GDPR Marketing 2026: Newsletter, Advertising, Profiling

Main article: Cookie banners 2026 — the full pillar article on consent and the exemptions under § 25 TDDDG.

Marketing data protection starts with two questions: which legal basis under Art. 6(1) GDPR supports the processing — and is the user's terminal equipment additionally accessed? Art. 6(1) GDPR lists six lawful bases; at least one must be met for the processing to be lawful. The following six sections work through the marketing constellations in turn; the cross-cutting obligations follow afterwards: data subject rights and deadlines, evidence for the supervisory authority, and the differences between Germany and Austria.

1. Newsletter consent and double opt-in

Mandatory: active consent + evidence of the consent + withdrawal as easy as sign-up. Double opt-in and logging the consent with IP address, time and form are the practice standard for that evidence (not an express statutory requirement).

The legal basis is Art. 6(1)(a) GDPR — consent as one of the six lawful bases. The requirements for that consent are set out in Art. 7 GDPR: where processing is based on consent, the Controller must be able to demonstrate that the data subject has consented (Art. 7(1) GDPR). That is precisely why the confirmation log exists — it is not a technical accessory but the evidence itself. Consent may be withdrawn at any time, the withdrawal does not affect the lawfulness of processing carried out up to that point, and it must be as easy to withdraw as to give (Art. 7(3) GDPR).

Practical recommendation (not a statutory requirement): one-click unsubscribe from every mailing, without login and without follow-up questions — this is the simplest way to make the equivalence of giving and withdrawing consent demonstrable. Also common practice: keep versioned copies of the wording of the sign-up form so that it remains traceable later what was consented to.

Germany / Austria: In Germany, § 7 UWG accompanies advertising contact. In Austria, § 174 TKG 2021 (unsolicited messages) governs newsletter dispatch — there too with consent, in addition to Art. 6 GDPR; double opt-in is the practice standard for the evidence there as well.

Practical assessment (no documented case numbers): newsletter infringements occur frequently in supervisory spot checks.

2. Cookies and tracking pixels

§ 25 TDDDG: consent BEFORE the tag loads. Equal choice: accept and reject as choice options with an equivalent communicative effect (interpretation by the supervisory authorities, OH Digitale Dienste para. 50). Fine range: up to EUR 300,000 for storing or reading information without consent (§ 28(1) no. 13, (2) TDDDG); for the subsequent processing, Art. 83 GDPR.

The statutory text is narrower than it is often quoted to be: under § 25(1) TDDDG, storing information in the end user's terminal equipment and accessing information already stored are permitted only where the end user has consented on the basis of clear and comprehensive information; information and consent must meet the standard of the GDPR. Without consent, only the two cases in § 25(2) TDDDG remain: the sole purpose is carrying out the transmission of a communication, or the access is strictly necessary in order to provide a digital service expressly requested by the user.

From this follows the two-stage tracking assessment as soon as terminal equipment is accessed: § 25 TDDDG governs access to the device, Art. 6(1) GDPR the subsequent processing of the data collected in that way. Both levels need their own answer — consent in the banner does not replace the assignment of a legal basis under Art. 6(1) GDPR, which is carried in the documentation of the processing activity as a practice field. In Austria, § 165 TKG 2021 takes the role of § 25 TDDDG and likewise requires opt-in for tracking cookies.

Practical recommendation: a permanently available route for changing the choice made — because withdrawal under Art. 7(3) GDPR must be as easy as giving consent.

3. Profiling (Art. 22)

Art. 22(1) GDPR applies only to decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect them. Ordinary advertising personalisation does not as a rule reach that threshold (only exceptionally, in the case of particularly intrusive targeting) — what matters then is the legal basis under Art. 6(1) GDPR and, for access to the device, § 25 TDDDG. Case law: CJEU, judgment of 4 July 2023, C-252/21 (Meta Platforms and Others v Bundeskartellamt) — information about sensitive characteristics that is inferred or aggregated from other data also falls under Art. 9 GDPR. CJEU, judgment of 4 October 2024, C-446/21 (Schrems v Meta Platforms Ireland) — aggregating personal data without any time limit for personalised advertising infringes Data Minimisation (Art. 5(1)(c) GDPR); Art. 9(2)(e) GDPR is to be interpreted narrowly.

Below the Art. 22 threshold, too, profiling triggers obligations of its own. First, Art. 9(1) GDPR: processing of data revealing, for example, ethnic origin, political opinions or religious or philosophical beliefs, as well as the processing of health data and data concerning sex life or sexual orientation, is prohibited in principle; it is permitted only via an exception in Art. 9(2) GDPR, such as explicit consent. Second, the data protection impact assessment: under Art. 35(1) and (3) GDPR it must be carried out in advance where a type of processing is likely to result in a high risk — expressly named are systematic and extensive evaluation of personal aspects based on profiling with legal effects, and processing on a large scale of special categories under Art. 9 GDPR. Third, the designation of a data protection officer: it is mandatory under Art. 37(1)(b) GDPR where the core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale.

4. Retargeting (pixels and lookalikes)

Meta Pixel, Google Ads tag = Third Country data. Required: a safeguard for the Third Country transfer (see the following paragraph) + consent; where standard contractual clauses are used, supplemented in practice by a transfer impact assessment (TIA).

For documentation, that means three things. First, every tool belongs in the 'transfers to third countries and safeguards' column of the record of processing activities; recipients in third countries need a safeguard — standard contractual clauses (SCC), the EU-US Data Privacy Framework (DPF) or binding corporate rules (BCR). In practical experience, a missing third-country reference for US tools is among the common documentation errors. Second, the role must be clarified before integration: Controller (Art. 4 no. 7 GDPR), Data Processor (Art. 4 no. 8 GDPR) or joint controllers (Art. 26 GDPR). In practical experience, confusing processing on behalf of a controller with joint controllership is a recurring error; the role determines in particular whether a data processing agreement under Art. 28(3) GDPR must be concluded (section 5). Third, § 25(1) TDDDG applies (section 2) to the extent that integrating the pixel stores information in the terminal equipment or reads information already stored — irrespective of how the subsequent processing is justified under Art. 6(1) GDPR.

5. Sharing email marketing data

Mailchimp tracking data, Brevo click tracking — a data processing agreement is required where the provider acts as a processor (role clarification in section 4), plus consent that covers the tracking.

Art. 28(1) GDPR permits cooperation only with processors providing sufficient guarantees of appropriate technical and organisational measures. Art. 28(3) GDPR sets out the minimum content of the contract: the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the Controller. A contract that does not name these points does not satisfy Art. 28(3) GDPR — even if it is labelled a data processing agreement. Conversely, the list is not an exhaustive checklist: it names the minimum content, not every individual provision that a data processing agreement must contain.

The fine range differs depending on which provision is infringed: infringements of Art. 25 to 39 GDPR — and thus of the processor rules under Art. 28 — carry up to EUR 10 million or 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4) GDPR). Infringements of the principles of processing and the conditions for consent (Art. 5, 6, 7 and 9 GDPR) and of the data subject rights (Art. 12 to 22 GDPR) carry up to EUR 20 million or 4 % (Art. 83(5) GDPR). In practical experience, a frequent documentation error is outdated recipient lists: replaced dispatch tools that are still listed in the record of processing activities — or still hold data.

6. Custom audiences from existing customers

Hash upload to Meta/Google: requires consent from existing customers covering the advertising context.

Anyone basing the upload on consent must be able to demonstrate that consent (Art. 7(1) GDPR) — and the upload requires consent that covers the advertising context; consent to receive a newsletter does not automatically cover matching against an advertising platform. Where the uploaded audience reflects sensitive characteristics, the prohibition on processing in Art. 9(1) GDPR applies in addition; under the case law cited in section 3, inferring or aggregating such characteristics from other data is already sufficient for this. For the list itself, the record-of-processing field 'envisaged time limits for erasure' applies per data category — an upload audience without a defined erasure period is a documentation defect.

Practical recommendation: set the upload cycle so that withdrawals take effect before the next matching run, and note the cycle in the record of processing activities.

Data subject rights and deadlines in marketing

Requests from data subjects must be answered without undue delay and at the latest within one month (Art. 12(3) GDPR); the extension mechanics and the other marketing-relevant deadlines are set out in the table. The overview expressly separates statutory requirements from practical recommendations: only the rows with a source reference are statutory requirements, the last row is a practice rhythm without a source reference.

Evidence: what the supervisory authority wants to see first

It starts with the record of processing activities. Order of review in practice (no statutory order): record of processing activities, then data processing agreements, then the concept for the technical and organisational measures, then the data protection impact assessments. For marketing this means: newsletter dispatch, the cookie banner and web analytics are separate processing activities and must each be recorded with their purpose, categories of recipients, transfers to third countries including safeguards, and envisaged erasure period (Art. 30(1) GDPR); the legal basis is not named there, but is carried as a practice field because it follows from Accountability under Art. 5(2) GDPR.

The 250-employee exemption in Art. 30(5) GDPR does not help here: it applies only cumulatively — fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 GDPR or criminal-law data. The statutory text refers to 'a risk', not to a high risk; the 'high risk' threshold applies only to the data protection impact assessment under Art. 35(1) GDPR. A newsletter is regular processing — which means the exemption is effectively used up.

Under Art. 30(4) GDPR, the record must be made available 'on request'. Practical expectation (no statutory deadline): transmission within one to two weeks. The consent evidence under Art. 7(1) GDPR from section 1 is part of the same chain — for each newsletter recipient, it shows what the entry in the record is based on.

Germany and Austria: the provisions that differ

The GDPR requirements are identical in both countries; what differs are the national provisions on advertising emails, on access to terminal equipment, on the obligation to designate a data protection officer, and on the supplementary sanctions.

Germany / Austria: The GDPR articles apply identically in both countries — the consent requirements (Art. 6(1)(a), Art. 7 GDPR) are the same. What differs is national law and supervision: § 25 TDDDG and § 7 UWG are German law; supervision in Germany lies with the state data protection authorities (§ 40(1) BDSG; for federal public bodies, the Federal Commissioner for Data Protection (BfDI), § 9(1) BDSG). In Austria, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) is competent (§ 18(1) DSG); in addition to Art. 83 GDPR, § 62(1) DSG provides for administrative penalties of up to EUR 50,000 — but only subsidiarily, that is, provided the act does not already constitute an offence under Art. 83 GDPR or is not subject to a stricter penalty under other administrative penal provisions, and only for the cases listed there, such as intentionally obtaining unlawful access to a data processing operation or the intentional transfer of data in breach of data secrecy (§ 6 DSG).