The General Data Protection Regulation — Regulation (EU) 2016/679, in force since May 2018 — remains the most consequential piece of legislation affecting marketing programs in Europe. Yet many marketing teams still treat GDPR as a legal department problem rather than a marketing operations problem. That division creates risk and leaves performance on the table. Understanding the regulation's core principles allows you to build programs that are both compliant and effective — and increasingly, in a cookieless measurement environment, the two goals are more aligned than they appear.
Legal bases: the foundation of everything
Every piece of personal data processing in your marketing stack needs a legal basis under Article 6 of the GDPR. There are six, but for most marketing activities, three are relevant:
| Legal basis | When it applies in marketing | Key constraint |
|---|---|---|
| Consent (Art. 6(1)(a)) | Email marketing, tracking cookies, behavioral advertising, profiling | Must be freely given, specific, informed, and unambiguous. Withdrawable at any time. |
| Legitimate interests (Art. 6(1)(f)) | B2B prospecting (with caveats), analytics, fraud prevention, some direct mail | Requires a Legitimate Interests Assessment (LIA). Individual's rights can override. |
| Contract (Art. 6(1)(b)) | Processing data to fulfill a purchase, send a receipt, manage a subscription | Only covers processing strictly necessary for the contract. Cannot stretch to marketing. |
A common mistake is using legitimate interests as a catch-all to avoid the friction of obtaining consent. Supervisory authorities across Europe — including the UK ICO, France's CNIL, and Germany's DPAs — have been clear that legitimate interests cannot substitute for consent where consent is the appropriate basis, particularly for direct marketing to consumers.
Choosing the right legal basis at the outset matters because it determines your obligations downstream: what you tell people, how long you keep data, what rights they have, and how you respond when they exercise those rights. It also affects how you structure your marketing technology stack.
Consent mechanics: opt-in, double opt-in, and what counts
Under GDPR, consent for marketing must meet a high standard. The key elements set out in Article 7 and Recital 32 are:
- Freely given: No bundling consent with terms of service. No detriment for refusing. No pre-ticked boxes.
- Specific: Separate consent for each distinct purpose (email newsletter vs behavioral advertising vs third-party data sharing). One blanket consent checkbox does not cover multiple purposes.
- Informed: The individual must know who is collecting the data, for what purpose, and for how long — before they consent.
- Unambiguous: Active affirmative action required — a tick, a click, a button press. Silence or inaction does not constitute consent.
Double opt-in (a confirmation email that requires a second click to activate a subscription) is not legally mandated by GDPR but is considered best practice by the European Data Protection Board (EDPB) and many national authorities. It strengthens your evidence of consent and improves list quality — both compliance and deliverability arguments point the same direction.
Consent records must be kept: who consented, when, to what, via which mechanism, and using which version of the notice. This is an operational requirement your CRM or consent management platform (CMP) must handle.
Cookies, ePrivacy, and the consent banner
Cookies and similar tracking technologies are governed by the ePrivacy Directive (2002/58/EC, amended 2009) alongside GDPR. Under the ePrivacy rules, non-essential cookies require prior consent — meaning the cookie cannot be set before the user accepts. Strictly necessary cookies (session cookies, shopping cart cookies, security cookies) are exempt.
In practice, this means:
- Analytics cookies (Google Analytics, Matomo) require consent unless configured in a privacy-preserving mode
- Advertising and retargeting cookies (Meta Pixel, Google Ads, LinkedIn Insight Tag) always require consent
- A/B testing tools that use cookies require consent
- Heatmap and session recording tools (Hotjar, Microsoft Clarity) require consent
Consent Management Platforms (CMPs) such as Didomi, OneTrust, and Axeptio implement the IAB Europe Transparency and Consent Framework (TCF) to standardize how consent signals are collected and passed to downstream ad tech vendors. If you run programmatic advertising, your CMP must be TCF-certified for your consent signals to be recognized by DSPs and SSPs.
Dark patterns in consent UIs — making the "Accept all" button large and colorful while hiding "Reject all" behind multiple clicks — have been the subject of enforcement action by the CNIL and other DPAs. The EDPB guidelines on dark patterns (published 2022) make clear that consent obtained through manipulative design is not valid consent.
Google Consent Mode v2
Google Consent Mode v2, which became required for all advertisers using Google Ads and Google Analytics 4 in the European Economic Area from March 2024, changes how measurement works when users do not consent to tracking.
When a user declines consent, Consent Mode v2 does not fire the standard measurement tags. Instead, it sends cookieless pings to Google that carry no personal identifiers. Google then uses modeled conversions — statistical inference based on aggregated, consented data from similar traffic — to estimate the conversions that occurred in the non-consented population.
The practical implication for marketers: your reported conversion numbers in Google Ads will include both observed conversions (from consented users) and modeled conversions (from non-consented users). Reported totals will be higher than what you would see from consented users alone, but the methodology is disclosed and the modeling is applied consistently. Advertisers who implement Consent Mode v2 correctly typically see better campaign optimization than those who pass no signal at all for non-consenting users.
Consent Mode v2 requires a CMP that supports the Google Consent Mode API and passes the correct consent signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) to your Google tags via the data layer or a tag manager integration.
Data minimization and retention
Article 5(1)(c) of the GDPR establishes the data minimization principle: collect only what is adequate, relevant, and limited to what is necessary for the purpose. For marketers, this has direct implications for form design, CRM hygiene, and analytics configuration.
In practice: a newsletter signup form that asks for job title, company size, industry, phone number, and date of birth when you only need an email address to send a newsletter fails the minimization test. Every field you collect should have a documented purpose.
Article 5(1)(e) adds the storage limitation principle: data should not be kept longer than necessary. This means your CRM needs defined retention periods — and a process to enforce them. Common approaches include suppression lists for unsubscribed contacts (retained to avoid re-contacting them), automated deletion schedules for inactive contacts after a defined period, and annual data audits.
Data minimization also applies to your analytics configuration. GA4 offers data retention settings; setting retention to the minimum period consistent with your reporting needs reduces your compliance exposure. IP anonymization should be active by default.
Cookieless marketing and first-party data
The long-term trajectory of digital marketing is toward cookieless measurement and first-party data primacy. Third-party cookies — already blocked by Safari and Firefox — are being phased out across the browser ecosystem. Regulatory pressure and technical change are pointing in the same direction.
GDPR compliance and cookieless strategy reinforce each other. Building a first-party data asset — consented email lists, CRM data, logged-in user behavior — is both the compliant approach and the strategically durable one. Tactics that work in a cookieless, consent-forward environment include:
- Server-side tagging, which moves data processing server-side and reduces browser-level cookie dependency
- Conversion API integrations (Meta CAPI, Google Enhanced Conversions) that send hashed first-party signals directly to ad platforms, improving signal quality without additional user-level tracking
- Clean rooms (Google Ads Data Hub, Amazon Marketing Cloud) for privacy-safe measurement across consented datasets
- Marketing mix modeling (MMM) for privacy-safe, aggregate-level attribution that does not rely on individual-level tracking — see our MMM guide for a full explanation
A well-structured marketing plan includes data governance, consent strategy, and measurement architecture from the start. Use Hatch's free planning tool to build programs that work within your compliance constraints.
Free Plan ToolNEWP works with B2B marketing teams on CMP implementation, Consent Mode v2 setup, and compliant measurement architecture. Talk to an expert agency before your next campaign launch.
Talk to an expert at NEWPFrequently asked questions
Can I use legitimate interests for email marketing to consumers?
Generally no. For direct marketing to consumers via email, consent is the required legal basis under the ePrivacy Directive and the guidance of most EU supervisory authorities. Legitimate interests may apply in limited B2B scenarios — for example, emailing a named business contact about a directly relevant product — but this requires a documented Legitimate Interests Assessment and must not override the individual's interests or rights.
Does GDPR apply to my marketing if I am not based in the EU?
GDPR applies if you target or monitor individuals in the EU, regardless of where your company is based. Article 3 establishes this extra-territorial scope explicitly. If you run campaigns targeting EU audiences, GDPR applies to your data processing for those campaigns.
What is the difference between a CMP and a cookie banner?
A cookie banner is the visible UI element. A Consent Management Platform (CMP) is the underlying system that collects, stores, and transmits consent signals to your marketing tools. A cookie banner without a proper CMP behind it may look compliant but will fail to pass consent signals correctly to ad platforms and analytics tools — which is where enforcement risk actually sits.
Do I need to implement Google Consent Mode v2?
If you use Google Ads or Google Analytics 4 and target users in the European Economic Area, yes. Without Consent Mode v2, Google's systems cannot model conversions for non-consenting users, which degrades campaign optimization. Google has made this a requirement for EEA traffic, and non-compliance affects your ability to use audience features and conversion tracking effectively.