How does GDPR affect advertising?
GDPR requires advertisers, publishers and ad tech firms to have a lawful basis, usually consent, before processing personal data such as cookies, device IDs and IP addresses for targeted ads in the EU and UK. Companies must explain what they collect, let people refuse or withdraw consent, minimize data and face fines of up to 4% of global annual turnover.
Under GDPR and the ePrivacy rules, most tracking for behavioral targeting needs opt-in consent, collected by a CMP and passed through the ad chain as a consent string, typically using the IAB's IAB TCF. Some processing may rely on legitimate interest, though regulators have narrowed that for ad targeting.
Enforcement has shaped the industry: regulators have fined Meta and Google, and Europe's top court ruled in 2024 that TCF consent strings can be personal data. The practical effects are lower match rates, more contextual targeting and first-party data strategies, and growth in data clean rooms.