GDPR requires a lawful basis for each ad-data use. CCPA/CPRA requires notices and consumer choices, including sale and sharing opt-outs. Before launching, I check 3 things: what data moves, which rules apply, and whether each partner honors the user’s choices.
The difference is not just opt-in versus opt-out. EU tracking rules can require consent before advertising tags run. California requires covered businesses to honor applicable opt-outs, including Global Privacy Control (GPC).
Quick Comparison
| Check | EU GDPR and tracking rules | California CCPA/CPRA |
|---|---|---|
| Coverage | EU/EEA establishment, targeting, or monitoring | California residents’ data and business coverage thresholds |
| Legal basis | Required for each processing purpose | No equivalent general requirement |
| Tracking | Prior consent where required | Assess sale or sharing and honor opt-outs |
| Notices and rights | Explain data use and support applicable rights, including consent withdrawal | Disclose data use and support applicable access, deletion, correction, and opt-out rights |
| Data limits | Limit data and retention to the purpose | Keep collection, use, and retention reasonably necessary and proportionate |
| Partners and transfers | Check roles, agreements, and transfer safeguards | Check partner contracts and limits on data use |
My rule: <u>approve the data use, not just the platform</u>. That means testing choices across CRM uploads, targeting, measurement, and downstream sharing - then keeping the records to back it up. UK campaigns also need a separate UK GDPR and PECR review.
GDPR vs. CCPA/CPRA: Ad Compliance Checks
CCPA vs. GDPR: What’s the Difference?
sbb-itb-01010c0
GDPR: Legal Grounds and Partner Duties
Map who controls each campaign step and who must document compliance once the lawful basis is clear.
Assess each campaign purpose separately. Audience building, targeting, and measurement often carry different GDPR duties. For every activity, including ad delivery, record the purpose, data used, lawful basis, and partner. Platform settings and contract labels do not determine compliance. [1][2]
Use that map to establish whether consent, legitimate interests, or both apply to each activity.
Consent, Legitimate Interests, and Tracking Rules
If you rely on consent, make it explicit, verifiable, and as easy to withdraw as to give. Record it through a properly configured consent management platform. [1]
Under Article 6(1)(f), document the interest, necessity, and balancing test. Behavioral ads alone do not make tracking necessary to perform a contract. [2]
ePrivacy rules apply separately. Advertising cookies, pixels, and device identifiers usually require prior consent unless strictly necessary for the requested service. Legitimate interests cannot bypass that requirement. [2]
Data Limits and Partner Responsibilities
Notices for audience uploads and ad delivery must disclose data sources, profiling, recipients, and retention. Collect only the fields you need, and tie retention periods to the purpose rather than keeping audience lists indefinitely. Review cross-border transfers and use an approved mechanism, such as Standard Contractual Clauses, along with any required safeguards. [1]
Cross-platform campaigns divide responsibility among several parties. Use the role map below to assign duties based on actual control, not platform labels.
| Party | Role depends on actual activity | Duty |
|---|---|---|
| Advertiser | Usually controller for campaign purpose and audience selection | Record the lawful basis and approve uploads, notices, retention, and partner responsibilities. |
| Publisher | Controller or joint controller when deciding tracking purposes or means | Assign responsibility for disclosures, consent collection, and withdrawal handling. |
| Platform | Processor, independent controller, or joint controller depending on its activities | Use the right contract and verify any data reuse. |
| Data provider | Often controller for independently collected audiences; processor only when acting on instructions | Verify collection sources, permitted uses, notices, and lawful-basis evidence before accepting data. |
CCPA/CPRA: Notices and Consumer Choices
GDPR asks for a lawful basis. CCPA/CPRA focuses on disclosure and consumer choice: Is personal information sold or shared, does the notice match the actual data flow, and is the user’s opt-out honored? Sale/sharing disclosures and opt-out notices must reflect personal information disclosed to third parties, service providers, and contractors.[2]
Sale, Sharing, and Global Privacy Control
Honor sale/sharing opt-outs, including Global Privacy Control signals where required. Stop downstream sharing that conflicts with the user’s choice.[2]
Consumer Rights and Ad-Tech Contracts
Keep contracts aligned with your data map. Limit service providers, contractors, and third parties to the disclosed purpose, and route access, deletion, and correction requests through the same workflow.
Use that notice-and-opt-out map for the campaign-stage checks that follow.
Running Campaigns Under Both Laws
Build privacy checks into campaign approval, with a check for each stage tied to the relevant legal duties.[1]
Privacy Checks at Each Campaign Stage
Run these checks before activation and whenever a campaign’s data use changes. Server-side tracking and hashed IDs do not remove privacy duties. Review the underlying collection, purpose, recipients, and user choices.[1][2]
Treat each stage as its own approval point rather than relying on a single sign-off.
| Campaign stage | GDPR lawful-basis and ePrivacy checks | California notice, choice, and contract checks |
|---|---|---|
| Collection | Document the lawful basis for each purpose and collect only necessary fields. | Make sure the collection notice matches the fields and purposes collected. |
| Cookies and pixels | Obtain required prior consent and keep unapproved tags blocked. | Honor GPC signals and provide a clear “Do Not Sell or Share” link. |
| Audience creation | Enforce purpose limits and use pseudonymized or hashed IDs where appropriate. | Check sale/sharing opt-outs before processing audience data. |
| CRM matching | Validate consent for third-party matching and execute required DPAs. | Sync “Do Not Sell” requests to the CRM and block downstream reuse. |
| Platform activation | Verify partner terms and required international-transfer safeguards. | Confirm contracts support the intended service-provider or contractor treatment. |
| Retargeting | Verify required tracking consent and make withdrawal easy. | Honor cross-context behavioral advertising opt-outs. |
| Lookalike audiences | Confirm a lawful basis for seed-list use and profiling. | Check seed lists for sale/sharing restrictions before upload. |
| Measurement | Minimize event fields and use aggregated or anonymized reporting. | Verify that measurement partners stay within service-provider limits. |
| Suppression | Stop consent-based uses after withdrawal and keep only necessary suppression data. | Carry opt-outs through exports, integrations, and audience refreshes. |
After approval, check that every data handoff follows the same rules.
Map Data Flows and Sync Privacy Choices
Map each handoff among directories, websites, CRM systems, publishers, data providers, ad platforms, analytics, and conversion tools. Label identifiers, browsing activity, inferred interests, and professional contact data. At each connection, assign a system to enforce privacy preferences.[1][2]
Keep Notices, Contracts, and Records Current
Privacy owns the documentation; operations supply the evidence. Keep notices aligned with purposes, data categories, recipients, retention, and rights. Put the required partner agreements in place, including DPAs and, where needed, Standard Contractual Clauses (SCCs).
Keep consent and opt-out records, vendor reviews, suppression evidence, and campaign-change logs according to documented retention rules. Schedule quarterly audits, and review sooner when vendors, tracking, or regulations change.[1][2]
Conclusion: Checks Before Campaign Approval
Approve the data use, not just the platform. Use the matrix below to check approval requirements by jurisdiction.
Choose Controls by Location and Activity
| Exposure | Activity | Approval checks |
|---|---|---|
| EEA | Measurement and tracking | Document the lawful basis and confirm consent where required. Check partner roles and international-transfer safeguards. |
| UK | Retargeting and audience matching | Check UK GDPR requirements, consent where needed, partner contracts, and transfer safeguards. |
| California | Advertising and audience matching | Align notices with actual purposes. Assess sale or sharing, honor opt-outs and GPC, and verify contractual limits on partner use. |
| Combined | All activities above | Standardize data minimization, vendor vetting, and privacy by design. Keep jurisdiction-specific notices, rights, consent, and opt-out controls in place. |
A CMP coordinates choices. It does not replace a lawful basis or opt-out handling.[1]
Use these controls to build the approval record below.
Record the Evidence for Approval
Confirm current requirements for profiling, automated decision-making, and higher-risk processing. Review the GDPR text, EDPB guidance, UK ICO guidance, California Privacy Protection Agency guidance, and California Attorney General materials.[1]
This article provides general information, not legal advice.[1]
Approval record: Attach the data map; purpose-by-purpose lawful-basis record; tested consent, withdrawal, and GPC settings; notice versions; signed partner contracts; downstream suppression results; applicable transfer safeguards; and audit findings.[1]
FAQs
Does my business need to comply with both laws?
Which law applies depends on where your customers are and where your business operates. GDPR applies to businesses that process personal data of individuals in the European Union. CCPA applies to businesses that collect personal information from California residents. If your ad campaigns target both regions, you must meet both laws’ requirements.
How can I test whether ad partners honor opt-outs?
Require Data Processing Agreements (DPAs) that mandate privacy compliance and give you explicit audit rights [1][2]. Audit ad partners’ data handling regularly to verify that they remove users who opt out from processing lists [1]. Require clear consent mechanisms that you can verify [1].
When you find compliance issues, use a structured investigation and corrective action plan. Document every step to keep a clear audit trail [3].
When does audience matching count as data sharing?
Audience matching counts as data sharing when personal information is sent to or processed by third parties, including advertising platforms, for targeting. Under CCPA, personal information broadly covers data linked or linkable to a specific person or household.
Under GDPR and CCPA, businesses must meet the transparency and consent rules that apply to them. This includes getting explicit consent when needed or providing required opt-out options.
