---
title: "GDPR and advertising: consent, cookies and CMP in 2026"
description: "How the GDPR frames online advertising: consent, cookies, CMP, first-party data. What advertisers must respect in 2026."
url: "https://publicitefrance.com/en/blog/rgpd-publicite-consentement/"
lang: en
translated_from: "https://publicitefrance.com/blog/rgpd-publicite-consentement/"
category: "Regulation"
publisher: "PubliCité France"
updated: "2026-08-02"
keywords: ["GDPR advertising", "cookie consent", "CMP", "personal data advertising"]
disclaimer: "Informational content, not legal advice."
---

# GDPR and advertising: consent, cookies and CMP in 2026

**In short:** the GDPR (2016) and cookie rules strictly frame online advertising. The key principle: no advertising tracking without the user's **freely given, informed, prior consent**.

## What the GDPR changes for advertising
Digital advertising relies heavily on personal data (targeting, retargeting, measurement). The GDPR requires a legal basis to process this data — most often **consent** for ad targeting. In practice: no advertising cookies or tracking before the user has said yes.

## The role of the CMP
The **CMP** (Consent Management Platform) collects and manages consent (the cookie banner). It must allow accepting, refusing just as easily, and configuring. Poorly collected consent exposes you to sanctions and skews measurement.

## Towards a "cookieless" world
With the phase-out of third-party cookies, advertisers turn to **first-party data** (collected directly, with consent), alternative IDs, and contextual approaches. Compliance becomes an advantage: better collection means better measurement.

## Best practices
- Clear banner: refusing must be as easy as accepting.
- Don't fire trackers before consent.
- Document consents (proof).
- Favour first-party data and data minimisation.

## FAQ
**Is consent required for all cookies?**
No: strictly necessary cookies are exempt. Non-exempt advertising and measurement cookies require consent.

**What does a non-compliant advertiser risk?**
Sanctions from the data protection authority, plus skewed measurement and lost trust.

**Does cookieless mean the end of targeting?**
No, but it shifts targeting towards first-party data, alternative IDs and contextual.

---
*PubliCité France — blog, Regulation. Informational content, not legal advice; consult a professional (DPO/lawyer) for any specific case. French version: /blog/rgpd-publicite-consentement/*