GDPR at a glance.
The numbers and rules marketing teams ask about most, each with the article of the regulation it comes from. For how to apply them to your campaigns, read the guides.
Last reviewed . General information, not legal advice.
Six lawful bases, three that matter for marketing.
Every use of personal data needs one of these, chosen before processing starts. Article 6(1).
Consent
6(1)(a)Most cookie-based tracking and most marketing email. Must be freely given, specific, informed and as easy to withdraw as to give.
Contract
6(1)(b)Delivering what someone bought or signed up for. Not marketing about future purchases.
Legal obligation
6(1)(c)What a law requires you to keep or do, such as tax records.
Vital interests
6(1)(d)Protecting someone’s life. Rarely relevant to marketing.
Public task
6(1)(e)Official functions of public bodies. Not relevant to commercial marketing.
Legitimate interests
6(1)(f)Some direct marketing, especially B2B, after a documented balancing test. Never covers tracking cookies.
Eight rights, one deadline to answer them.
- Arts. 13–14
To be informed
Who processes their data, why, on what basis and for how long.
- Art. 15
Access
A copy of their data and how it’s used.
- Art. 16
Rectification
Correct inaccurate data.
- Art. 17
Erasure
Have data deleted when there is no longer a reason to keep it.
- Art. 18
Restriction
Pause processing while something is checked or disputed.
- Art. 20
Portability
Receive their data in a machine-readable format.
- Art. 21
Object
Stop processing based on legitimate interests; for direct marketing, always.
- Art. 22
Automated decisions
Not be subject to decisions with significant effects made solely by automated means.
The largest GDPR fines, and what they were for.
Three of the eight are about advertising or tracking. Several of these decisions are under appeal.
| Company | Fine | Regulator | Date | What it was for |
|---|---|---|---|---|
| Meta Platforms Ireland | €1.2 billion | Irish DPC | May 2023 | Transfers of Facebook users’ data to the US |
| Uber | €825 million | Dutch DPA | Aug 2026 | Fully automated deactivation of drivers’ accounts |
| TikTok | €530 million | Irish DPC | May 2025 | Transfers of EEA users’ data to China, and transparency |
| Instagram (Meta) | €405 million | Irish DPC | Sep 2022 | Children’s data |
| Google Ireland | €403 million | Irish DPC | Sep 2026 | Location data: lawfulness, transparency and retention |
| Meta (Facebook and Instagram) | €390 million | Irish DPC | Jan 2023 | Legal basis for personalized advertising |
| TikTok | €345 million | Irish DPC | Sep 2023 | Children’s data |
| LinkedIn Ireland | €310 million | Irish DPC | Oct 2024 | Legal basis for behavioral analysis and targeted ads |
Not listed: Amazon’s €746 million fine from Luxembourg’s regulator (2021), annulled on March 12, 2026 because the regulator had not assessed whether Amazon acted intentionally or negligently, and sent back to it; the court agreed Amazon could not rely on legitimate interest for its ad targeting. Cookie fines issued under national ePrivacy laws, such as France’s, are not GDPR fines and are not included. Checked October 1, 2026.
A checklist for ad campaigns.
Each step links to the guide that covers it.
Choose and record the lawful basis for each campaign before it starts.
Legitimate interest vs consent →Block tracking tags until the visitor consents, with Reject as easy as Accept.
Cookie consent guide →Check how a customer list was collected before uploading it to an ad platform.
Facebook & Instagram ads →Have a data processing agreement with every tool that handles personal data, and know where each one sends it.
DPA guide →Have a process to answer access and deletion requests within a month.
Data subject access requests →Check the ad copy itself for risky claims before it goes live.
Free GDPR ad checker →