GDPR Applies Across the EU

What Changed

The General Data Protection Regulation (GDPR) began to apply on May 25, 2018, across the European Union and the wider European Economic Area. It governs any organization that processes personal data about people in the EU, wherever that organization is based.

Under the GDPR, "personal data" includes online identifiers such as cookie IDs, advertising IDs and IP addresses. Processing it needs a lawful basis. For most advertising and cross-site tracking, that basis is consent, and the GDPR set a high bar for it: consent has to be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

The requirement to ask before setting non-essential cookies comes from a separate EU law, the ePrivacy Directive, but it uses the GDPR's definition of consent. In 2019 the EU's highest court confirmed, in the Planet49 case, that a pre-ticked box is not valid consent.¹ The European Commission's overview of EU data protection law sets out how the two laws fit together.²

Why It Mattered

The GDPR is why cookie banners and consent management platforms spread across the web. The ad industry built shared frameworks, such as IAB Europe's Transparency and Consent Framework, to pass consent signals between the many companies involved in a single ad. That framework became a test case itself: in 2022 Belgium's data protection authority found IAB Europe in breach of the GDPR, and in March 2024 the EU's highest court ruled that the consent string it passes along can be personal data, so the consent record is regulated like the data it governs.³

Fines can reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher, and regulators have issued large ones against major platforms. Cookie rules are enforced too: in January 2022 France's data protection authority fined Google €150 million and Facebook €60 million because their sites made refusing cookies harder than accepting them.⁴ The law also changed how data moves: advertisers and vendors now have to account for where data goes and on what basis, not only whether it can be collected, and in 2020 an EU court ruling put US analytics tools in doubt.

Researchers have measured the effect on the web. A study in Management Science of more than 27,000 top websites found that their use of third-party technology vendors fell by 15% for EU visitors in the week after the GDPR took effect, and that the vendor market became 17% more concentrated, with Google- and Facebook-owned vendors gaining share.⁵ Rules meant to rein in data collection also favoured the largest companies.

For measurement, the biggest effect is simple. People who decline consent can't be tracked, so part of every European audience is missing from user-level data.