Communication & media — GDPR: audiences, subscribers and sources

What does GDPR cover?

GDPR governs trackers (consent), advertising profiling and prospecting. For media organisations, a journalistic exemption allows, under certain conditions, the processing of data for journalistic purposes, balanced against freedom of expression and information.

The protection of journalistic sources is governed by these rules.

Is the 'Communication & media' sector affected?

Agencies, ad networks, media companies, and creators processing audience and subscriber data are data controllers. Media organisations benefit from specific exemptions for their journalistic processing activities.

Service providers (audience measurement, adtech) are processors or joint controllers depending on the case.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Trackers and direct marketing attract the most scrutiny; the journalistic exemption does not waive fundamental principles.

Common mistakes in the sector

• 1Non-compliant trackers. Drop trackers without consent.
• 2Prospecting without a legal basis. Sending communications without a legal basis.
• 3Poorly framed exception. Invoking journalism outside its proper scope.
• 4Exposed sources. Neglecting source protection.

Practical case

A media company was deploying advertising audience measurement without valid consent. Following remediation, it now activates non-essential trackers only after consent is obtained, documents the journalistic exemption for its editorial processing activities, and secures the protection of its sources.

Compliance roadmap

1. 1

   Audit trackers. Check cookie banner and audience measurement.

2. 2

   Framing subscribers and prospecting. Legal bases and information.

3. 3

   Securing journalism. Document the journalistic exemption.

4. 4

   Protecting sources. Articulate with GDPR.

5. 5

   Document. Maintain the register.

Frequently asked questions