The EU regulation requiring an opt-in legal basis, most often consent, before a company can process personal data, including for personalized ad targeting.
The General Data Protection Regulation (GDPR) is the EU law that requires a lawful basis, most commonly opt-in consent, before any company can process an EU resident's personal data. For advertising, that means personalized ad targeting needs an affirmative opt-in. It cannot run on an opt-out default.
Any platform serving EU users personalized ads, from Meta to ChatGPT, has to build a consent flow that satisfies GDPR before it can use behavioral or purchase-intent signal. Platforms that skip the opt-in and default straight to personalization are exposed to enforcement from national data protection authorities.
GDPR sets the floor for what any advertiser can target in the EU. Miss the consent requirement and a campaign is not just a compliance risk, it is a targeting risk: non-compliant personalization gets shut down or fined, and the fallback is usually a thinner, contextual-only version of the same audience.
