Complete Guide to GDPR-Compliant Marketing for European SMEs

GDPR-compliant marketing is not one setting you switch on. It is a set of decisions you make for every campaign: which data you collect, on which lawful basis, whether the ePrivacy rules require consent, which vendors process it under which contract, how long you keep it, and how you answer people who ask about it. This guide is the hub of our GDPR cluster. It explains each decision for a European SME, links to the detailed guides and platform posts, and ends with a 30-day action plan. It reflects the law as of October 2026.

1. Personal data in marketing is broader than you think

GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable person, and it names "an online identifier" as one way a person can be identified. In marketing that covers the obvious (name, email, phone) and the less obvious: cookie IDs, advertising IDs, IP addresses, hashed emails uploaded to an ad platform, and behavioural data linked to any of them. Most pixels, tags and ad-platform audiences therefore process personal data, even when no name is ever collected.

2. Lawful bases for marketing

Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. In marketing, three matter: consent, legitimate interests and, in a narrow way, contract. The table shows the usual starting point for common activities. It is a starting point, not a verdict; your facts decide.

Marketing activity	Usual basis	Why
Advertising and analytics cookies, pixels, SDKs	Consent	ePrivacy Art. 5(3) requires consent to store or read information on a device unless it is strictly necessary for a service the user asked for.
Email or SMS marketing to consumers	Consent	ePrivacy Art. 13(1), with the narrow soft opt-in exception for existing customers (section 5).
Email marketing to business contacts	Depends on national law	Art. 13(5) leaves the protection of non-natural-person subscribers to each country. In France, for example, the CNIL accepts legitimate interest when the message relates to the recipient's profession.
Postal marketing to existing customers	Legitimate interests	Recital 47 says direct marketing "may be regarded" as a legitimate interest, subject to a balancing test and the right to object.
Processing an order or delivering a service	Contract	Only what is objectively necessary for the contract. Personalised advertising is not.
Sharing customer data with partners for their marketing	Usually consent; legitimate interests only in narrow cases	The Court of Justice allows a commercial interest, but only if the processing is strictly necessary and passes the balancing test (section 3).

The contract basis is a common trap. In January 2023 the Irish Data Protection Commission, following binding decisions of the European Data Protection Board, fined Meta Platforms Ireland €210 million (Facebook) and €180 million (Instagram) and found it could not rely on contract for behavioural advertising. In July 2023 the Court of Justice added (Case C-252/21) that contract only covers processing that is objectively indispensable to the contract, and that personalised advertising could not justify Meta's processing of the data at issue as a legitimate interest without consent.

3. Consent vs legitimate interest

When you need consent, it has to be real

Valid consent is freely given, specific, informed and unambiguous, given by a clear affirmative action (Art. 4(11)). You must be able to show that people consented (Art. 7(1)), and "it shall be as easy to withdraw as to give consent" (Art. 7(3)). In Planet49 (Case C-673/17, 1 October 2019) the Court held that a pre-ticked box is not valid consent for cookies, that clicking to join a promotional game is not specific consent to cookies, and that users must be told how long cookies operate and whether third parties can access them.

When legitimate interest can work

Legitimate interest needs three things: a lawful interest, processing that is necessary for it, and a balancing test showing people's rights do not override it. In Case C-621/22 (4 October 2024), the Dutch tennis federation KNLTB had been fined €525,000 by the Dutch authority for passing members' data to sponsors. The Court ruled that a purely commercial interest can be legitimate, but only if the processing is strictly necessary and the members' interests do not override it. Write the balancing test down before you rely on it; that document is your Legitimate Interest Assessment.

Two rules apply whichever basis you use for direct marketing. People can object at any time, and once they do, the data "shall no longer be processed for such purposes" (Art. 21(2) and (3)). And the right to object must be brought to their attention explicitly, at the latest in the first communication, separately from other information (Art. 21(4)). Our guide on legitimate interest vs consent walks through the choice for each ad activity.

4. ePrivacy and cookies

Cookie rules come from the ePrivacy Directive, not the GDPR. Article 5(3) requires consent before storing information on, or reading it from, a user's device, unless it is strictly necessary to provide the service the user requested. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) (final version adopted 16 October 2024) confirm that this also reaches techniques such as tracking pixels and URL tracking, not only classic cookies. Moving tags to a server does not by itself remove the consent question; see our post on server-side tracking and what consent still covers.

What a valid banner looks like in practice:

• No non-essential cookies or pixels fire before the user chooses.
• Refusing is as easy as accepting. The French authority CNIL states that users must be able to accept or refuse with the same degree of simplicity.
• Purposes and third parties are named, in the visitor's language.
• A refusal is respected on later pages and visits, and withdrawing is as easy as consenting.
• You keep a record of what each user agreed to.

Ad platforms add their own contractual layer. Google's EU user consent policy requires sites using its products to obtain valid consent for cookies where legally required and for the collection, sharing and use of personal data to personalise ads, for users in the EEA, the UK and Switzerland, and to keep records of consent. For implementation detail, see the cookie consent implementation guide, the practical cookie consent post for SMEs and our post on GDPR and retargeting.

What about the Digital Omnibus? On 19 November 2025 the European Commission proposed a "Digital Omnibus" that would, among other things, move the cookie rules from the ePrivacy Directive into the GDPR. As of the European Parliament's Legislative Train update of 20 September 2026, the proposal was still at committee stage, with no committee vote, Council position or trilogue yet. Nothing has changed in the law today, so plan for the current rules.

5. Email marketing and the soft opt-in

Under ePrivacy Article 13(1), marketing by email (and SMS, automated calls and fax) to individuals needs prior consent. Article 13(2) creates the "soft opt-in": you may email your own customers without fresh consent if all of these are true:

• You got their email address from them in the context of a sale of a product or service.
• You market only your own similar products or services.
• They were given a clear, free and easy way to object when you collected the address.
• Every message gives them the same easy way to object.

Prospects who never bought from you are not covered. Rules for business addresses vary because Article 13(5) leaves them to national law; the CNIL, for example, accepts legitimate interest for B2B emails when the message relates to the recipient's profession, with an opt-out. Note that "email" is read broadly: in September 2025 the CNIL fined Google LLC and Google Ireland Limited a total of €325 million, partly because ads displayed as emails in Gmail's Promotions and Social tabs were treated as direct marketing that needed consent.

6. Ad platforms and joint controllership

When you put a platform's pixel or plugin on your site, you are usually not just a customer of that platform. In Fashion ID (Case C-40/17, 29 July 2019), the Court held that a website operator embedding the Facebook Like button can be a joint controller with Facebook for collecting and transmitting visitors' data, though not for what Facebook does with the data afterwards. The earlier Wirtschaftsakademie ruling (Case C-210/16) found a Facebook fan page administrator jointly responsible with Facebook for processing data about page visitors.

Article 26 requires joint controllers to set out their respective responsibilities in an arrangement, in particular for transparency and data subject rights. Meta's Controller Addendum does this for its Business Tools: Meta and the business are joint controllers for collecting the data and transmitting it to Meta; Meta's later processing is outside the joint processing. Your part is mainly transparency and a lawful basis (in practice consent) for the collection on your site. The EDPB's Guidelines 8/2020 on the targeting of social media users (final version adopted 13 April 2021) are the reference text on roles in social media targeting.

Platforms are also limited in how much they may use. In Case C-446/21 (Schrems, 4 October 2024), the Court ruled that data minimisation stops a social network from aggregating and using all the personal data it obtains for targeted advertising without limit in time and without distinction by type of data.

Each platform handles consent signals, audiences and pixels differently. Our platform posts cover the settings one by one:

• Google Ads GDPR settings
• Facebook and Instagram ads
• LinkedIn ads for B2B
• TikTok ads
• Microsoft Ads and UET consent
• Pinterest ads
• X (Twitter) ads
• YouTube ads

7. Data processing agreements and transfers

Your email tool, CRM, hosting provider and any agency handling customer data on your instructions are usually processors. Article 28(3) requires a contract that, among other things, makes the processor act only on your documented instructions, keep the data confidential, apply the security measures of Article 32, use sub-processors only under the agreed conditions, help you answer data subject requests, and delete or return the data when the service ends. Most vendors offer a standard data processing agreement; your job is to sign it, check it covers what you actually do, and keep a list of vendors. The DPA guide for marketers explains each clause.

Many marketing tools are based in the United States. Transfers there need a valid mechanism: standard contractual clauses, or the EU-US Data Privacy Framework for certified US companies, which rests on the Commission's adequacy decision of 10 July 2023. On 3 September 2025 the EU General Court dismissed an action to annul that decision (Case T-553/23, Latombe). Check that each US vendor is certified or offers standard contractual clauses, and keep an eye on further court challenges.

8. Retention

Article 5(1)(e) says personal data must be kept no longer than necessary for its purpose, and Articles 13 and 14 require you to tell people the retention period or the criteria for it. The GDPR sets no fixed periods for marketing data, so you set them and write them down. Some authorities, including the CNIL, publish reference periods for common processing in their sector guidance, which are a useful benchmark for your own decisions.

Data set	Decide and document
Newsletter subscribers	When an inactive subscriber is re-asked or removed
Prospects who never bought	How long after the last contact you delete them
Customers under soft opt-in	When the customer relationship counts as ended for marketing
Uploaded ad audiences (customer lists)	How often lists are refreshed, and that opt-outs are removed before each upload
Consent records	How long you keep proof of consent
Opt-out (suppression) list	The minimum you keep so an opted-out person is not re-imported

9. Data subject rights

People can ask to access, correct, erase, restrict or port their data, and to object (Articles 15 to 22). You must respond without undue delay and within one month, extendable by two further months for complex or numerous requests if you tell the person within the first month (Art. 12(3)). For marketing teams the most common requests are access ("what do you hold on me and where did you get it?"), erasure and objection. An objection to direct marketing has no balancing test: you stop. Our post on data subject access requests covers the mistakes marketing teams make.

10. DSA ad rules (Articles 26 and 28)

The Digital Services Act (Regulation (EU) 2022/2065) has applied in full since 17 February 2024. Its ad rules bind online platforms, but they shape what you can do as an advertiser:

• Article 26(1): for every ad, users must be able to see in real time that it is an ad, on whose behalf it is shown, who paid for it if different, and meaningful information about the main targeting parameters. Keep the advertiser and payer names in your ad account accurate.
• Article 26(3): platforms must not show ads based on profiling that uses special categories of data under GDPR Article 9 (such as health, religion, political opinions or sexual orientation). Do not try to rebuild these through interest proxies.
• Article 28(2): platforms must not show profiling-based ads to users they know with reasonable certainty are minors.
• Article 39: very large online platforms and very large online search engines keep a public ad repository with each ad until one year after it was last shown, so assume competitors and regulators can see your ads.

Political advertising has its own regulation on transparency and targeting (Regulation (EU) 2024/900), which has applied since 10 October 2025.

11. Fines and enforcement trends

GDPR fines for breaching the core principles, lawful bases or data subject rights can reach €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)). Cookie breaches are often fined under national ePrivacy laws instead. Verified examples relevant to marketing:

Date	Authority or court	Case	What it teaches
January 2023	Irish DPC	Meta Platforms Ireland: €210m (Facebook) and €180m (Instagram)	Contract is not a lawful basis for behavioural advertising.
4 October 2024	Court of Justice	KNLTB (C-621/22), after a €525,000 Dutch fine	Commercial interests can be legitimate, but only with strict necessity and a real balancing test.
1 September 2025	CNIL (France)	Google LLC and Google Ireland Limited: €325m in total	Ads shown as emails need consent; cookie refusal must be as easy as acceptance.
1 September 2025	CNIL (France)	Infinite Styles Services Co. Limited (Shein group): €150m	Cookies set before any choice, ignored refusals and incomplete banners.

Three trends stand out. First, cookie consent remains a priority for the CNIL, which presented its 2025 Google and Shein decisions as a continuation of the cookie action plan it began in 2019. Second, consumer associations bring cases too: both Planet49 and Fashion ID started as lawsuits by German consumer organisations, so a complaint does not have to come from a regulator. Third, the courts keep narrowing what platforms may do with ad data (C-252/21, C-446/21), which shows up as fewer targeting options and stricter consent signals for advertisers.

12. Common mistakes

• Firing pixels on page load and asking for consent afterwards.
• A banner with "Accept all" on the first layer and "Reject" hidden two clicks away.
• Using the soft opt-in for prospects, or for products unlike the ones the customer bought.
• Claiming legitimate interest without a written balancing test.
• Uploading customer lists to ad platforms without removing people who objected.
• No data processing agreement with the email tool or agency.
• A privacy notice that does not name the ad platforms and tools actually used.
• Keeping prospect data forever "just in case".
• Assuming the Digital Omnibus has already changed the cookie rules.

13. 30-day action plan

Week	Tasks	Output
Week 1: Map	List every tag, pixel, SDK, form, list and tool that touches personal data. Note the purpose and lawful basis for each.	A data map and processing record you can update.
Week 2: Consent	Test the cookie banner: nothing fires before a choice, refusing is one click, refusals persist. Check email sign-up forms and soft opt-in conditions.	A fixed banner and form wording, with screenshots as evidence.
Week 3: Contracts and platforms	Collect DPAs from processors, confirm transfer mechanisms, accept the platforms' controller terms, and check consent signals reach Google, Meta and the other platforms you use.	A vendor list with DPA and transfer status.
Week 4: Rights and retention	Write retention periods, set deletion reminders, build the suppression list, and run a test access request end to end.	A retention schedule, a rights-request procedure and an updated privacy notice.

Checklist before your next campaign goes live:

1. Lawful basis recorded for every data use in the campaign.
2. Consent collected before any ad or analytics tag fires.
3. Email audience limited to consented contacts or valid soft opt-in customers.
4. Uploaded audiences cleaned of objections and opt-outs.
5. Privacy notice names the platforms and tools in use.
6. No targeting on sensitive categories or their proxies.
7. Ad copy checked for claims that need evidence.

More in this GDPR hub

Guides: cookie consent and consent management, data processing agreements explained, legitimate interest vs consent, and multilingual marketing for European businesses for consent texts in each market's language. Posts: GDPR and AI marketing tools, plus the cookie, retargeting, server-side, access-request and platform posts linked above.

How Adverizeo helps

Adverizeo gives every text ad a compliance score from 0 to 100 with suggestions, using country rules for EU locales. It is a risk check and guidance, not a legal guarantee, and it does not replace your consent setup or contracts. You can test an ad with the free GDPR ad checker without an account, read how the checks work on our GDPR page, or create a free account.

This guide is general information, not legal advice.