GDPR & CCPA Marketing Compliance

Two different laws, one shared problem

GDPR (EU, enforced since 2018) and CCPA/CPRA (California, enforced since 2020/2023) both regulate how marketing teams collect and use personal data, but they start from different legal premises. GDPR is opt-in by default: processing personal data requires a valid legal basis, and for most marketing use cases (cookies, email, ad targeting) that basis is explicit consent obtained *before* collection. CCPA/CPRA is closer to opt-out by default: businesses can collect and use data without prior consent, but must disclose what they collect and honor a consumer's right to opt out of its "sale" or "sharing," a term CPRA defines broadly enough to cover most third-party ad-tech data flows.

For a marketing team operating in both jurisdictions, the practical consequence is that you generally have to build to the stricter standard (GDPR's opt-in consent) and then layer the CCPA-specific disclosure and opt-out mechanics on top, rather than running two entirely separate systems.

GDPR vs. CCPA/CPRA for marketing teams

What counts as valid consent under GDPR

GDPR consent has to meet specific criteria to be legally valid — a checkbox pre-ticked by default, or a banner with only an "Accept" button and no equally prominent "Reject" option, does not meet the bar and has been the subject of enforcement actions and fines in multiple EU member states. Valid consent must be:

- Freely given — no bundling consent with access to the service ("accept cookies or you can't use the site" is generally non-compliant for non-essential cookies).
- Specific — granular by purpose (analytics vs. advertising vs. personalization), not one blanket toggle.
- Informed — the user must know what's being collected and why before consenting, in plain language.
- Unambiguous — requires a clear affirmative action; silence, pre-ticked boxes, or scrolling the page do not count as consent.
- As easy to withdraw as to give — if accepting takes one click, rejecting or later withdrawing must be similarly easy, not buried three menus deep.

Data subject rights that marketing systems need to support

Both laws grant individuals rights over their data, and marketing stacks are frequently the part of the business least prepared to fulfill them because customer data is scattered across a CRM, an ESP, an ad platform's custom audience list, a CDP, and analytics tools simultaneously.

GDPR's core rights include access (what data do you have on me), rectification (correct it), erasure ("right to be forgotten" — delete it), portability (export it in a usable format), and objection (stop processing for direct marketing specifically, which must be honored unconditionally and immediately, no justification required from the user).

CCPA/CPRA grants a largely overlapping set: right to know, right to delete, right to correct, right to opt out of sale/sharing, and right to limit use of sensitive personal information. The CPRA addition of sensitive personal information (precise geolocation, health data, etc.) carries extra restriction requirements on top of the general data categories.

Practical compliance checklist for marketing data collection

Translated into what a marketing/ops team actually needs to have in place:

1. A compliant CMP generating a valid, logged consent record per user, with granular purpose categories and an equally easy reject path (see the Consent Management Platforms module for architecture detail).
2. Google Consent Mode (or equivalent) wired to the CMP so that ad and analytics tags respect the actual consent choice rather than firing regardless.
3. A documented data inventory — what personal data you collect, where it's stored, which systems it flows to (this is also a GDPR Article 30 requirement for a record of processing activities).
4. A defined retention policy with actual enforcement, not just a written policy (see the Data Minimization module).
5. A request-fulfillment workflow covering access, deletion, correction, and opt-out requests that touches every downstream system, with a committed response SLA (GDPR requires response within one month; CCPA within 45 days).
6. Vendor/processor agreements (DPAs) with every third-party tool that touches personal data on your behalf, since GDPR makes you responsible for your processors' compliance too.
7. A "Do Not Sell or Share" mechanism visible and functional on any property serving California residents, honored across ad-tech integrations within required timeframes.

Where enforcement actually bites

In practice, enforcement actions against marketing teams cluster around a few repeat patterns: cookie banners that fire analytics/ad tags before consent is captured (a technical implementation failure, not a policy failure); dark-pattern banner design that makes rejecting meaningfully harder than accepting; failure to honor opt-out/deletion requests within the required window; and sharing data with ad-tech partners beyond what the privacy policy disclosed. None of these require sophisticated attacks or audits to find — they're typically discovered through routine regulator sweeps or user complaints, which makes them avoidable with basic implementation discipline rather than deep legal expertise.

What's next

The CMP is the system that actually captures and enforces the consent choices this module describes — worth understanding its architecture directly.

Next: Consent Management Platforms (CMPs) →