As reported toward the end of 2015, the General Data Protection Regulation (GDPR) is set to be implemented, across the European Union, by 2017.


Following years of negotiations, the European Union has struck a deal on data protection rules, one that, depending on who you ask is either:


“…an own goal [from the EU]… an inexorable impairment on online media in Europe.” 


Townsend Feehan, the CEO of IAB Europe


or more positively


“(a) deterrent effect on companies so they take data protection seriously…”


David Martin, senior legal officer with consumer advocacy group BEUC


It matters to the advertising industry because it could, in theory, have a large impact on the value and efficacy of advertising online, and because so much is staked (by both content publishers and advertisers alike) on getting advertising online to pick up the slack left by the demise of print.


The deal gives internet users and consumers more control over how their data is kept and used and raises the age of consent from 13 to 16. Companies and organisations that don’t abide by the new rules will face large fines (of up to 4% of global sales). This is a big stick no matter which way you turn it, and it is designed to be, giving consumers a lot more power in the relationship they have with organisations online.


It’s worth showing the full definition of personal data according to The European Commision:


“…any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address. The EU’s Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet.”


That’s a broad scope and quite a lot of territory that advertisers had assumed (and used) as fair game. That broad definition, alongside the threat of fines on global profit, is the reason the likes of Google and Facebook have reason to be concerned about the new deal. Their business models are based on effective mining, and selling, of data. More widely the digital ad world is partly based on that effective data collection and the role it plays in being able to effectively match brands with audiences. Internet companies will now need to seek permission from users in Europe, to get them to opt-in, before serving them with targeted ads, while the changed age of consent will in one stroke remove a profitable chunk of audience from play.


Although it remains to see how the regulation will actually work in practise across all member states and all international media space owners, on paper at least it has the potential to seriously disrupt digital advertising and the brands who increasingly rely on it.


Naturally, we’ll keep our eye on this and keep you updated.


By Oliver Brown