Marketing, Cookies and Tracking

Under Article 4(7) GDPR, the controller is the party deciding the purposes and means of processing. This will normally be the organisation using a customer database for advertising or deciding which audiences an advertising platform should target. A marketing provider may be a processor. If the platform also determines purposes and means, the allocation of roles requires a separate assessment.

Every measure should therefore have a short data-flow record: source, identifiers, tags or interfaces, recipients, profile attributes, purpose and deletion rule. Calling something a “marketing tool” does not answer these questions. Pseudonymous identifiers may still be personal data if the organisation or a provider can reasonably link them back to a person.

The data protection governance process should include approval of new tools. Where agencies, platforms or campaign partners jointly shape a campaign, clarify who informs individuals, receives objections and handles requests.

For cookies, pixels and similar technologies, first determine whether information is stored on or read from the device. Section 165(3) of the Austrian Telecommunications Act 2021 requires providers of information-society services to obtain active consent, based on clear and comprehensive information, when collecting personal data. The narrow exception covers technical transmission or access that is strictly necessary for a service expressly requested by the user.

A marketing, analytics or retargeting tag therefore cannot be justified simply because it sets “only” an identifier or sends data to a provider. The user must know the purpose before choosing. Non-essential technologies must not load on the initial page view. Refusal should be possible without unnecessary obstacles and should not be hidden behind a materially less visible choice.

Consent under telecommunications law does not automatically answer the GDPR question. If an organisation processes an IP address, online identifier, device information or usage data, it also needs a suitable legal basis under Article 6 GDPR. A banner should show purposes, providers, categories and withdrawal in an understandable way rather than merely listing technical product names.

Postal advertising, newsletters, SMS and other contact channels are not governed by identical rules. Article 6 GDPR requires a legal basis for processing. Legitimate interests may be relevant for direct marketing where purpose, scope, reasonable expectations and impact are carefully balanced. The information must name the purpose clearly. Electronic marketing is also subject to the stricter requirements of Section 174 of the Austrian Telecommunications Act 2021.

Electronic mail for direct advertising is generally permitted only with prior consent. The exception for the controller’s own similar products or services requires, among other things, that the contact details were obtained in connection with a sale or service and that a clear, free and easy opt-out was offered when collected and in every message. The specific recipients and message content must be part of the assessment.

A person objecting to processing for direct marketing has a particularly strong right under Article 21(2) GDPR. The data must then no longer be processed for that purpose. The organisation therefore needs a reliable suppression list covering CRM, newsletters, sales lists and, where relevant, contracted advertising providers.

Article 4(4) GDPR defines profiling as automated processing used to evaluate personal aspects, especially to analyse or predict interests, behaviour or economic situation. Assigning someone to a target group may already qualify. The assessment is not limited to complex artificial-intelligence models: CRM rules, scores and combined online and offline data can create a profile.

For every segment, an organisation should be able to explain which attributes are used, why they are necessary, where they came from and when they expire. Special-category data or information inferred from it cannot simply be treated as an ordinary advertising attribute. This is particularly important for political, health or other Article 9 data.

A solely automated decision producing legal effects or similarly significant effects may additionally engage Article 22 GDPR. Personalised advertising is not automatically such a decision. The threshold must not be bypassed by a formal label, however. If a score controls access, price, service or another significant opportunity, the organisation needs a deeper review, appropriate information and, where required, human intervention. For an initial assessment, profiling and automated decisions should be documented as separate review steps.

Articles 13 and 14 GDPR require information that people can actually understand. A privacy notice should not merely name an advertising platform. It should explain which data comes from which interaction, which audiences are created, how long attributes remain and whether recipients outside the European Economic Area are involved.

When data comes from public sources, partners or enrichment providers, Article 14 GDPR must also be considered. Information should not be prepared only after a complaint. Anyone purchasing an interest list should document its origin, purpose and objection route, even if the list is used for a single campaign.

For a website visit, the privacy notice, consent dialogue and actual tag behaviour must match. A banner selecting only “marketing” while the notice lists many different purposes and providers makes an informed choice difficult. The EDPB guidance on consent provides a useful framework for clear, specific and informed choices. The governance topic shows how to connect these documents with internal responsibility.

The accountability principle in Article 5(2) GDPR does not require every organisation to produce the same volume of paperwork. It must be able to show why a measure appeared lawful and how it was implemented. Depending on the measure, this includes records of processing, a legitimate-interest assessment, consent logs, provider review and the withdrawal and objection process.

A data-protection impact assessment under Article 35 GDPR should be considered where processing is likely to create a high risk, for example through large-scale systematic monitoring, sensitive data, linked sources or significant consequences of automated evaluations. That is not an automatic consequence of every analytics tool; scale, duration, systematic nature and impact matter.

A practical approach is one approval record per campaign or permanent data flow. It should contain the data-flow diagram, purpose, legal basis, notice, provider, technical activation, suppression logic, retention period and an opt-out test. Changes to tags, audiences or recipients require an updated assessment.

Many risks arise from small gaps between planning and operation. A tag may be classified as “essential” in a manager even though it measures reach or supports advertising. Or an objection may be stored in the newsletter system but never sent to the advertising platform.

A careful banner cannot authorise unlawful profiling in a CRM. Conversely, a good privacy notice cannot replace active choice where device access or electronic advertising requires consent. The assessment should therefore cover both the interface and the downstream systems.

The internal review can follow a simple sequence. Describe the measure, purpose, audience and contact channel. Record source, technology, recipients and storage. Then assess legal bases and notices. Only after that should the technology be activated. Once live, test first visit, acceptance, refusal, withdrawal, objection and deletion with realistic cases.

The role check supports an initial assessment of whether the organisation is a controller, processor or joint controller. A deeper review should include contracts, tag configuration, campaign briefing, data sources and deletion and suppression periods.

If a measure is already running, changing the banner text alone is not enough. Compare the browser, consent store, tag manager, CRM, sending tool and advertising platform. This reveals whether a withdrawal or objection actually reaches the last recipient.