General Data Protection Regulation

Personal data spent a long time being treated as something you collected because you could. The marketing consent box at the bottom of a signup form sat pre-ticked, and permission to send advertising lived deep inside terms nobody read to the end. Handing collected data to an ad network needed no particular process either.

From the user's side it looked like this. Advertising arrives from a company you don't remember signing up with. You unsubscribe, and a month later the same thing arrives under a different brand name. There is nobody to ask where your address came from and nowhere to ask for it to be deleted.

Companies weren't comfortable either. Europe had a 1995 directive that each country had translated into its own national law, so the German, French and Spanish standards differed in detail, and a company serving all of Europe had to satisfy more than twenty of them for a single feature.

GDPR, which took effect in May 2018, changed two things at once. It replaced those scattered national standards with one text that reads the same across Europe, and it wrote down in law what has to be true before a company may claim it has consent. Tying the fines to revenue finished the job: breaking the rules stopped being cheaper than following them.

Before touching personal data at all, a company has to name one of six legal bases for processing it: consent, performance of a contract, legal obligation, protection of someone's life, a public task, or legitimate interests. Without a basis the data can't be collected in the first place, never mind used. Marketing work realistically runs on two of the six — consent and legitimate interests.

Relying on consent means meeting four conditions together.

1. It has to be freely given. Make advertising consent a condition of signing up and the consent is not free, which makes it void.
2. It has to be specific to a purpose. Service announcements and discount campaigns are different purposes, so one box can't cover both.
3. It has to be informed. Who uses the data, for what, and for how long has to be readable on the consent screen itself.
4. It has to be an unambiguous action. A pre-ticked box, silence, and scrolling to the bottom of a page are none of them consent.

Withdrawing has to be as easy as giving. If consent took one click but removal takes a phone call to support, that condition breaks.

Users get a set of rights attached. They can ask to see their data, correct it, delete it, export it to another service, or object to a particular use, and the company has a month to answer. A data breach has to be reported to the supervisory authority within 72 hours.

Fines come in two tiers. Procedural failures such as poor record-keeping reach €10 million or 2 percent of global annual revenue, whichever is larger. Using data without a basis or ignoring user rights reaches €20 million or 4 percent, again whichever is larger. Because the figure scales with revenue, the exposure grows as the company does.

Marketers meet this regulation while editing screens and lists, not while reading legal text. Four places come up again and again.

1. The signup form. If terms of service and marketing consent share one checkbox, they have to be separated. The advertising box defaults to off, and refusing it still has to let signup finish.
2. The cookie banner. Cookie consent is the step that runs before anything is stored to recognize a visitor. The reject button belongs at the same size and in the same place as the accept button. Hide rejection two screens deep and acceptance rates climb, but the consent won't hold up later.
3. The sending list. Every address needs a record of when, where, and under what wording consent was collected. A purchased list or one scraped from another service can't produce that record, so it stays a liability. This is a large part of why first-party data gained value.
4. Deletion requests. Emptying the product database doesn't finish the job. The same person's records sit copied inside the email tool, the analytics tool, and the customer management tool, and all of them have to be cleared.

The document that states publicly what gets collected and how is the privacy policy. A gap between that document and actual practice is itself a violation, so the habit worth keeping is to edit it every time a new tool is connected.

"Three European users still means GDPR applies. We start with the signup form."

Pushing back on the idea that a small number of users makes this skippable.

"This list is a GDPR risk. We have no record of where the addresses came from."

Consent history can't be proven, so nothing should be sent to it.

"We got a deletion request — do we have to clear it from the email tool and analytics too?"

Someone has just realized how many tools hold a copy of the same person.

The month Pagedeck opened its free plan to European users, Ravi went back through the signup form. The existing screen bundled terms, data processing, and marketing into one box and left that box pre-ticked. Under Korean rules it needed one fix; under European rules it broke three conditions at once.

Ravi split the box into three and set marketing to off by default. Consent rates fell by more than half, as expected. Open rates went up instead, because only people who actively chose it stayed on the list.

The most common mistake is filing this under someone else's problem because the law is European. The regulation keys on where the data subject lives, not where the company sits. Offer a service to someone in Europe or track their behavior and it applies. Left alone, the consequence usually surfaces in sales first: a European customer asks about compliance during security review, and a deal stops there while nobody can answer.

Reading consent as blanket permission is the other frequent error. Consent is one basis out of six, and it stops working the moment the use drifts outside the purpose it was collected for. Sending a discount campaign to an address collected for service notifications is a violation even with a signed consent record on file.