GDPR and advertising: consent, cookies and CMP in 2026
In short: the GDPR (2016) and cookie rules strictly frame online advertising. The key principle: no advertising tracking without the user’s freely given, informed, prior consent.
What the GDPR changes for advertising
Digital advertising relies heavily on personal data (targeting, retargeting, measurement). The GDPR requires a legal basis to process this data — most often consent for ad targeting. In practice: no advertising cookies or tracking before the user has said yes.
The role of the CMP
The CMP (Consent Management Platform) collects and manages consent (the cookie banner). It must allow accepting, refusing just as easily, and configuring. Poorly collected consent exposes you to sanctions and skews measurement.
Towards a “cookieless” world
With the phase-out of third-party cookies, advertisers turn to first-party data (collected directly, with consent), alternative IDs, and contextual approaches. Compliance becomes an advantage: better collection means better measurement.
Best practices
- Clear banner: refusing must be as easy as accepting.
- Don’t fire trackers before consent.
- Document consents (proof).
- Favour first-party data and data minimisation.
FAQ
Is consent required for all cookies? No: strictly necessary cookies are exempt. Non-exempt advertising and measurement cookies require consent.
What does a non-compliant advertiser risk? Sanctions from the data protection authority, plus skewed measurement and lost trust.
Does cookieless mean the end of targeting? No, but it shifts targeting towards first-party data, alternative IDs and contextual.
PubliCité France — blog, Regulation. Informational content, not legal advice; consult a professional (DPO/lawyer) for any specific case. French version: /blog/rgpd-publicite-consentement/