is worth setting a retention window for detailed behavioral data, somewhere in the range of 18 to 24 months, after which it gets aggregated or deleted, so that recommendations reflect what a reader is working on now and not the dissertation they defended a decade ago.

Picture a medical society whose membership application asks for twenty-two pieces of information. If someone audited those fields, they might find that only six, such as primary specialty, practice setting and career stage, have ever been used to segment an email, while the other sixteen have sat untouched since the day they were collected, going slowly out of date. Dropping those sixteen would give applicants a shorter form, give the society less to lose in a breach, and give staff time to keep the six fields that matter accurate.

Start with a data minimization audit

The most useful first step is an inventory of every field you collect across registration, membership, alerts and events (the same inventory that starts any customer data integration project), with one extra column noting whether that field has driven a communications decision in the past twelve months. In most organizations that column settles a lot of debates quickly. From there you can retire what nobody uses, set expiry rules for what is left, and publish a plain-language explanation of what you collect and why, which is the kind of transparency both the NISO principles and the DFG have asked for. Some fields will need to stay for legal or financial reasons, which is fine, as long as each one is there because somebody decided it should be.

Publishers and societies are trusted with a remarkable amount of information about how research gets done, and readers hand it over on the assumption that it will be handled with care. Holding less of it, being open about what you keep, and making good use of that smaller set is, in my view, the most dependable way to personalize over the long run. If you would like to see how an email platform built for STM and scholarly publishers supports behavior-based segmentation and reader-controlled preferences, talk to us.

Continue the conversation

This article grew out of an episode of From Content to Community, our short video series with Samast AI, where people working in scholarly publishing, data and responsible AI talk through how publishers and societies can build stronger relationships with their readers. In this episode Chhavi of Samast AI argues that responsible personalization starts with knowing where your reader data lives and whether you are allowed to use it, and this post follows that thought one step further by asking whether you should be holding the data in the first place.

Watch the full series on YouTube: From Content to Community, STM Publishing playlist.

FAQ: Data Minimization for Publishers

What is data minimization?

It is the principle that an organization should collect and keep only the personal data it actually needs for a stated purpose. The GDPR requires it, and a growing number of US state privacy laws, including Maryland's, now do as well.

Won't collecting less data weaken our personalization?

In most cases it does the opposite, because behavioral signals like clicks through to full-text articles are fresher and more reliable than profile fields a reader filled in years ago, so a short list of chosen preferences combined with engagement data usually beats a long registration profile that nobody maintains.

What is progressive profiling?

It means asking readers for one piece of information at the moment it becomes useful, such as their subfield when they sign up for a topic alert, instead of asking for everything up front on a long form.

Where should a publisher or society start?

Start by listing every field you collect across registration, membership, alert and event systems and marking which ones have actually driven a communications decision in the past year. That list will show you what to retire and where you need retention rules.

Sources

• American Library Association. Library Privacy Guidelines for Library Websites, OPACs, and Discovery Services.

• Cisco (2024). Cisco 2024 Consumer Privacy Survey and accompanying press release.

• Deutsche Forschungsgemeinschaft (2021). Data tracking in research: aggregation and use or sale of usage data by academic publishers.

• European Union. General Data Protection Regulation, Article 5.

• IBM (2026). Cost of a Data Breach Report 2026.

• IBM (2025). What data leaders need to know from the Cost of a Data Breach Report 2025.

• Moore & Van Allen (2025). Getting Ready for Maryland's Online Data Privacy Act: A New Trendsetter?

• NISO (2015). NISO Consensus Principles on Users' Digital Privacy in Library, Publisher, and Software-Provider Systems.

• open-access.network. DFG Perspectives on the Role of Artificial Intelligence in Research Practice, Part III.

• Splunk. The State of Dark Data.

• Veritas Technologies (2016). Global Databerg Report.