Lesson 4 of 4 · 9 min read · advanced
The global regulation map for ad tech
GDPR, the DMA and DSA, US state laws, COPPA, India’s DPDP Act, Brazil, China, Japan and Australia: how privacy and platform laws shape ads worldwide.
An ad shown to a reader in Mumbai, Munich and Miami may be governed by three completely different sets of rules. Ad tech relies on personal data such as device IDs, IP addresses and browsing behaviour, so privacy law is the single biggest legal force on the industry. Alongside privacy, newer platform laws target the power of the biggest companies. This lesson gives you a map, not legal advice.
Think of driving across borders. The car is the same, but one country drives on the left, another requires headlights in daytime, and a third bans certain number plates. Ad tech companies run one global system that must switch rules at every border, often in the milliseconds before an ad loads.
Three families of law
- Consent-first privacy lawsYou generally need a valid legal basis, often consent, before processing personal data for ads. Europe’s GDPR is the model, followed by laws such as India’s DPDP Act.
- Opt-out privacy lawsProcessing is allowed by default, but people must be able to say no to the sale or sharing of their data. Most US state laws, led by California’s CCPA / CPRA, work this way.
- Platform and competition lawsRules aimed at the largest gatekeepers, such as the EU’s Digital Markets Act and Digital Services Act, plus antitrust cases.
The map
| Jurisdiction | Main law(s) | What it means for ads |
|---|---|---|
| European Union | GDPR (applies since May 2018) | Needs a legal basis such as consent or legitimate interest for personal data; fines up to 4% of global turnover. The IAB Europe IAB TCF passes consent signals. |
| European Union | ePrivacy Directive (cookie rules) | Consent needed to store or read information on a device, such as cookies, except where strictly necessary. A replacement ePrivacy Regulation was withdrawn by the Commission in 2025. |
| European Union | Digital Markets Act (DMA) | Designated gatekeepers need consent to combine personal data across their services for ads, and must give advertisers and publishers more data on ad performance and pricing. |
| European Union | Digital Services Act (DSA, fully applicable Feb 2024) | Online platforms may not show ads based on profiling using sensitive data, or profiling-based ads to users they know are minors; ad transparency and, for very large platforms, public ad repositories. |
| United Kingdom | UK GDPR, Data Protection Act 2018, PECR; Data (Use and Access) Act 2025 | Similar to the EU model, with cookie rules under PECR; the 2025 Act adjusts some consent requirements for low-risk cookies and raises PECR fines. |
| United States (federal) | COPPA; FTC Act | Verifiable parental consent before collecting data from children under 13; the FTC’s updated COPPA Rule took effect in 2025. The FTC also acts against unfair or deceptive data practices. |
| United States (states) | California CCPA as amended by CPRA, plus a growing list of state laws such as Virginia, Colorado, Connecticut and Texas | Rights to opt out of the sale or sharing of data and of targeted advertising; some states require honouring Global Privacy Control signals. The IAB IAB Global Privacy Platform carries these choices. |
| India | Digital Personal Data Protection Act 2023; DPDP Rules notified November 2025 | Consent-based model with notice requirements; bans tracking, behavioural monitoring and targeted ads directed at children; most obligations phase in over 18 months, to May 2027. |
| Brazil | LGPD (in force since 2020) | GDPR-style law with legal bases including consent and legitimate interest, enforced by the ANPD. |
| China | Personal Information Protection Law (PIPL, 2021) | Consent and strict rules on cross-border data transfers; people can refuse personalised recommendations and marketing. |
| Japan | Act on the Protection of Personal Information (APPI; amendments in force since April 2022) | Rules on sharing personal and pseudonymised data, including when cookie data becomes personal in a partner’s hands. |
| Australia | Privacy Act 1988, amended by the Privacy and Other Legislation Amendment Act 2024 | First tranche of reforms added transparency and a statutory privacy tort; a children’s online privacy code is being developed and further reforms are expected. |
Opt-in versus opt-out
Opt-in (EU, UK, India, others)
- Ask first, then use data
- Consent banners and CMPs are everywhere
- Lower match rates for targeting
- Heavier penalties for getting consent wrong
Opt-out (most US states)
- Use data unless the person objects
- “Do not sell or share” links and GPC signals
- Stricter rules for sensitive data and children
- Patchwork of state laws with different details
How ad tech adapts
- Signals travel with the ad request: consent strings and GPP strings tell every partner what the user agreed to.
- Data minimization: collecting less data reduces risk under nearly every law.
- Contextual and first-party approaches: Contextual targeting and first-party data reduce reliance on cross-site tracking.
- Children get special treatment everywhere: from COPPA to the DSA to India’s DPDP Act, targeted ads to children are restricted or banned.
The direction of travel is clear across continents: more consent, more transparency, special protection for children and sensitive data, and closer scrutiny of the largest platforms. The details, deadlines and enforcement styles differ, which is why global ad tech companies increasingly build systems that can apply the strictest rule where required and pass the right signal to every partner in the chain.
Key takeaways
- Privacy laws fall into consent-first models (GDPR, India’s DPDP Act) and opt-out models (most US state laws).
- Platform laws such as the EU’s DMA and DSA add rules for gatekeepers and ban some profiling-based ads to minors or using sensitive data.
- India’s DPDP Rules, notified in November 2025, phase in most obligations over 18 months.
- Consent and privacy signals such as TCF and GPP strings travel with ad requests so every partner can respect them.
Questions people ask
How does GDPR affect programmatic advertising?
GDPR requires a legal basis, usually consent, to process personal data such as cookie IDs, device IDs or IP addresses for ad targeting and measurement in the EU. Publishers use consent management platforms to ask users, and pass the result along the chain through the IAB Europe TCF consent string. Without valid consent, many partners cannot use the data, and regulators can impose large fines.
What does India’s DPDP Act mean for advertisers?
The Digital Personal Data Protection Act 2023 requires clear notice and consent for processing personal data, gives people rights to access, correct and erase data, and bans tracking, behavioural monitoring and targeted advertising directed at children. The DPDP Rules, notified in November 2025, phase in most obligations over 18 months, so advertisers and ad tech firms operating in India must prepare consent flows and data controls.
Is there a federal privacy law for advertising in the US?
Not a comprehensive one. At federal level, COPPA protects children under 13 and the FTC acts against unfair or deceptive data practices. Most consumer privacy rules come from states: California’s CCPA, amended by the CPRA, and a growing list of other state laws that give people rights to opt out of the sale or sharing of data and of targeted advertising.