Targeted Advertising with Personal Data

Targeted advertising is showing specific advertising to particular people or groups using personal data such as browsing history, location, purchasing behaviour, interests or demographics. Behavioural advertising, retargeting and lookalike audience targeting are common forms.

Which Rules Apply?

Targeted advertising sits at the intersection of several regulations:

• KVKK: Analysing personal data for advertising is profiling and must rely on a legal basis for processing. As marketing profiling usually cannot rely on another basis, it generally requires explicit consent. Data subjects must also be informed.
• Cookies: Advertising and targeting cookies and advertising pixels are not strictly necessary cookies and should not be placed on a device without the user’s explicit consent; see Cookies and Cookie Policy.
• Commercial messages: If targeted advertising is sent by email, SMS or notification, commercial electronic message approval and IYS registration are also required.
• Cross-border transfer: As most advertising platforms are abroad, uploading customer lists and sharing pixel data are subject to cross-border data transfer rules.

Specific Risks

• Special categories of data: Targeting based on special categories of personal data, such as health, religion or sexual life, carries serious risk.
• Children: Targeted advertising directed at children requires particular care.
• Personalised pricing: Under the 2022 amendment to the Regulation on Commercial Advertising and Unfair Commercial Practices, consumers must be informed where the price is personalised based on their purchasing behaviour and other personal data.

The European Union

Targeted advertising to people in the EU is subject to the GDPR and the EU’s digital services rules, which impose stricter limits particularly on advertising to children and advertising based on special categories of data.