Consumer privacy rules that shape FMCG data collection

The three regimes, defined

GDPR (General Data Protection Regulation): EU law effective since 2018, enforced by national Data Protection Authorities (DPAs) such as France's CNIL or Ireland's DPC. It applies to any company processing EU residents' personal data, regardless of where the company is based. Core requirement: you need a valid "legal basis" (usually consent or "legitimate interest") before processing.

CCPA (California Consumer Privacy Act, amended by the CPRA, California Privacy Rights Act, effective 2023): gives California residents rights to know, delete, and opt out of the "sale or sharing" of their personal information. Enforced by the California Privacy Protection Agency (CPPA). Unlike GDPR, it's opt-out by default for most data uses, not opt-in.

Cookie-consent rules: in the EU, these stem from the ePrivacy Directive (sometimes called the "cookie law"), which requires prior consent before placing non-essential cookies or trackers, layered on top of GDPR. In the US there's no single federal cookie law, but state laws (California, Colorado, Virginia, Connecticut) increasingly require honoring browser-level opt-out signals like Global Privacy Control (GPC).

What this means for a shampoo brand, concretely

Loyalty apps. Under GDPR, a "join our haircare club" sign-up needs a clear, unticked consent checkbox for marketing emails, separate from the terms-of-service checkbox. Under CCPA, the brand must post a "Do Not Sell or Share My Personal Information" link if it shares loyalty data with ad networks, and must honor GPC signals automatically.

Sampling programs. Collecting a name and address to mail a free conditioner sample is generally low-risk (it's necessary to fulfill the request). But if the sampling form also asks "how often do you color your hair" and feeds that into a marketing segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → model, that's a secondary use requiring its own legal basis under GDPR.

Connected packaging. A QR code linking to a personalization quiz often sits on a third-party web platform using tracking pixels (Meta Pixel, Google Tag). If EU users land there, the ePrivacy rule requires a consent banner before any pixel fires, not after. Many brands fail this by loading the pixel on page load and asking permission a second later.

Building a compliant first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → asset

"First-party dataFirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition →" is data you collect directly from consumers, as opposed to "third-party datathird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.View full definition →" bought from data brokers. Regulators are steadily strangling third-party cookies and broker data (Google has repeatedly delayed but is progressively phasing down third-party cookies in Chrome), so first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → is becoming FMCG's main growth lever. Doing it compliantly means:

• Purpose limitation: state exactly why you're collecting each field ("email for order confirmation," not "email for future use"). GDPR requires this explicitly; it's good practice everywhere.
• Data minimization: don't ask for a scalp photo if a text-based quiz answers the same question. Every unnecessary field is unnecessary legal exposure.
• Consent logging: store timestamp, consent text version, and channel for every opt-in. If a DPA or the CPPA asks "prove this user consented," you need a record, not a memory.
• Retention limits: loyalty data for a discontinued shampoo line shouldn't sit in your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → for five years "just in case." GDPR requires a defined retention period tied to purpose.

A simple internal audit script might flag stale or unjustified data:

This kind of check should run quarterly, not once at launch.

Practical checks and audits to run

Before any campaign involving a loyalty app, sample form, or QR-linked landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition →, run these checks:

1. Consent audit: does the consent flow separate "necessary" processing from "marketing" and "analytics"? Is it opt-in (GDPR) where required, and does it honor opt-out signals like GPC (US states)?

2. Data mapping: trace every field collected to a named purpose and named system it flows into (CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, ad platform, analytics tool). Unmapped fields are the most common audit failure.

3. Vendor check: if a third-party agency runs your sampling site, confirm a Data Processing Agreement (DPA, a GDPR-required contract governing how processors handle data on your behalf) is signed.

4. Cross-border transfer check: if EU consumer data flows to a US-based marketing cloud, confirm a valid transfer mechanism (Standard Contractual Clauses, or reliance on the EU-US Data Privacy Framework, adopted in 2023) is in place.

5. Children's data flag: family-size or "products for kids" campaigns must screen for under-13 (US, under COPPA, the Children's Online Privacy Protection Act) or under-16 (GDPR default, though some EU states set 13) data, which needs parental consent.

For a practical starting reference, the UK Information Commissioner's Office publishes a clear, free guide to consent under GDPR that's usable well beyond the UK.

Key Takeaways

• GDPR (EU, opt-in by default) and CCPA/CPRA (California, opt-out by default) impose different default postures. Design consent flows for the stricter one (GDPR) to stay safe globally.
• Cookie-consent rules (EU ePrivacy Directive, US state-level GPC requirements) govern trackers separately from the main privacy law, and are the most commonly mis-implemented piece on QR-code landing pages.
• Loyalty apps, sampling forms, and connected packaging are FMCG's main first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → channels, and each carries distinct legal-basis and minimization obligations.
• Run recurring audits, not one-time launch checks: consent logs, data maps, vendor DPAs, and cross-border transfer mechanisms all need periodic review.
• Third-party cookies and broker data are declining in usefulness and legality, making compliant first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → collection the durable strategic asset for FMCG brands.