How can you ensure your display ads comply with GDPR?

First, why is this about display ads? Are you really using them still? For what? Second, it isn't hard to be GDPR compliant. It's about consent and responsible use of data. Same with CCPA. Start with the platforms you are using. Rely on your first party data and your data security and follow the rules. No issue if you don't try to cheat the rules.

General Data Protection Regulation (GDPR) is a European Union law that was implemented May 25, 2018 and replaced the 1995 Data Protection Directive. Organizations must safeguard personal data and uphold privacy rights of anyone in EU territory. Any organization that processes personal data belonging to any people in the EU must comply with the GDPR. Authorities can also issue sanctions, such as bans on data processing or public reprimands and there's a maximum penalty is €20 million or 4% of global revenue, whichever is higher. Complying looks like, using data protection impact assessment, following the principles of "data protection by design and by default," and appointing a Data Protection Officer if necessary.

Understanding the scope of GDPR and its impact on an organization involves: Familiarize yourself with the key aspects of GDPR, such as data protection, consent, and individuals' rights Understand how your organization collects, stores, and uses personal data) Determine where your data practices need changes to comply with GDPR. Ensure proper security measures are in place to safeguard personal data. Train your team on GDPR compliance and their roles in maintaining it. Keep up-to-date with any changes or updates to GDPR regulations.

In my opinion, if your display banners do not involve placing cookies or engage in any form of personal data processing, such as tracking users across sites, behavioral targeting, or collecting identifiers, then GDPR consent is not a requirement for the banners themselves. This perspective aligns with the core principles of GDPR, which emphasize the protection of personal data. The absence of such data processing activities in your banners effectively places them outside the scope of GDPR's consent requirements.

To obtain valid consent under GDPR, you should: Clearly explain what you're asking consent for, including the type of data you'll collect and how you'll use it. Ensure consent requests are separate from other terms and conditions, making them easily noticeable. Consent must be a voluntary and genuine choice, with no pressure or consequences for not consenting. Make it simple for individuals to withdraw their consent at any time. Keep records of when and how consent was given, to demonstrate compliance. Ensure mechanisms to verify the age of individuals, especially if you're collecting data from children.

As a brand leader advertising, emailing, and communicating across global markets for regulated products it is critical to be educated on the GDPR requirements through the variety of sources accessible to us as professionals. I have found it is especially helpful to protect your brand by partnering with the right third-party consent vendors coupled with your media buying agencies to ensure your advertising outreach is consistent with evolving market standards. It is more challenging when all aspects of this are in-house due to the ever changing requirements across each distinct market.

Super important make sure to ask for their GDPR compliance policies or certifications. Reliable partners should have clear documentation outlining their compliance measures. Also make sure any agreements clearly state how they handle data, including data processing, storage, and security measures.

Summary of GDPR User Data Privacy Rights - Transparency about how data is being used - Security Requirements for storing "information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person." - Ability to request that data be deleted or corrected for accuracy - To object and restrict to data processing - To have their data provided in a transferrable standard format

Under GDPR, people have the right to know and control their data, like they'd control who enters their house. Imagine someone asks, "Hey, what info do you have on me?" Just like showing a guest around, you let them see their data. If they find something wrong, it's like a spill on the carpet - you clean it up, or in data terms, rectify it. And if they want to take their data and leave, like taking back a borrowed book, you make it easy for them. It's all about treating people's data like something valuable they've entrusted to you.

Continuous monitoring is key and an excellent way to ensure long-term compliance. Using a third-party company for ongoing scanning allows website owners to audit what page elements are deploying on their customers, such as tracking cookies and JavaScript.

Best way to keep up to date with GDPR compliance laws is to subscribe to newsletters from reliable sources like data protection agencies or legal experts. Also, join forums or LinkedIn groups where professionals chat about GDPR. It's a simple way to stay in the loop and drive your compliance efforts smoothly.

Try to understand how online advertising platforms work. Often, we're talking about an ecosystem almost like a black box where one player controls all aspects of the advertising chain, from identifying the target audience to displaying the advertisement, from obtaining consent to subsequent management of it. It's important to understand that sometimes, no matter how much you'd like to have all the data of the targeting, delivery, or monitoring process, it's almost impossible to obtain them. In that case, it might be more useful to prioritize the idea of compliance over delivering ads at any cost. After all, the risk you assume could end up turning against you.

The biggest mistakes people make with GDPR compliance include: 1. Misjudging the extent to which GDPR applies to their data practices, including not realizing it applies to data processed outside the EU for EU citizens. 2. Employees not being adequately trained or aware of GDPR requirements, leading to potential breaches. 3. Not obtaining clear, specific, and voluntary consent for data processing. 4. Failing to have proper data inventory and management practices, leading to data misuse or loss. 5. Not respecting individuals' rights under GDPR, like the right to access, rectify, or erase their data. 6. Not implementing sufficient security measures to protect personal data from breaches.

Ensuring that your display ads comply with GDPR involves implementing a robust consent management system. Clearly inform users about the data being collected and its purpose, providing an easy option to give or withdraw consent. Use data minimization principles, collecting only what is necessary for the intended purpose. Regularly update your privacy policy to reflect current data practices. Work with GDPR-compliant ad platforms and service providers. Conduct periodic audits of your ad campaigns to ensure ongoing compliance. Train your marketing team on GDPR requirements and best practices. This proactive approach protects user data privacy and maintains trust, while keeping your ad practices in line with legal obligations.