Privacy and data law: the rules behind targeted ads and personalization

GDPR: consent as the default posture

GDPR applies to any company processing personal data of people in the EU, regardless of where the company is headquartered. It is enforced by national Data Protection Authorities (DPAs), coordinated loosely through the European Data Protection Board.

For a recommendation engine, GDPR forces two structural choices:

1. Legal basis for processing. Companies must pick a justification under Article 6, most commonly "consent" or "legitimate interest." Personalization based on inferred traits (mood, political leaning, health-adjacent viewing habits) usually needs explicit consent, not just legitimate interest, because it can produce sensitive inferences.

2. Data minimization. Only collect what the personalization actually needs. A music app cannot justify pulling contact lists for a recommendation feature it doesn't use.

GDPR also grants individuals the right to access, rectify, erase, and port their data, plus the right to object to profiling used for direct marketing (Article 21). A subscriber can demand Netflix explain, in broad terms, why an algorithm recommended a given genre, and can opt out of ad-based profiling entirely.

Fines are structured to be painful at scale: up to €20 million or 4% of global annual revenue, whichever is higher. Meta has faced some of the largest penalties under GDPR, including a €1.2 billion fine from Ireland's Data Protection Commission in 2023 over EU-to-US data transfers, per the Irish DPC's public decisions.

CCPA/CPRA: opt-out, not opt-in

California's approach is structurally different from GDPR. Instead of requiring consent upfront, CCPA (as strengthened by CPRA in 2023) gives consumers the right to opt out of the "sale or sharing" of their personal information, a category interpreted broadly enough to include most behavioral advertising.

This is why nearly every US media site now shows a "Do Not Sell or Share My Personal Information" link, often built as a standardized signal called Global Privacy Control (GPC), which browsers send automatically to tell sites to stop sharing data.

CPRA created a dedicated regulator, the California Privacy Protection Agency (CPPA), the first US agency built specifically for privacy enforcement. It also added a category of "sensitive personal information" (precise geolocation, sexual orientation, etc.) that requires an explicit opt-in limit on use, closer to GDPR's stricter posture.

Other states have followed with their own laws (Virginia's VCDPA, Colorado's CPACPACost Per Acquisition: the total cost to generate one customer or conversion, computed by dividing total spend by the number of acquisitions.View full definition →, and others), each with slightly different thresholds, so compliance teams typically build to the strictest common denominator rather than maintaining fifty state-specific flows.

COPPA: the bright line around minors

COPPA is narrower but stricter: it applies to any online service that is directed at children under 13, or that has actual knowledge it is collecting data from a child under 13. It is enforced by the FTC, and violations can trigger civil penalties per violation, adjusted periodically (as of the FTC's most recent inflation adjustments, penalties can run over $50,000 per violation, and companies with millions of child users can face totals in the hundreds of millions).

For ad networks and streaming platforms, COPPA forces concrete engineering decisions:

• Age gating. Services likely to attract children (kids' content hubs, cartoon-heavy catalogs) must ask age at signup and route under-13 users into a restricted experience.
• Verifiable parental consent. Before collecting personal data from a child, the platform needs a mechanism, credit card verification, signed consent forms, or knowledge-based verification, to confirm a parent authorized it.
• No behavioral advertising to known children. This is the exact failure in the YouTube case: channels clearly aimed at kids were still being profiled for ad targeting.

The practical result: YouTube now requires creators to mark content "made for kids," which automatically disables personalized ads and comments on that content, a direct structural response to the FTC settlement, documented on the FTC's case page.

What compliance teams actually build

Strip away the legal language and three regimes converge on similar engineering artifacts:

• Consent Management Platforms (CMPs): the cookie banners and preference centers that log what a user agreed to, timestamped, auditable, and tied to a legal basis.
• Data mapping and inventories: a live record of what personal data is collected, where it flows (including to ad exchanges), and how long it's retained.
• Age assurance layers: signup flows that segment users by age band before any personalization logic runs.
• Opt-out signal handling: automated pipelines that read GPC signals or account settings and suppress data sharing to ad partners in near real time.

A simplified version of what a consent check might look like before an ad request fires:

This is deliberately simplified, but it reflects the real logic: region and age determine which rule fires, and the system defaults to restriction when signals are missing or conflicting.

Where the three laws create friction

They don't align neatly. GDPR assumes opt-in by default; CCPA assumes opt-out. COPPA cares only about age, not geography. A global platform ends up running parallel compliance logic: an EU user sees a consent wall before any tracking starts, a California user sees a passive opt-out link, and any user flagged as a child anywhere sees no behavioral ads at all, regardless of region.

This is also why "personalization" and "advertising" are often split internally. Many platforms use first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → (what you watched on their own service) for recommendations under a broader legitimate-interest or product-necessity basis, while walling off third-party ad targeting behind stricter, separate consent, because regulators and courts treat the two uses very differently in terms of risk.

Key Takeaways

• GDPR requires opt-in consent for most personalization and ad targeting in the EU, backed by fines up to 4% of global revenue; enforcement runs through national DPAs.
• CCPA/CPRA gives US consumers an opt-out right, not a consent requirement, enforced by California's dedicated CPPA, with other states adopting similar but non-identical frameworks.
• COPPA sets a hard line at age 13: no behavioral advertising or unconsented data collection from known children, enforced by the FTC with per-violation penalties that scale into the hundreds of millions for major platforms.
• Compliance in practice means building consent management platforms, data inventories, and age-gating logic that route users into different data-handling paths based on region and age, not a single global policy.
• Personalization (first-party recommendations) and advertising (third-party targeting) are increasingly treated as legally distinct activities requiring separate consent and data-handling logic.