Marketing Privacy Regulation

For a long stretch, the job of a marketing team was to make the list bigger. Get thirty thousand email addresses from somewhere and you could send to them that same week. Paste one line of code from an ad network onto your site and you could follow the people who visited it across other sites entirely. Nobody asked permission at any point in that chain. The technology arrived first and the rules had not been written yet.

Discomfort piled up on both sides. On the customer's side, a pair of running shoes glanced at once would trail them across every site for two weeks, and marketing email arrived from companies whose names they had never heard. There was no obvious place to ask where the address had come from, and no obvious place to say stop. On the company's side a different problem grew. Eventually nobody could explain where the thirty thousand rows had come from. Addresses collected at a conference three years ago, addresses handed over by an agency, addresses from a partner deal — all of it sat in one table, so when something went wrong there was no way to tell which rows to delete.

In a meeting the situation took a recognizable shape. Ravi reports that he has secured a list of thirty thousand contacts, Grace asks where it came from, Ravi says the agency supplied it. The conversation stops there. No standard existed inside the company for deciding whether sending was allowed. With no standard, the decision came down to whoever was willing to take the risk, and since someone always had a send target to hit, the answer usually leaned toward sending.

Rules arrived from three directions at once. The first was law. Europe put the General Data Protection Regulation (GDPR) into force in 2018 and began setting fines against a company's worldwide revenue, and Korea's Personal Information Protection Act (PIPA) tightened its own standards along the same lines. The second was platforms. Apple introduced App Tracking Transparency (ATT) in 2021, forcing apps to ask permission in a popup before tracking a user, and the major browsers began blocking third-party cookies. The third was people. Resentment toward ads that follow you around had already accumulated, so the moment a decline button existed, a large share of users pressed it.

Marketing as a field splits into strategy that sets direction, the funnel and channels that map where customers travel, execution that actually speaks to them, and a back layer that reads results and handles the tools and the rules. Marketing privacy regulation sits in that back layer. Measurement sorts out what worked and the tool stack runs the machinery; this branch sits ahead of both and decides what may be collected in the first place and how far the collected material may be used. It is filed at the back but it runs at the front, so a team that checks it only after a campaign is built ends up throwing the campaign away.

Seven terms sit under marketing privacy regulation, in two branches. One is the body of law that draws the line, and the other is the collection mechanisms where that line actually gets crossed. The first branch is the standard, the second is the field.

Law decides what is permitted and what is forbidden. Three terms belong here.

1. GDPR — Europe's data protection regulation. It applies to the data of people living in Europe no matter where the company itself sits, so a Korean company with even a handful of European users is not exempt. Two features matter most. One is how strictly it defines valid consent: a pre-checked box, or a sentence buried in the terms of service, does not count. The other is the fine, set at up to four percent of worldwide annual revenue. Because the amount scales with company size, the exposure grows as revenue does.
2. PIPA — Korea's law on how personal information must be handled. It requires telling people what is being collected and why, obtaining consent at collection, using the data only for the stated purpose, and deleting it once that purpose is finished. The clause marketers run into most often is purpose limitation. Sending a service maintenance notice to an address given at signup and sending a discount announcement to the same address are two different purposes, and the second one needs its own consent. The document published externally to describe all of this is the privacy policy, and any gap between what that document says and what the company actually does is itself a violation.
3. Marketing consent — the permission required before sending promotional messages. Where the previous two govern data in general, this one attaches directly to the act of sending. In Korea the Network Act covers this ground and issues penalties for promotional email and text sent without consent. Three details catch teams in practice: sending a promotional text between nine at night and eight in the morning requires a separate night-hours consent, email subject lines have to carry an advertising label, and every message has to include a way to unsubscribe.

Collection covers the pipes data actually flows through. If law draws the line, this is where feet land on it. Four terms belong here.

1. Cookie consent — the permission step taken before tracking cookies are set. A cookie is a small record stored in the browser that lets a site recognize a returning visitor. The banner that slides up the first time you open a European site is this. The craft of building one comes down to putting the decline button at the same size and in the same place as the accept button. Hiding decline two screens deep inside a settings panel raises the acceptance rate, and it also means the consent will not hold up later.
2. Third-party cookie — a cookie set not by us but by an ad network, used to follow one person across many different sites. Retargeting, which shows an ad elsewhere to someone who visited our site, leaned on this material for years. As browsers moved toward blocking it, the material thinned out and recognizing the same person off our own property became hard.
3. First-party data — customer data collected directly on our own channels. Signup details, behavior recorded inside our site and app, and support history all belong here. Because we gathered it with consent rather than borrowing someone else's tracking, it survives when the regulatory picture shifts. This is the side whose value rose as the previous one thinned, which is why marketing teams have spent recent years pushing newsletters and account signups again.
4. ATT — Apple's policy requiring an app to ask permission in a popup before tracking activity across other companies' services. Users who decline have their advertising identifier returned empty, which means the person who clicked an ad and the person who paid inside the app can no longer be linked as one person. That is why attribution on the app side lost so much of its footing.

The two branches do not run separately. Law decides what has to be obtained, and the collection mechanisms become the screens and steps that obtain it; when a collection mechanism closes, the team goes back and works out which data can still be used within the law. The shift of weight toward first-party data after third-party cookies were blocked is exactly that loop. Splitting the branch across two people usually goes badly for the same reason. Someone who knows only the law does not know which buttons people actually press on the live site, and someone who knows only the tools does not know which clause the feature they left switched on runs into.

"Out of those thirty thousand contacts, filter for the ones with marketing consent and tell me that number first."

Said on the assumption that the contacts you hold and the contacts you may send to are two different figures.

"Don't put the email and the phone number on that event. Personal data goes straight into the analytics tool that way."

A warning that loading identifiable values into a measurement event turns the analytics tool itself into a system processing personal data.

"Does this banner show for European users? I'm not seeing a decline button on the current screen."

The question is not whether a consent banner exists but whether declining is as easy as accepting.

At Pagedeck the branch first surfaced as a problem because of a single webinar. Ravi ran an online session on document collaboration and gathered 1,200 registrations, and the following week he planned to send a paid-plan discount offer to the whole list. Mia reopened the registration form and found a single consent checkbox on it: consent to receive information about the event. There was no consent to receive promotions. Of the 1,200 registrations, the ones that could legally be mailed were the 310 who had given marketing consent through an earlier signup path.

Rather than simply blocking the send, Grace created one procedure. Campaign briefs gained a field for a single line naming the source of the target list and the consent it carries. Since then, a Pagedeck marketing brief states who a campaign goes to and, right next to it, what those people agreed to. The following quarter the webinar registration form carried marketing consent as a separate optional checkbox, and half of the registrants ticked it. Half sounds like a poor rate, but 600 contacts you may send to are worth more than 1,200 you may not.

The most common mistake is treating this as the legal team's work. A law is named, a fine follows a violation, so it reads as a legal matter. But the place the rules actually bite is not a lawyer's desk — it is the screens and tools a marketing team touches every day. How the consent checkboxes are arranged on the signup form, which values get loaded into the analytics tool, whether a customer list gets uploaded to an ad account: each of those is a marketer's decision. Legal sees the document only after the decision has been made. Left alone, this produces a pattern where campaigns get built in full and then die in a review the day before launch, and after that happens a few times the team starts skipping the review.

The second frequent error is assuming that consent, once obtained, makes the data free to use. Someone ticked the box, so permission was granted — except that consent attaches only to the purpose written beside it. Sending a discount offer to a person who agreed to receive service notices means using consented data for something they never consented to. Retention periods bind alongside it. Still holding a registration list from an event five years ago is a problem in itself, and the moment a user withdraws consent they have to drop out of the sending list from that point forward. A team that ignores all three ends up in a state where the share of usable records shrinks as the list grows. The table holds a hundred thousand rows, twenty thousand of them can actually be mailed, and the other eighty thousand sit there undeleted, accumulating nothing but risk.