What Is GDPR? A Compliance Guide | Anura

GDPR stands for General Data Protection Regulation. It’s the European Union’s primary law governing how organizations collect, use, store, disclose, and protect personal data, and it does apply to many countries outside of Europe.

In the simplest terms, GDPR gives people more control over information that can identify them. It also requires organizations, including advertisers, to justify how they use that information.

After all, advertisers often track individuals across websites, apps, devices, or platforms. That puts many ordinary advertising activities within GDPR territory. Noncompliance can bring fines, but you may also be required to stop processing data, which can disrupt targeting and measurement and potentially halt your operation.

In this GDPR compliance guide, we’ll explain the basics of GDPR requirements so you can ensure you’re handling personal data securely.

What Is GDPR?

GDPR is a strict European law governing how marketers use personal consumer data for targeting and tracking. The GDPR law became enforceable on May 25, 2018. Essentially, it asks organizations to justify how they use any personal data they engage with when tracking individuals and their behavior.

What Qualifies as Personal Data?

Personal data includes obvious identifiers such as names and email addresses, but it can also include:

• IP addresses
• Cookie IDs
• Mobile advertising identifiers
• Location information
• Browsing and purchase histories
• Audience profiles or inferred interests

Be aware that some pseudonymized information can still qualify as personal data when it can be connected to an identifiable person.

What Do Advertisers Need to Know About GDPR?

Many ordinary advertising activities fall within GDPR territory. That’s just one reason why advertisers need to understand GDPR requirements.

GDPR Can Apply to Companies Outside of Europe

GDPR may apply if a company offers goods or services to people in the EU or monitors their behavior there, whether or not they have an office in the EU. For example, an American advertiser running retargeting campaigns aimed at EU visitors may be covered.

Advertising Data May Be Personal Data

Data doesn’t have to include someone’s name to be protected. Cookie IDs, device identifiers, IP addresses, and combinations of behavioral signals may identify or single out an individual.

Every Use of Personal Data Requires a Lawful Basis

GDPR recognizes several lawful bases, including consent and legitimate interests, but legitimate interest isn’t automatic permission to advertise. You’ll need to assess whether your interests are outweighed by the individual’s privacy rights.

Consent Needs to Meet a High Standard

When consent is required, it must be informed, specific, freely given, and communicated through a clear affirmative action. Prechecked boxes and vague blanket consent generally don’t satisfy that standard, and withdrawing consent needs to be as easy and intuitive as providing it.

GDPR & Cookie Consent Is More Complex

The EU’s ePrivacy rules and national laws address the use of cookies and similar tracking technologies, separate from GDPR. Nonessential advertising trackers often require consent before they’re activated.

People Can Object to Direct Marketing

Individuals have the right to object to personal data processing for direct marketing, including related profiling. Once someone exercises that right, the organization generally must stop using their data for that purpose.

Advertisers Are Responsible for Their Partners

GDPR requires organizations to determine whether each partner is acting as a controller, joint controller, or processor, and all contracts and disclosures must reflect those roles.

Noncompliance Is Expensive

There are financial penalties for GDPR non-compliance. Certain violations can result in administrative fines of up to €20 million or 4% of the organization’s total worldwide annual revenue from the previous financial year, whichever is higher.

A GDPR Compliance Checklist for Advertisers

Your exact GDPR requirements will depend on the campaign, organization, and the countries involved. However, the following GDPR compliance checklist provides a practical starting point:

• Know what data you collect. Document personal data gathered through forms, cookies, pixels, CRM systems, and advertising platforms.
• Confirm you can legally use it. Identify a lawful basis for each purpose and obtain valid consent when required.
• Explain your practices clearly. Maintain an accurate privacy notice covering collection, targeting, profiling, sharing, and retention.
• Respect user choices. Make it easy to reject or withdraw consent and object to direct marketing.
• Check your partners. Review agencies, platforms, and data vendors, and put required data-processing agreements in place.
• Collect less and delete regularly. Keep only the information needed and follow defined retention periods.
• Protect the data. Use appropriate security controls and maintain a data-breach response process.
• Keep evidence of compliance. Save consent records, lawful-basis assessments, vendor agreements, and campaign reviews.

A checklist can help organize the work, but it can’t determine whether a particular campaign is lawful. That requires reviewing the actual data, targeting method, parties involved, and applicable national rules. Use this checklist as a starting point but do your due diligence.

Put Compliance First with Anura

Anura supports GDPR-conscious advertising by helping businesses identify invalid traffic and fraudulent leads before unreliable data enters their marketing systems. It’s time to discover how much ad fraud is costing your business. Get a traffic quality audit and calculate your savings.