Digital marketing · GDPR

Digital marketing — GDPR: trackers, profiling and prospecting

GDPR is at the heart of digital marketing: consent for trackers, governance of profiling, the legal basis for prospecting and verification of third-party data. These are the most closely supervised areas. This guide details these obligations and an operational roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Advertisers, agencies, publishers and adtech companies handling tracking and prospecting data are concerned, often under joint controllership.
  • Bringing trackers into compliance.
  • Govern profiling.
  • Framing prospecting.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

Non-essential trackers (advertising, non-exempt measurement) require compliant consent. Profiling must be fair and transparent. Prospecting is governed by specific rules depending on the channel and context (B2C/B2B), with an opt-out right always applicable.

Data enrichment and file purchasing require verifying the origin and consent of the data.

Is the 'Digital marketing' sector concerned?

Advertisers, agencies, publishers and adtech companies handling tracking and prospecting data are concerned, often under joint controllership.

Partners (DSPs, SSPs, data brokers) are controllers or processors depending on the circumstances.

Detailed obligations

Bringing trackers into compliance

Compliant cookie banner, no deposit before consent, revocability.

Govern profiling

Ensure fairness, transparency, and the right to object.

Frame prospecting

Determine the legal basis and offer a simple opt-out.

Verifying third-party data

Control the origin, legal basis and information notice of enriched files.

Limit retention periods

Define retention periods by purpose (trackers, prospects, profiles).

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Non-consented trackers and non-compliant prospecting are frequent grounds for sanctions.

Common mistakes in the sector

  • 1Trackers before consent. Dropping trackers upon arrival.
  • 2Opaque profiling. Profile without information or right to object.
  • 3Suspicious files. Using data of unverified origin.
  • 4Prospecting without a legal basis. Prospecting without a legal basis.

Practical case

An agency was using enriched files without verifying their origin and placing trackers without consent. Compliance requires a conformant consent banner, verification of data origin and a framework governing prospecting activities.

Compliance roadmap

  1. 1

    Audit trackers. Check banners and cookie deposits.

  2. 2

    Govern profiling. Fairness and objection.

  3. 3

    Frame prospecting. Legal bases and unsubscription.

  4. 4

    Verify the files. Origin and consent.

  5. 5

    Durations. Define by purpose.

Frequently asked questions

No: strictly necessary trackers are exempt; advertising trackers require consent.

Back to the Digital marketing guideDigital marketing & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to digital marketing.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital marketing sector secured their compliance with DCO.

See testimonials