What is GDPR?

GDPR (General Data Protection Regulation) is the EU data-protection law effective from 25 May 2018. It applies to processing data of EU residents regardless of where the company is registered. In performance marketing, GDPR affects pixels, retargeting, email lists, lead gen forms, and any EU traffic in traffic arbitrage.

Core principles

  • Lawful basis — legal grounds and explicit consent for marketing cookies and mailings.
  • Data minimization — collect only necessary fields in lead gen.
  • Data subject rights — access, correction, erasure ("right to be forgotten").
  • DPA — agreements with processors (tracker, ESP, ad platform).

Practice for media buyers

Opt-in cookie banners (not pre-ticked) on EU landings; Google Consent Mode v2 for Ads/Analytics; limited retargeting without consent. Passing email/phone in postbacks is personal data—privacy policy and legal basis are required. Fines up to 4% of global turnover or €20M.

Related laws

The ePrivacy Directive governs cookies; the UK runs UK GDPR post-Brexit. US state laws include CCPA/CPRA in California. Global campaigns use GEO splits: compliant EU flows, separate landings when needed.

See also

Pixel tracking, Lead generation, Geo targeting, Landing page.