{"id":264,"date":"2019-05-22T00:00:00","date_gmt":"2019-05-21T22:00:00","guid":{"rendered":"https:\/\/stage.usercentrics.com\/knowledge-hub\/users-consent-retargeting\/"},"modified":"2025-06-24T10:41:51","modified_gmt":"2025-06-24T08:41:51","slug":"users-consent-retargeting","status":"publish","type":"knowledge","link":"https:\/\/usercentrics-poc.psapp.dev\/us\/knowledge-hub\/users-consent-retargeting\/","title":{"rendered":"Do I need a user’s consent for retargeting?"},"content":{"rendered":"

What is retargeting?<\/h2>\nWith retargeting, a user\u2019s browser history is analyzed to address the user with products that he\/she showed interest in before.\n\nBecause of a personalized address, retargeting campaigns are extremely effective to bring back former website visitors and turn them into lucrative recurring customers.\n\nBut retargeting only works on the basis of user and behavioral data, which are generated through tracking cookies.\n

The GDPR and retargeting<\/h2>\nRetargeting uses the personal data that is obtained and processed by cookies.\n\nThis usually includes the IP-address, which has already been classified by the German Courts as personal data to the GDPR.\n\nFurthermore the usage behavior of the website visitor, e.g. which products the visitor looks at, which landing pages the user visits, where he\/she clicks, will be captured.\n\nIn addition, the online behavior outside a website can be enriched with these data, so that a user profile can be generated.\n\nFor obtaining and processing these data, the GDPR<\/a> requires a legal basis according to Article 6 GDPR, e.g. obtaining a consent.\n

Justified interest or consent for retargeting?<\/h2>\nThe question, whether retargeting can be based on justified interest (Article 6 (1f) GDPR) or on the user\u2019s consent (Article 6 (1a) GDPR) is controversial.\n\nTo prove “justified interest” in accordance with article 6 (1f) GDPR the company has to be able to proof a corresponding balance of interests in favor of their own economic interests against the data protection interests of the users.\n\nThis is because comprehensive profiling and the \u201ctracking\u201d of a user with products, that he\/she looked at on several websites, is hard to justify.\n\nAs a yardstick the GDPR takes what the average user could expect.\nThe majority of privacy advocates, especially data protection authorities, clearly see the consent as a prerequisite for retargeting with tracking cookies. Large providers of retargeting technologies such as Google and Facebook are in favor of unambiguous consent as the basis for retargeting and also stipulate this in their terms of contract.\n\nWhen providing consent, it must be ensured that all the criteria for a valid consent pursuant to the GDPR are met.\n

Consents for Google Remarketing Services<\/h2>\nThe biggest provider of remarketing services (e.g. Google Ads, Google Remarketing) is Google – which means that Google sets the tone when it comes to the implementation of the GDPR.\n\nGoogle describes in its EU standard for consents<\/em>, that advertisers need to obtain and proof the legally watertight consent for their advertising services, especially retargeting.\n\nThat means that all Google Ads customers have the duty to obtain the explicit and freely given consent of their website visitors before Google Ads cookies collect data for personalized retargeting advertising.\n\nAdvertisers have no long-term choice but to fulfill all criteria, if they would like to profit from and use Google Tools.\n\nIn the future, Google will demand the consent to be obtained from the advertisers not only legally but also programmatically: Google has once again confirmed its agreement to join the IAB Transparency & Consent Framework<\/a>.\n

Consent for Retargeting on Social Media Channels like Facebook, LinkedIn, Twitter, etc.<\/h2>\nUnique cases exist such as if the advertiser happens to use a special pixel or cookie from a social media channel such as the Facebook Pixel and displays its website visitors with personalized advertisement.\n\nAccording to Article 6 (1) GDPR, this will cause legal issues seeing as in order to use retargeting and personalization, explicit consent is necessary.\n\nTherefore, the advertiser has to obtain consent from users in a freely, informed, and explicit, manner when using data for Facebook.\n\nAlthough, the user may indeed have given – deeply buried within the terms and conditions – consent to create a profile through the data which he\/she has provided and which is being collected by pixels on external sites, it must be noted that this type of consent does not comply with the DSGVO.\n\nStill, these cookies and pixels collect data from all visitors. Even those who do not have an account with a social network.\n\nIncidentally, this consent can not be extended to all advertisers who may advertise on social networks such as Facebook.\n\nIn this regards, Facebook Custom Audiences is strongly condemned by authorities and courts and is only possible with the consent of the user.\n

Facebook requires the consent<\/h3>\nSimilar to Google, Facebook states in its “Policy for Consent to Developers\u201d<\/a> that advertisers who have Facebook Pixel installed on their website or in their app must be able to obtain and prove their users’ consent.\n

Consent for retargeting with AdTech technologies like Criteo<\/h2>\nConsent for retargeting with AdTech technologies like Criteo.\nCriteo itself does not stipulate in their terms and conditions that one must obtain consent.\n\nThus, it is up to the advertiser to decide if he or she sees the requirements for legitimate interest.\n\nAs stated above, there lacks a strong basis of argumentation under the GDPR. The interests of the person concerned predominate regularly.\n

Result: Retargeting is only possible with given consent.<\/h2>\nSources and related links:\n