Digital marketing compliance: GDPR & AI Act

Why the 'Digital marketing' sector is concerned

Digital marketing relies on tracking and profiling: trackers, advertising identifiers, real-time programmatic advertising (RTB), and enrichment via third parties. GDPR imposes two closely scrutinised requirements in this area: consent to non-essential trackers and a framework governing profiling.

Prospecting (email, SMS, phone) is subject to precise rules regarding legal basis and opt-out, which differ between B2C and B2B. Purchasing or enriching contact lists from third parties requires verifying the origin and consent status of the data.

On the AI side, targeting and optimisation generally fall under limited risk, and AI-generated advertising content calls for transparency. The AI Act also prohibits manipulative techniques that exploit vulnerabilities.

GDPR — cookies, tracking, adtech

The advertiser and the agency are (jointly) responsible for tracking and profiling processing activities. Key checkpoints: consent for non-essential trackers, the fairness of profiling, the legal basis for prospecting, and verification of the origin of enriched or purchased data.

Key obligations

• Consent compliant with non-essential trackers.
• Framing advertising profiling.
• Legal basis for prospecting (B2C/B2B) and unsubscription.
• Verifying the origin of enriched data.

AI Act — targeting and generated content

AI-driven targeting and optimisation generally fall under limited risk. AI-generated advertising content calls for transparency (labelling of generated content). Manipulative techniques exploiting vulnerabilities are prohibited.

Key obligations

• Qualifying uses (targeting = limited risk).
• Labelling AI-generated advertising content.
• Prohibiting manipulative practices.
• Articulation with GDPR profiling.

Comparative overview of regulations

How these regulations interact

Digital marketing is primarily governed by GDPR: consent for trackers, profiling and prospecting account for the bulk of audits and sanctions. Targeting AI is layered on top via profiling (GDPR) and transparency (AI Act).

The emerging area of vigilance is content generation and influence practices: AI Act transparency requirements for generated content and the prohibition of manipulative techniques, in addition to GDPR.

Application timeline

• 1GDPR. In force; frequent controls on trackers.
• 2AI Act. prohibitions: Manipulative practices prohibited since February 2025.
• 3AI Act. Transparency: progressively applicable.

Applicable penalties

GDPR up to €20M or 4%, with recurring checks on cookies and prospecting. AI Act up to €35M or 7% for prohibited manipulative practices.

Non-consented tracking and non-compliant prospecting are among the most sanctioned breaches in the sector.

Compliance roadmap

• 1Bringing trackers into compliance. Compliant banner and consent, blocking prior to consent.
• 2Govern profiling. Fairness, information and right to object.
• 3Frame prospecting. Legal basis, opt-in/opt-out, unsubscribe.
• 4Verifying third-party data. Controlling the origin and consent of enriched files.
• 5Governing AI. Mark generated content, prohibit manipulation.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports advertisers and digital agencies on trackers, profiling, prospecting and content AI.

DCO offers tailored templates (cookie policy, profiling framework, prospecting charter).

Frequently asked questions