GDPR Retargeting: What EU Advertisers Need in Place

GDPR retargeting rests on one rule: a visitor may only enter a retargeting audience after they have actively agreed to advertising tracking on your site. Everything else follows from that. The pixel or tag that builds the audience waits for consent, you share responsibility for that data flow with the ad platform, every audience has a retention window you can explain, and customer lists you upload need their own legal basis. This guide covers what to set up in Google Ads and Meta, as of October 2026.

1. Why retargeting gets more scrutiny than other targeting

With keyword or interest targeting, the ad platform decides who sees your ad from data it already holds. Retargeting works the other way round: your website recognises a specific visitor and hands that signal to the platform, so the same person sees your ads again later. That puts two laws in play at once. The ePrivacy Directive covers anything stored on or read from the visitor's device (the tag, the cookie, the pixel request). The GDPR covers the personal data that results.

The Court of Justice of the EU settled the question of responsibility in Fashion ID (C-40/17, 29 July 2019). A clothing retailer had embedded Facebook's Like button. The Court found the retailer could be a joint controller with Facebook for collecting the visitors' data and transmitting it, though not for what Facebook did with the data afterwards. It also said the website operator must obtain any prior consent for the part it controls. The European Data Protection Board applied the same reasoning to retargeting in its Guidelines 8/2020 on the targeting of social media users (final version adopted 13 April 2021): when you embed a platform's tracking pixel, you and the platform are joint controllers for the collection and transmission of the data, and for the campaign reporting.

Regulators do act on this. In June 2023 France's CNIL fined a company specialising in targeted web advertising 40 million euros. The breaches it listed included consent, information and transparency, and the way the company managed its relations with joint controllers.

2. Consent has to come before the pixel fires

For retargeting, the device step needs prior consent. Legitimate interest cannot replace it there. The Court's Planet49 ruling (C-673/17, 1 October 2019) set the standard: a pre-ticked box is not consent, consent must be specific (agreeing to join a prize draw is not agreeing to cookies), and visitors must be told how long the cookies run and whether third parties can access them. The EDPB adds in Guidelines 8/2020 that scrolling, swiping or similar activity never counts as a clear affirmative action. GDPR Article 7(3) requires that withdrawing consent is as easy as giving it.

The platforms write the same requirement into their contracts. Meta's Business Tools Terms say that where the law requires consent for cookies or device storage, as it does in the EU, you must ensure, in a verifiable way, that people have given it before you use Meta's tools to store or access information on their device. Meta's developer documentation for the pixel offers a consent command for this: call fbq('consent', 'revoke') on every page so the pixel holds its events, then fbq('consent', 'grant') once the visitor accepts.

Google reads consent through Consent Mode. Two of its four signals matter most for retargeting. ad_personalization is consent for personalised advertising: when it is denied, remarketing in Google Ads receives no data from that visitor. ad_user_data is consent to send user data to Google for advertising. Google says both must be granted for personalised advertising to work. Google also audits sites under its EU user consent policy, checking for a working banner, an affirmative action, no cookies set before consent and correctly configured signals. Advertisers who do not engage risk losing remarketing and conversion measurement features.

How to test your setup in ten minutes

1. Open your site in a fresh private browser window with developer tools open on the Network tab.
2. Before touching the banner, filter requests by the ad platforms' domains. You should see no retargeting or pixel requests that carry identifiers, and no advertising cookies under the Application or Storage tab.
3. Click "Reject all". Browse three pages, including a product page. Nothing should change.
4. Open a new private window, click "Accept", and confirm the tags now load.
5. Withdraw consent through the link in your footer and check the tags stop again.

Repeat the test after every tag, theme or plugin change. A banner that looks right but never blocked anything is one of the most common audit findings. For banner design and consent records, see our practical guide to GDPR cookie consent.

3. Retention: platform maximums are ceilings, not targets

GDPR Article 5(1)(e) says personal data must be kept in identifiable form no longer than necessary for the purpose. For a retargeting audience, the purpose is usually narrow, such as recovering an abandoned cart or following up a pricing-page visit. The window should match it. The platforms let you go much longer:

Audience type	Where you set it	Platform limit (October 2026)	A defensible starting point
Google Ads website visitor segments	Membership duration on the segment, in Audience manager	Default 30 days, maximum 540 days	14 to 30 days for carts; up to 90 days for longer B2B cycles
Google Ads Customer Match lists	Membership duration when you upload or edit the list	Maximum 540 days	Tie it to the customer relationship; refresh the list rather than extend it
Meta website Custom Audiences	Retention (days) when you create the audience in Ads Manager	Meta's developer pages give both 180 and 365 days as the limit; check what Ads Manager shows for each event, as Meta changes these	30 to 60 days for product-view and cart audiences

The last column is a suggestion, not a legal threshold. A furniture shop with a long consideration phase can justify more than a food delivery service can. What matters is that someone chose the number, can explain it, and wrote it down. Also check audiences you created years ago: limits and defaults change, and an old audience may hold people longer than anyone remembers deciding.

Keep an audience register

A one-page register answers most questions a regulator, auditor or customer could ask. Keep one row per audience:

Column	Example entry
Audience name and platform	"Cart abandoners 14d", Meta
Source	Pixel event AddToCart, consented visitors only
Legal basis	Consent (cookie banner, marketing category)
Retention and reason	14 days; carts are rarely recovered after two weeks
Exclusions	Purchasers in the last 30 days; people who objected to marketing
Owner and last review	Marketing lead, reviewed quarterly

4. Customer lists are a separate legal question

Uploading email addresses or phone numbers for Google Customer Match or a Meta customer-list Custom Audience is also retargeting, just without the pixel. The cookie banner does not cover it. You need a legal basis for using that contact data for social and search advertising, and people had to be told about it when you collected their details.

The EDPB's Guidelines 8/2020 give two contrasting examples. A bank uploads the email of someone who only booked an appointment and then decided not to become a customer: legitimate interest is not an appropriate basis, because she had no reasonable expectation of being targeted. A different customer was told at sign-up that his email could be used to advertise related services and that he could object at any time: there, legitimate interest might work. The difference lies in what people were told at collection, whether the ads relate to services they already use, and whether they could object.

A recent French case shows the risk. In a decision dated 30 December 2025, the CNIL fined a company 3.5 million euros for sending the email addresses and phone numbers of more than 10.5 million loyalty-programme members to a social network for targeted advertising. The company relied on consent, but its loyalty sign-up form said nothing about that use, and its privacy documents did not make the purpose clear. The CNIL said it published the case because the practice is widespread.

Before any upload:

1. Trace the source. Which form collected these contacts, and what did it say about advertising on Google, Meta or other platforms?
2. Choose and record the basis. Consent collected for this purpose, or a documented legitimate-interest assessment for existing customers who were informed and could object.
3. Remove objectors. Under GDPR Article 21(2) and (3), once someone objects to direct marketing, their data may no longer be used for it. Unsubscribed contacts and objectors should never reach an upload file.
4. Set the consent signals. In Google Ads, uploads go through Tools, then Audience manager, the plus button, and Customer list. You tick a box confirming the data was collected and shared in line with Google's Customer Match policies, and you set a membership duration (maximum 540 days). Since March 2024, Customer Match lists sent through the API or a partner for EEA users need both ad_user_data and ad_personalization set to granted. Data sent without them is treated as not consented. On Meta, an ad account must accept the Custom Audience terms before it can create a customer-list audience.
5. Keep the file small. Upload only the identifiers needed for matching, not order history or notes.

The platforms hash contact details for matching. That does not make the data anonymous. We explain why, and what it means for server-side setups, in server-side tracking and GDPR: what consent still covers.

5. Tell people, in your privacy notice and in the banner

Because you are a joint controller for the collection, your own notice has to cover it. Name each platform you retarget on, say that you build advertising audiences from site visits and, where relevant, from customer lists, state how long people stay in those audiences, and explain how to withdraw consent or object. Planet49 requires telling people how long the cookies run and whether third parties can access them, so keep the banner's detail layer in line with the notice.

Common mistakes

• Banner without blocking. The pixel loads in the page header and the banner only records a choice nobody acts on.
• Consent collected but never passed on. The site respects the choice, but Consent Mode signals never reach Google. EEA audiences then quietly stop growing, and the audit risk remains.
• Every audience at the maximum. 540 days "just in case" is hard to justify for a 14-day cart campaign.
• Uploading the newsletter list. A list collected for "news by email" is not automatically fit for Customer Match or Meta audiences.
• Forgetting exclusions. People who objected to marketing, or asked for erasure, stay in uploaded lists until someone removes them.
• Creepy creative. Ads that repeat exactly what someone viewed, especially for sensitive products, invite complaints. Keep the message general.

Checklist: what to do this week

1. Run the five-step consent test above on your main domain and on any landing-page domains.
2. Confirm the Meta pixel starts in revoked mode and only grants on accept.
3. Check that Google receives ad_user_data and ad_personalization for EEA traffic, and that a denied choice is sent as denied.
4. List every audience in Google Ads and Meta, with its retention, in an audience register.
5. Shorten any window you cannot explain in one sentence.
6. For each customer list, find the original sign-up wording and record the legal basis.
7. Remove objectors and unsubscribed contacts from upload files, and set a recurring reminder to do it again.
8. Update the privacy notice: platforms, audience types, retention, and how to opt out.

Where Adverizeo fits

The consent and audience work above happens in your consent tool and ad accounts, not in Adverizeo. Adverizeo covers the ad text: every text ad gets a compliance score from 0 to 100 with suggestions before you use it. It is a risk check, not a legal guarantee. You can try it on existing copy with the free GDPR ad checker, no account needed, and read how the checks work on our GDPR page.

Related reading

• The complete guide to GDPR-compliant marketing for European SMEs
• Google Ads GDPR settings: complete configuration guide
• GDPR-compliant Facebook and Instagram ads
• Legitimate interest vs. consent: choosing a legal basis for ads

Want ad copy that is checked for compliance risks before your next campaign? Start free with Adverizeo.

This article is general information, not legal advice.