Personalisation rules built behind a permanent holdout

Reverse-IP company resolution on Dutch mid-market traffic identifies the visitor's organisation for roughly a third of sessions. A rule keyed on industry therefore reaches a third of your traffic, and can move site-wide conversion by at most a third of whatever it does to the people who see it. That arithmetic is the first slide of every engagement, because it is the number that decides whether a rule is worth its maintenance cost. Every rule we build ships behind a permanent 10 per cent holdout that never sees personalisation at all. What we build: Segment definitions with an eligibility count attached before a line of code exists. A segment with 200 sessions a month does not get a rule; it gets written down and revisited when the traffic arrives. Rules live in the stack you already run: GrowthBook or Statsig flags with targeting attributes, Ninetailed on Contentful, Optimizely Web, Dynamic Yield, or middleware at the edge when the front end is yours and the logic belongs in code. Decisioning is server-side or at the edge by default, because a client-side rule paints the default content first and the flicker costs more than most rules earn. We measure that, on the paint of the personalised region and on INP for the template carrying the rule. Consent, and what it forbids: Behavioural and profiling-based segments run only for sessions with a lawful basis under the AVG, wired to Consent Mode v2 so a withdrawn consent removes the visitor from targeting rather than leaving a stale assignment in place. The rule set has a defined behaviour for non-consented traffic instead of failing open into the default experience by accident. Geography and referrer are treated differently from inferred firmographics, and we write down which is which so your privacy officer reviews a document rather than a codebase. Measurement, and the expiry date: One global holdout across all rules, not one per rule; per-rule effects are read against it. Every rule ships with a 90-day review date. Rules that cannot show an effect at review are removed, because forty stale rules is a debt paid by whoever maintains the site after us, and personalisation programmes usually die of that rather than of any single bad rule. What we refuse: No personalisation of the price shown. No rules keyed on inferred health, financial position or anything else that a visitor would be alarmed to learn was inferred. No black-box engine that cannot tell you which rule fired for a given session, which rules out most tools sold as AI personalisation. No behavioural rule on first-time anonymous traffic beyond geography, language and referrer, because there is nothing there to personalise on and pretending otherwise produces the effects our holdouts catch. This is not for you if: Your site takes fewer than about 50,000 sessions a month; the holdout will not resolve anything and the maintenance outlives the benefit. You do not control your own CMS or front end. You want one-to-one personalisation; what exists in practice is a small number of well-chosen segments, and a shop that promises the former is selling a roadmap rather than a build. Where this pays, in our experience: For a property portal, recency of saved searches beats every firmographic signal available. For B2B SaaS, the rule that repays its cost is usually account stage rather than industry. For pet retail, replenishment timing. We arrive with those priors and we test them rather than assert them.