Marketing & advertising compliance: GDPR & AI Act

Why the 'Marketing & advertising' sector is concerned

Advertising involves data: prospect files, audience data, and information about creators and their communities in influencer marketing. GDPR governs these processing activities (legal basis, information obligations, data partnerships between advertisers, ad networks, and platforms).

Generative AI is transforming creative production: visuals, voices, videos. The AI Act requires transparency — labelling of generated content, flagging of deepfakes — and prohibits manipulative techniques. Creatives depicting individuals also raise portrait rights issues.

Influencer marketing adds specific requirements: transparency regarding the commercial nature of content and governance of audience and creator data.

GDPR — prospects, audiences, influence

Advertisers, agencies, and ad networks are controllers (or joint controllers) of prospect files, audience data, and influencer-related data. They must define legal bases, provide information, govern data partnerships, and verify the origin of data files.

Key obligations

• Legal bases and information notices (prospects, audiences).
• Governing data partnerships (roles, DPA).
• Verifying the origin of files.
• Security and retention periods.

AI Act — generative AI and transparency

AI-generated advertising creative calls for transparency: labelling of generated content and flagging of deepfakes (except where exemptions apply). Manipulative techniques are prohibited. Creatives depicting individuals must comply with portrait rights and GDPR.

Key obligations

• Labelling AI-generated advertising content.
• Reporting deepfakes (outside exceptions).
• Prohibiting manipulative practices.
• Respecting image rights and GDPR.

Comparative overview of regulations

How these regulations interact

AI-generated advertising content combines AI Act transparency obligations (disclosing what has been generated) and GDPR requirements when individuals are depicted (image, voice). An advertising deepfake of a real person triggers AI Act labelling, GDPR, and image rights obligations simultaneously.

On the data side, partnerships between advertisers, ad networks, and platforms raise questions of roles (joint controllership) and data origin, which must be governed under GDPR.

Application timeline

• 1GDPR. In force.
• 2AI Act. prohibitions: Manipulative practices prohibited since February 2025.
• 3AI Act. Transparency: progressively applicable.

Applicable penalties

GDPR up to €20M or 4%, AI Act up to €35M or 7% (prohibited practices). An unlabelled advertising deepfake combines AI Act, GDPR, and image rights risks.

Compliance roadmap

• 1Govern data files. Legal bases, origin, and information provided to prospects.
• 2Framing data partnerships. Clarify roles and sign DPAs.
• 3Watermark AI-generated content. Label AI-generated content and deepfakes.
• 4Respecting the right to one's image. Governing creations depicting individuals.
• 5Govern influencer activity. Ensuring commercial transparency and protecting data.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with outsourced DPO services, and supports agencies, ad networks, and advertisers on data files, data partnerships, and AI-generated content transparency.

DCO offers tailored templates (data partnership frameworks, AI transparency policy, image rights authorisations).

Frequently asked questions