Insight

GDPR Implications for Retargeted Advertising / Remarketing

By Eamonn O’Raghallaigh First published 19 Mar 2023 Reviewed 22 August 2026 5 minute read

In brief

Retargeting normally depends on online tracking, identifiers and profiling, so marketers must assess both ePrivacy/cookie requirements and GDPR obligations. In Ireland, non-essential tracking technologies generally require valid consent; organisations also need transparent notices, data minimisation, appropriate processor arrangements, secure audience handling and a clear way for people to withdraw or object.

Separate cookie/ePrivacy requirements from the GDPR lawful-basis assessment.
Do not treat acceptance of a service contract as permission for behavioural advertising.
Minimise audience data and avoid sensitive or unexpectedly intimate targeting.
Document platform roles, retention, matching and suppression processes.
Legal and data-protection review is required for material implementation decisions.

Author’s update — August 2026

I have revisited retargeting because consent interfaces and advertising technology have changed, but the underlying legal questions remain distinct. Cookie and ePrivacy requirements must be considered alongside the GDPR lawful basis; agreeing to receive a service does not automatically authorise behavioural advertising. Organisations should be able to explain what data is used, by whom and for what purpose.

Introduction

The GDPR aims to protect EU citizens’ personal data, requiring companies to obtain explicit consent before collecting and processing personal data for retargeting advertising purposes.

Key Takeaways:

Retargeting advertising relies on cookies and tracking technologies to gather consumer data and deliver customised ads, but the GDPR has made it more challenging to use personal data in this manner.
Securing explicit consent is difficult, as many consumers may not understand the implications or may be unwilling to provide consent, reducing the effectiveness of retargeting campaigns.
The GDPR grants consumers the rights to access, rectify, erase, and restrict the processing of their personal data, which can negatively impact retargeting advertising as consumers can opt out of data usage for this purpose.
Apple’s Safari Intelligent Tracking Prevention (ITP) also poses a challenge, as it blocks third-party cookies, further hindering retargeting advertising efforts.
Companies may need to explore alternative methods for delivering targeted ads and maintaining consumer profiles to continue being effective in a GDPR-regulated landscape.

Retargeting now depends on lawful and proportionate data use

Retargeting remains possible, but the legal and technical context has become more fragmented. Consent requirements, profiling rules, browser controls, platform restrictions and the organisation’s own data practices all shape what can be done. A platform feature or consent-mode setting does not replace the need for a valid legal basis, clear information and proportionate processing.

The most resilient approach is to reduce unnecessary data collection, strengthen first-party relationships, keep audience logic transparent and design measurement that can still support decisions when identifiers or platform signals are limited.

Retargeted Advertising

Retargeting advertising, commonly referred to as remarketing, entails the use of cookies and other tracking technologies by companies to accumulate data on consumers’ online behaviour, including website visits and product views. Subsequently, this data is employed to present tailored ads to consumers on other websites they browse.

In accordance with the GDPR, companies are obligated to obtain unambiguous consent from consumers prior to the collection and usage of their personal data for retargeting advertising purposes. Consequently, consumers must be duly informed about the intended use of their data and actively consent to their data being gathered and used in this manner.

Securing explicit consent poses a considerable challenge for companies that depend on retargeting advertising. Owing to a lack of understanding regarding the implications of providing consent or an unwillingness to do so, many consumers may withhold consent. This impedes companies’ ability to deliver targeted ads, consequently diminishing the effectiveness of retargeting campaigns.

Furthermore, the GDPR accords consumers the rights to access, rectify, erase, and restrict the processing of their personal data. In essence, consumers can demand the deletion of their personal data or the restriction of its use. These rights can also adversely affect retargeting advertising, as they enable consumers to opt out of data usage for this specific purpose. The resulting difficulty in constructing and maintaining precise consumer profiles, which are crucial for delivering targeted ads, further compromises retargeting advertising efficacy.

Browser and platform restrictions

Another challenge is that Apple now blocks most advertising cookies. Apple released a major update to its Safari Intelligent Tracking Prevention (ITP), which is a privacy feature that allows the company’s web browser to block cookies and prevent advertisers from snooping on your web habits. According to Apple’s John Wilander, the WebKit engineer behind the feature, Safari now blocks all third-party cookies.

GDPR has significantly influenced the effectiveness of retargeting advertising. While the regulation’s primary objective is to protect the privacy of EU citizens, it has concurrently rendered the utilization of personal data for retargeting purposes more challenging for companies. Consequently, businesses may need to explore alternative methods for delivering targeted ads and for creating and maintaining consumer profiles in order to sustain effectiveness in this domain.

Sources and references

About the author

Eamonn O’Raghallaigh, PhD, is Managing Director at Digital Strategy Consultants and a Teaching Fellow in Digital Marketing & AI at Trinity Business School where he teaches on the MSc in Digital Marketing Strategy and Executive Education programmes.

Need a clearer view of digital performance?

Book a strategy call

Related insights

IAB TCF in 2026: What Webmasters and Marketers Need to Know

The IAB Europe Transparency and Consent Framework is a maintained industry framework, not a legal safe harbour. In 2026, publishers should use the current policy and technical documents, verify their CMP and vendor configuration, test consent behaviour and retain independent GDPR and ePrivacy accountability.

Ethical Considerations of Personalisation in Marketing

Responsible personalisation begins with a legitimate customer purpose and the minimum data required to achieve it. Organisations should be transparent about data use, respect consent and objections, avoid sensitive or unexpectedly intimate inferences, test whether the experience feels helpful rather than manipulative, and retain meaningful human accountability for consequential decisions.