Abstract:

This month will see the enforcement of a sweeping new set of regulations that could change the face of digital marketing: the European Union’s General Data Protection Regulation, or GDPR. To protect consumers’ privacy and give them greater control over how their data is collected and used, GDPR requires marketers to secure explicit permission for data-use activities within the EU. With new and substantial constraints on what had been largely unregulated data-collection practices, marketers will have to find ways to target digital ads, depending less (or not at all) on hoovering up quantities of behavioral data.

Consumers have already seen a range of developments resulting from the forthcoming enforcement of GDPR. Among these are the dozens of messages from web-based companies from TaskRabbit to Twitter about privacy policy updates, as well as the recent reports about how major internet companies like Facebook and LinkedIn are moving the personal data associated with non-Europeans out of Europe and into other jurisdictions – the latter of which are largely moves designed to minimize legal liability. But while digital marketers are aware of the strict new regulatory regime, seemingly few have taken active steps to address how it will impact their day-to-day operations.

GDPR will force marketers to relinquish much of their dependence on behavioral data collection. Most critically, it will directly implicate several business practices that are core to current digital ad targeting. The stipulation that will perhaps cause most angst is the new formulation for collecting an individual’s consent to data gathering and processing; GDPR requires that consent be active (as opposed to passive) and represent a genuine and meaningful choice. Digital marketers know that users of internet-based services like Snapchat, Facebook, and Google technically provide consent by agreeing to these companies’ terms of service when they sign up. But does this constitute an active and genuine choice? Does it indicate that the user is willing to have her personal data harvested across the digital and physical worlds, on- and off-platform, and have that data used to create a behavioral profile for digital marketing purposes? Almost certifiably not.