In-session vs. profile-based
Profile-based personalization asks "what do we know about this person from the past?" and needs identity infrastructure to answer it: a CDP, an identity graph, stitched devices. It has nothing to say to the visitor it can't recognize — which is most visitors. In-session personalization asks "what is this person showing us right now?" The current visit's behavior is scored as it happens, and the decision about what to show follows from that score, with no profile required.
The two aren't substitutes. Cross-session, known-customer problems — lifecycle email, loyalty — genuinely need the profile. Converting the anonymous visitor currently on the page does not, and buying identity infrastructure to solve it is buying the wrong tool.
What it takes to do well
Three properties separate real in-session personalization from a delayed batch job. Speed: the decision has to land before the page finishes painting, or the visitor sees the default content flash into the personalized version — the flicker problem. Determinism: the same behavior should produce the same decision every time, with no model call in the live path. Measurement: an always-on holdout, so the lift the personalization produces is proven against a control group rather than asserted.