GDPR for Marketers: What the Law Actually Requires

Most of what marketers believe about GDPR arrives secondhand, through cookie-banner folklore and vendor scare content, and a lot of it is wrong in both directions: teams over-comply where the law is permissive and sleepwalk where it bites. This guide is my plain reading of the parts that actually bind marketing work, each claim linked to the regulation’s text or the regulator’s own decision. It sits in my governance series next to the EU AI Act checklist, and the two divide cleanly: the AI Act regulates AI systems, GDPR regulates the personal data flowing through them, and a marketing team using AI answers to both. The usual disclaimer applies, and I mean it: I am a marketer reading law, not a lawyer, and anything consequential deserves counsel.

The stakes stopped being theoretical years ago. The GDPR Enforcement Tracker counts 3,270 enforcement actions totaling 7.15 billion euros in fines across 32 countries, and a striking share of the headline cases are about marketing data specifically.

The mental model: data, processing, basis

The whole regulation compresses to one sentence for our purposes: any use of personal data needs a lawful basis, named in advance. Personal data is anything relating to an identifiable person - an email address, a cookie ID, a CRM record. Processing is anything you do with it, including just holding it. Article 6 lists six lawful bases, and marketing work runs on two of them: consent (“the data subject has given consent to the processing of his or her personal data for one or more specific purposes”) and legitimate interests (processing “necessary for the purposes of the legitimate interests pursued by the controller,” except where the person’s rights override them).

My rule of thumb for which is which: consent is the basis for anything intrusive or unexpected (tracking cookies, adtech data sharing, buying lists - the last being a practice the enforcement record should talk you out of regardless), while legitimate interest can carry the marketing a reasonable customer would expect from a company they already deal with. That is not wishful reading: Recital 47 of the regulation itself says “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Legitimate interest is a balancing test you must be able to defend on paper, not a magic phrase, but marketers who believe GDPR made all marketing consent-only are over-complying against the text.

The absolute right that shapes every campaign

Whatever basis you choose, Article 21 gives every person an unconditional trump card: “the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.” And the consequence is immediate: “Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.” No balancing test, no exceptions, no “are you sure” flow.

In practice this is the unsubscribe rule generalized to everything. The objection covers email, retargeting audiences, direct mail and the profiling behind them, and it must actually propagate - a suppressed email address that still sits in a custom audience upload is an unhonored objection. When I audit a marketing stack against GDPR, this is the first thing I test, because it is the requirement most often broken by architecture rather than intent: five tools, one unsubscribe, four copies of the data that never heard about it.

The AI layer: profiling, automated decisions, and your vendors

Two GDPR provisions land directly on AI marketing. Article 22 gives people “the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” Ordinary ad targeting and email segmentation sit below that bar. Fully automated decisions with real consequences - credit-linked offers, pricing that materially differs by profile, eligibility screening - can cross it, and the practical fix is a human meaningfully in the loop plus a route for the person to contest the outcome. The delivery-skew mechanics I covered in the ad targeting bias post live one door down from this provision, and the two are converging in regulators’ attention.

The newer question is what feeding customer data to AI tools does, and the European Data Protection Board answered a chunk of it in Opinion 28/2024, its December 2024 guidance on AI models: when a model trained on personal data counts as anonymous, and when legitimate interest can carry AI development and deployment. The marketing-team translation I work from: an AI vendor processing your customer data is a processor needing a data processing agreement like any other vendor, “the model learned from it” does not automatically launder personal data into anonymous data, and pasting identifiable customer records into a consumer AI tool whose terms let it train on inputs is a data transfer your lawful basis almost certainly does not cover. Strip identifiers before the paste - the same hygiene rule my persona and case-study workflows already enforce for quality reasons.

What enforcement actually looks like

The fine ceiling in Article 83 is famous: up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher, for the serious tier, with a 10 million / 2% tier below it. The record shows regulators willing to use the room. The largest fine so far is Meta’s 1.2 billion euros, announced by Ireland’s Data Protection Commission in May 2023 over EU-to-US data transfers. Closer to the daily work of this audience: adtech firm Criteo, the engine behind behavioral retargeting for thousands of retailers, was fined 40 million euros in June 2023 after France’s CNIL found it could not prove valid consent for the data behind its retargeting, on top of transparency and rights failures - a case that started with complaints filed by privacy groups in 2018 and covered data on roughly 370 million Europeans.

The Criteo case is the one I would sit with, because the liability logic reaches you: the consent Criteo could not prove was collected on its clients’ websites. Using an adtech vendor does not outsource the compliance question, it multiplies the places your lawful basis has to hold.

The Tuesday-afternoon version

What I would actually do as a marketing team, in order. Map where personal data lives in the stack - every tool, every export, every audience upload - because nothing downstream works without the map. Name a lawful basis per activity, in writing, with the legitimate-interest balancing documented where that is the claim. Test the objection path end to end and fix the tools the suppression list does not reach. Put a data processing agreement in place with every vendor touching personal data, AI tools included, and set a team rule for what may enter which AI tool. And design consent honestly - a banner engineered so refusal takes four clicks is both a GDPR problem and a dark pattern, and regulators have fined exactly that design. None of this is a legal project first. It is an inventory project, and marketing owns most of the inventory.

FAQ

I market from the US. Does GDPR apply to me? If you target or track people in the EU, yes - the regulation follows the people, not your office address. A US SaaS running EU ad campaigns or holding EU emails in its CRM is in scope. For the US rules layered on your AI marketing specifically, the FTC’s position is the domestic counterpart, and the state privacy layer starts with California’s CCPA, which shares GDPR’s reach-follows-the-people logic on a different chassis.

Do I need consent to send email to existing customers? Under GDPR, legitimate interest can carry direct marketing to existing customers, per Recital 47 - but email marketing also runs under the separate ePrivacy rules, where most EU countries require consent or the “existing customer” exception with an opt-out at collection. The workable summary: your own customers, your own similar products, clear opt-out every time, and national rules checked where you sell.

Does GDPR ban AI-driven personalization? No. It requires a lawful basis for the data feeding it, honesty about the profiling in your privacy notice, an honored objection right, and human involvement where automated decisions have significant effects. Segment-level personalization on first-party data, done with those four in place, is comfortably legal - the constraint is on data you cannot account for, not on intelligence applied to data you can.

What is the realistic risk for a small company? Regulators prioritize scale and harm, and the headline fines land on platforms and adtech. But the enforcement tracker’s 3,270 cases include plenty of small-company fines for mundane failures - marketing to people who objected being a recurring one. The cheap insurance is exactly the unglamorous list above, and the expensive lesson is that “we’re too small to be noticed” is a bet, not a basis.

This guide is part of my ethics and governance series. The AI-systems half of the legal picture is the EU AI Act for marketers, the US enforcement layer is the FTC’s AI advertising rules, and the delivery-bias question next door is AI bias in ad targeting.