Online marketing and the GDPR
Monetising websites is an important source of income for many companies and sometimes is the business model. But monetisation means that traffic gets measured.
Targeted ads raise the return but require individual users or devices to be identified and their preferences analysed. We have detailed knowledge of how the common technologies are classified in data protection terms, including Google Analytics, TCF 2.0 and Usercentrics, and help with an implementation that holds up.
Two questions, not one
Access to the terminal device
- Governed by the German Telecommunications Digital Services Data Protection Act
- Applies regardless of whether personal data is involved
- Requires consent, subject to narrow exceptions
- Covers access without cookies as well, such as fingerprinting
Processing of the data
- Governed by the GDPR
- Needs a legal basis of its own
- Covers purposes, recipients, retention and transfers to third countries
- Consent at the first level does not replace it
Email advertising follows its own rules
Unfair competition law sits alongside data protection law and is often overlooked in online marketing. Advertising by email without prior express consent is an unreasonable nuisance under section 7(2) no. 2 of the German Unfair Competition Act, regardless of whether the GDPR would supply a legal basis.
The exception for existing customers in section 7(3) is narrower than it reads. Its four conditions have to be met together, and in practice the fourth is the one that fails. The right to object has to be pointed out not only on collection but on every single use.
For proving consent the double confirmation procedure has become standard. What has to be recorded is the time, the IP address and the wording that was agreed to. Without those details consent can hardly be shown in a dispute, and the burden of proof lies with the advertiser.
Where we support you
- Using Google Analytics in line with the GDPR
- Integrating consent management platforms such as Usercentrics correctly
- Review of your websites
- Advice on Google Ads, TCF 2.0 and comparable standards
- Review of your consent records
- Newsletters and advertising to existing customers under section 7 UWG
Banner in place, all quiet?
We check whether the integration delivers what the banner promises.
Have your site reviewedFrequently asked questions
Why is consent under the GDPR not enough?
Because two levels have to be kept apart. Storing and reading information on the terminal device requires its own consent under the German Telecommunications Digital Services Data Protection Act, regardless of whether personal data is involved. Only the subsequent processing follows the GDPR. Where both levels are collapsed into one, neither of them may be validly met.
May we use Google Analytics?
With consent and a clean configuration its use comes into consideration. Without consent it is precarious, and the question of transfers to the United States remains to be assessed. We look at your actual integration rather than advising for or against in the abstract.
May we contact existing customers without consent?
Only where four conditions are met together, section 7(3) of the German Unfair Competition Act. The address comes from the sale of goods or a service, the advertising is for the trader own similar goods or services, the person has not objected, and both on collection and on every use there is a clear notice of the right to object. If one of the four is missing, the exception does not apply.
We use a consent management platform. Is that sufficient?
Not automatically. A platform provides the tool, not the lawfulness. What matters is the design of the banner, whether rejecting actually takes effect, and whether loading really only happens after consent. That is what we review.