The General Data Protection Regulation (GDPR) is a set of requirements for organizations in the EU that collect and process personal information. It went into effect in May, 2018. The GDPR stipulates giving users control over the use of their data. Stakeholders of personal data must put in place appropriate technical and organizational measures to implement the data protection principles. As personal data is processed on many occasions, the impact of GDPR is fairly all-encompassing. It has a major impact on marketing and advertising, as more and more of these activities are based on insights into customers, which are derived from personal information. Personalized advertising is still possible under GDPR, but requires consent, fair use, and reducing the use of data only to what is necessary. This is sometimes easier said than done, and regulations like the “fair use of data” are open to debate, as are the methods of getting consent to use data.

In the meantime, there have been some rulings from the EU and national courts to specify practices. GDPR gave rise to many solutions for handling customer consent for electronic channels. Those can be complex, however, and while large enterprises have the resources to cope, smaller organizations can have severe limitations.

In addition to the GDPR, the EU plans to pass another regulation to augment and detail privacy in electronic communication: the e-Privacy Regulation (ePR). The ePR is an upgrade to the e-privacy directive passed back in 2002. As a regulation, the ePR is much more powerful than a directive and is binding for member states and will supersede national laws. It will also mean that there is only one set of rules all stakeholders have to adhere to across the EU. Additionally, the ePR takes care of the considerable progress electronic communication has made in the last 15 years. It adds rules for social networks, privacy for meta-data transmitted, more control over cookies, and protection against spam.