Consumer privacy rules that shape FMCG data collection

# Consumer privacy rules that shape FMCG data collection

A shopper scans a QR code on a shampoo bottle to unlock a "hair quiz," enters her email, skin type, and a photo of her scalp. That single interaction touches at least three legal regimes at once: GDPR in Europe, CCPA in California, and a cookie-consent rule if the quiz sits on a tracked webpage. Get any one of them wrong and the brand's shiny new "connected packaging" campaign becomes a regulatory liability, not a data asset.

This lesson walks through the rules that actually bind FMCG (fast-moving consumer goods, meaning low-cost, frequently repurchased products like shampoo, snacks, or detergent) data teams, and the checks you run before launch.

Why FMCG is a special case

FMCG brands historically had almost no first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète →. You sell shampoo through a retailer like Walmart or Carrefour, and the retailer, not the brand, owns the checkout relationship. Loyalty apps, sampling programs, and smart packaging (QR codes, NFC chips) exist precisely to close that gap by collecting data directly from consumers.

That direct collection is exactly what privacy law scrutinizes hardest: it's consumer-initiated, often includes sensitive-adjacent data (skin conditions, allergies, family size), and frequently happens on mobile, where consent mechanics are stricter.

The three regimes, defined

GDPR (General Data Protection Regulation): EU law effective since 2018, enforced by national Data Protection Authorities (DPAs) such as France's CNIL or Ireland's DPC. It applies to any company processing EU residents' personal data, regardless of where the company is based. Core requirement: you need a valid "legal basis" (usually consent or "legitimate interest") before processing.

CCPA (California Consumer Privacy Act, amended by the CPRA, California Privacy Rights Act, effective 2023): gives California residents rights to know, delete, and opt out of the "sale or sharing" of their personal information. Enforced by the California Privacy Protection Agency (CPPA). Unlike GDPR, it's opt-out by default for most data uses, not opt-in.

Cookie-consent rules: in the EU, these stem from the ePrivacy Directive (sometimes called the "cookie law"), which requires prior consent before placing non-essential cookies or trackers, layered on top of GDPR. In the US there's no single federal cookie law, but state laws (California, Colorado, Virginia, Connecticut) increasingly require honoring browser-level opt-out signals like Global Privacy Control (GPC).

What this means for a shampoo brand, concretely

Loyalty apps. Under GDPR, a "join our haircare club" sign-up needs a clear, unticked consent checkbox for marketing emails, separate from the terms-of-service checkbox. Under CCPA, the brand must post a "Do Not Sell or Share My Personal Information" link if it shares loyalty data with ad networks, and must honor GPC signals automatically.

Sampling programs. Collecting a name and address to mail a free conditioner sample is generally low-risk (it's necessary to fulfill the request). But if the sampling form also asks "how often do you color your hair" and feeds that into a marketing segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.Voir la définition complète → model, that's a secondary use requiring its own legal basis under GDPR.

Connected packaging. A QR code linking to a personalization quiz often sits on a third-party web platform using tracking pixels (Meta Pixel, Google Tag). If EU users land there, the ePrivacy rule requires a consent banner before any pixel fires, not after. Many brands fail this by loading the pixel on page load and asking permission a second later.

Building a compliant first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète → asset

"First-party dataFirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète →" is data you collect directly from consumers, as opposed to "third-party datathird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.Voir la définition complète →" bought from data brokers. Regulators are steadily strangling third-party cookies and broker data (Google has repeatedly delayed but is progressively phasing down third-party cookies in Chrome), so first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source. is becoming FMCG's main growth lever. Doing it compliantly means:

• Purpose limitation: state exactly why you're collecting each field ("email for order confirmation," not "email for future use"). GDPR requires this explicitly; it's good practice everywhere.
• Data minimization: don't ask for a scalp photo if a text-based quiz answers the same question. Every unnecessary field is unnecessary legal exposure.
• Consent logging: store timestamp, consent text version, and channel for every opt-in. If a DPA or the CPPA asks "prove this user consented," you need a record, not a memory.
• Retention limits: loyalty data for a discontinued shampoo line shouldn't sit in your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → for five years "just in case." GDPR requires a defined retention period tied to purpose.

A simple internal audit script might flag stale or unjustified data:

# Flag loyalty records with no activity and no documented retention reason
import pandas as pd

df = pd.read_csv("loyalty_members.csv")
cutoff = pd.Timestamp.now() - pd.DateOffset(years=2)

stale = df[
    (pd.to_datetime(df["last_activity"]) < cutoff) &
    (df["retention_justification"].isna())
]

print(f"{len(stale)} records flagged for deletion review")

This kind of check should run quarterly, not once at launch.

Practical checks and audits to run

Before any campaign involving a loyalty app, sample form, or QR-linked landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.Voir la définition complète →, run these checks:

1. Consent audit: does the consent flow separate "necessary" processing from "marketing" and "analytics"? Is it opt-in (GDPR) where required, and does it honor opt-out signals like GPC (US states)?

2. Data mapping: trace every field collected to a named purpose and named system it flows into (CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, ad platform, analytics tool). Unmapped fields are the most common audit failure.

3. Vendor check