Who it applies to
GDPR covers organizations based in the EU, and also businesses elsewhere, including in the US, that offer goods or services to people in the EU or track their behavior online. A US company with no EU customers or visitors may not be covered, but many sites with international traffic are.
What it requires
Businesses need a lawful reason to process personal data, such as consent. People have rights to see, correct and delete their data. Sites must explain clearly what they collect and why, usually in a privacy policy, and keep data secure.
What it means for marketing
In practice, GDPR shapes cookie banners, analytics and ad tracking, email sign-up forms and how long you keep lead data. Fines can be large: up to 20 million euros or 4% of global annual turnover, whichever is higher.
Why GDPR matters
Privacy rules affect what data you can collect and how you can use it for marketing. Getting the basics right builds trust with visitors and lowers the risk of fines, while sloppy tracking or unclear consent can create real legal exposure.
Cleaning up the sign-up form
A software company selling to European customers pre-checked the marketing consent box on its demo form. Switching to an unchecked box, explaining what emails people would get and logging consent brought the form in line with GDPR and kept its email list clean.
Common mistakes
Assuming it never applies to US businesses
If you market to or track people in the EU, GDPR can apply. Check where your visitors and customers are.
Pre-checked consent boxes
Consent under GDPR has to be a clear, active choice. Pre-ticked boxes don't count.
Copying a privacy policy
A policy that doesn't match what your site actually does creates risk. Write it to reflect your real data practices, and get legal advice for your situation.
Where we work on this