LinkedIn Ads GDPR Compliance: B2B Marketing Guide for European Companies

LinkedIn ads GDPR compliance starts with a fact many B2B teams skip: a named prospect's work email, job title and employer are personal data, so the GDPR applies to B2B advertising just as it does to consumer ads. On LinkedIn it touches five places: the Insight Tag, the Conversions API, Matched Audiences, Lead Gen Forms and your targeting choices. This guide covers each one as of October 2026, plus retention, data subject requests and the Digital Services Act. For formats and campaign setup, see our complete guide to LinkedIn advertising for B2B.

1. B2B contact data is personal data

GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable natural person. "anna.berg@company.eu, Head of Procurement" identifies a person, whether it sits in a sales tool or a consumer database. A business email, a direct phone number, a job title plus employer, or a hashed email a platform can match: all personal data.

What falls outside is information about the company itself. France's regulator, the CNIL, notes that generic addresses such as info@ or contact@ belonging to a legal entity are not subject to its email prospecting rules. A company name on a target account list is not personal data either, which matters for company lists in section 5.

2. Prospecting and ad targeting are separate legal questions

"We may contact business prospects" is not one permission. Emailing someone, uploading their address to LinkedIn and tracking them on your site each have their own rules:

Activity	Rules	Usual basis	What you need
Cold email to a named prospect	National e-privacy rules plus GDPR	Legitimate interest where national law allows B2B email without consent (in France, if the message relates to the person's job)	Information at collection, an objection link in every message
Contact list upload to Matched Audiences	GDPR	Consent, or legitimate interest where people were told and could object	A record of the list's source and what people were told
Insight Tag retargeting and conversions	ePrivacy Directive Art. 5(3), then GDPR	Consent; legitimate interest cannot replace it	A banner that blocks the tag until opt-in
Following up Lead Gen Form leads	GDPR plus e-privacy rules for email	What the form and privacy policy said	Purpose-specific checkboxes, CRM sync
Targeting by job title, industry, company size	GDPR (LinkedIn's member data), DSA	LinkedIn's own basis	No proxies for sensitive categories

Legitimate interest: possible, but earned

Recital 47 says direct marketing may be a legitimate interest, subject to careful assessment of whether the person could reasonably expect it when their data was collected. That means a written assessment per use, not one line in a privacy policy. Under Article 21(2) and (3), people can object to direct marketing at any time, including related profiling, and you must then stop. Article 21(4) requires you to point out this right explicitly at your first communication at the latest.

The EDPB's Guidelines 8/2020 on targeting social media users draw the line with two examples. A bank uploads the email of someone who only asked for an appointment and did not become a customer: legitimate interest is not appropriate. A customer told at sign-up that his email could be used for social media ads about related services, with a right to object, might be targeted on that basis. A webinar attendee told about LinkedIn advertising is a different case from a list scraped from the web.

Regulators apply the same test to LinkedIn. In October 2024 Ireland's Data Protection Commission fined LinkedIn Ireland 310 million euros, finding that LinkedIn could not rely on legitimate interest or contract for behavioural analysis and targeted advertising with members' own data, and that its consent for third-party data was invalid. The decision concerned LinkedIn's processing, not advertisers, but shows how narrowly legitimate interest is read for ad profiling.

Bought or enriched lists

If contacts did not give you their details directly (a purchased list, an enrichment tool, an event partner), Article 14 applies: tell people the source and your use within one month at the latest, or at your first contact if sooner. Until that has happened, the list is not ready to upload.

3. The Insight Tag needs consent before it loads

The Insight Tag is JavaScript that runs on the visitor's device and sends LinkedIn the URL, referrer, IP address, browser details and a timestamp. The EDPB's Guidelines 2/2023 confirm that Article 5(3) of the ePrivacy Directive covers pixels and JavaScript tracking, so it needs prior consent for advertising. "B2B" changes nothing.

There are two consent layers. LinkedIn's GDPR page says the Insight Tag, the Conversions API and the Revenue Attribution Report adjust to consented member data only, based on members' ad settings. That is LinkedIn's consent from its members. Your cookie banner is your consent from your visitors, and you need it regardless.

LinkedIn also says the tag should not be installed on pages that collect or contain sensitive data, such as health or financial details. With enhanced matching, emails are hashed on your site before sending; hashed data is still personal data. Our posts on GDPR cookie consent and GDPR retargeting cover banner setup and testing.

4. Conversions API: hashing is not anonymisation

The Conversions API sends events from your server or CRM to LinkedIn, useful in B2B where qualified leads and deals come weeks after the click. Emails are hashed with SHA-256. But LinkedIn's API documentation shows an event can also carry a plain-text IP address, first and last name, job title, company name, a Lead Gen Form response ID, your external IDs and LinkedIn's first-party click ID. Names can be hashed in recent API versions; other fields arrive as you send them.

LinkedIn encourages several identifiers to raise match rates, but each extra field adds personal data, so send only what you need. LinkedIn says you must have the necessary permissions before sharing data, that Conversions API data is stored on US servers under the EU-U.S. Data Privacy Framework, and that it is kept for 180 days. Forward web events only for visitors who accepted advertising cookies; for offline CRM events, your legal basis and notice must cover sharing with LinkedIn. See server-side tracking and GDPR for why a server route does not remove consent.

5. Matched Audiences: contact lists and company lists

Lists are uploaded under Plan, Audiences, Create audience, Matched Audience, then Company or Contact, ending with "Agree & Upload". LinkedIn's data processing agreement lists the contact targeting data it receives: hashed email, first and last name, employer, job title, country and mobile device IDs.

• Contact lists target named people. Each needs a legal basis covering social media advertising and must have been informed. Strip objectors and unsubscribes before every upload.
• Company lists hold organisations, so the upload carries little personal data; LinkedIn then reaches employees through its own member data. Keep them to real target accounts, never a stand-in for a sensitive group such as religious or political organisations.

In the EEA, Switzerland and the UK, LinkedIn only matches members who consented to member-level matching, so audiences are smaller. An ad set needs at least 300 members to run.

6. Lead Gen Forms

Forms are pre-filled from the member's profile: first name, last name and email by default, up to 12 fields in total, including up to three custom questions.

• Privacy policy URL: required in the Data privacy section for approval; optional privacy text appears below it.
• Custom checkboxes: up to five, optional by default, outside the 12-field limit. One can be marked "Required"; do not do that for marketing consent, since under Article 7(4) consent made a condition of the download is unlikely to be freely given. Use one unticked box per extra purpose.
• Storage: LinkedIn deletes lead data after 365 days, and members can withdraw their submission during that time. Download leads (Content & Assets, Lead generation forms) or sync them to your CRM.
• Minimisation: LinkedIn itself recommends three to four fields. Each extra field is data to justify, secure and delete.

7. Controller, processor or joint controller

• LinkedIn's contract: its data processing agreement covers Marketing Solutions data, including Insight Tag data and Matched Audience contact information, under controller-to-processor clauses. For LinkedIn member data you access through its products, each party is an independent controller and they "are not joint controllers". If people contact LinkedIn about data you provided, LinkedIn tells you (the DPA has you name a Master Admin for such requests) and will not substantively respond without your prior written authorisation.
• The regulators' view: EDPB Guidelines 8/2020 treat advertiser and platform as joint controllers for list-based targeting, from upload through matching, display and reporting. In Fashion ID (C-40/17, 29 July 2019) the Court of Justice held that a site embedding a third-party tool can be a joint controller for collecting and transmitting the data, not for the platform's later use.
• Your Company Page: under LinkedIn's Page Insights Joint Controller Addendum, LinkedIn Ireland and the Page owner are joint controllers of Page Insights for EEA and Swiss members, and LinkedIn answers data subject requests. If a member or a regulator contacts you about Page Insights, you must notify LinkedIn within three working days. This mirrors the Court's Wirtschaftsakademie ruling (C-210/16, 5 June 2018).

Record both positions. Whatever the label, the consent on your site, the source of your lists and your privacy notice are yours. The notice should name LinkedIn, explain retargeting, list uploads and lead forms, and say how to object.

8. DSA rules on LinkedIn ads

DSA Article 26(3) forbids platforms from showing ads based on profiling with special categories of data, such as health, religion, political opinions, sexual orientation or trade union membership. The EDPB's November 2025 factsheet says platforms should never present targeted ads based on such data, and Article 26(3) contains no consent exception. Article 28(2) bans profiling-based ads to users known to be minors.

Since 15 May 2024, Member Groups is no longer a targeting attribute in the EEA or Switzerland. On 7 June 2024 Commissioner Thierry Breton announced that LinkedIn had fully disabled ad targeting based on LinkedIn Group membership in the EU. The Commission had sent LinkedIn a request for information in March 2024 after a civil society complaint that group membership could reveal sensitive data such as political opinions, race or sexual orientation. Do not rebuild it with uploaded association member lists or interests pointing at health, faith or politics. The pillar guide's EU targeting restrictions table lists the other European limits.

9. Retention and data subject requests

Data in Campaign Manager	LinkedIn deletes it	Your action
Uploaded contact lists	Within 30 days	Delete or retain the source file under your own rule
Audiences from contact lists	Rolling 90 days if unused	Delete audiences you no longer run
Lead Gen Form submissions	After 365 days	Sync to CRM, apply your CRM retention
Pseudonymised website visits, offline conversions	180 days	Describe it in your cookie and privacy notices
CRM data	Within 12 months	Disconnect unused integrations

These are LinkedIn's limits; your CRM and spreadsheets need their own. Under Article 12(3) you must answer access or objection requests within one month, extendable by two months for complex or numerous requests. Keep a suppression list applied before every upload and CRM sync. Our post on data subject access requests covers the process.

10. Settings table

Setting	Where	Recommended for EU campaigns
Insight Tag loading	Tag manager or consent tool	Only after advertising consent; not on sensitive pages
Enhanced matching	Insight Tag settings	Only if your notice covers hashed emails
Conversions API fields	Server, CRM or partner integration	Minimum identifiers; consent filter for web events
Contact list upload	Plan, Audiences, Matched Audience	Documented source and basis; objectors removed
Lead Gen Form data privacy	Lead Gen Form editor	Privacy URL, purpose text, unticked optional checkboxes
Targeting	Ad set audience	Professional attributes; no sensitive proxies
Account access	Ad account users	Few people can download leads; remove leavers

Common mistakes

• "It's B2B, so GDPR doesn't apply." Named business contacts are personal data.
• A banner that blocks nothing while the Insight Tag loads in the page header.
• Uploading the whole CRM, including people who unsubscribed or objected.
• Calling hashed emails "anonymous" in a privacy notice.
• Required consent checkboxes to unlock a download.
• Relying on LinkedIn's DPA alone without noting the joint-controller view.
• Lists or interests that recreate group targeting around health, religion or politics.

Checklist: what to do this week

1. Reject cookies in a private window and confirm nothing is sent to LinkedIn.
2. Map every data flow to LinkedIn: tag, Conversions API, lists, CRM sync, lead forms.
3. Record each contact list's source, notice and legal basis; write the legitimate interest assessment where needed.
4. Cut Conversions API events to the identifiers you need.
5. Check every Lead Gen Form for a privacy URL and unticked optional checkboxes; connect it to your CRM.
6. Review targeting and lists for sensitive proxies.
7. Update your privacy notice and set up a suppression list.

Where Adverizeo fits

Consent, lists and forms live in your consent tool and Campaign Manager. Adverizeo writes the ad text: every text ad gets a compliance score from 0 to 100 with suggestions, a risk check rather than a legal guarantee. See our GDPR page, test existing copy with the free GDPR ad checker, or start free with 10 credits a month.

For the wider picture, read our complete guide to GDPR-compliant marketing for European SMEs and legitimate interest vs consent.

This article is general information, not legal advice.