What the EU's privacy rules actually changed for advertisers
Jun 22, 2026 · WinzeeDigital
The General Data Protection Regulation became enforceable in 2018. For most advertisers, the practical impact was manageable: cookie consent banners appeared, some remarketing audience sizes declined, and campaign managers adapted targeting strategies to account for smaller cookied pools. Eight years later, the landscape looks significantly different — and not primarily because the rules changed.
Enforcement has intensified. The DPA fines issued in 2025 and 2026 represent a step change in regulatory appetite, particularly for retargeting practices, consent management platforms that default to opt-in, and cross-border data transfers that cannot demonstrate an adequate legal basis. Brands that set up a consent banner in 2018 and considered the compliance work done are now discovering that the enforcement environment has caught up with the letter of the law.
What changed in practice for paid media
The largest practical impact has been on measurement. With browser-level tracking declining and consent rates on many European sites running below 60%, the data that feeds automated bidding algorithms is noisier than it was three years ago. Performance Max campaigns that used to self-optimise confidently are now operating on partial signal, which means human oversight of budget pacing and placement exclusions matters more.
The brands navigating this most effectively are investing in server-side tagging and conversion APIs to preserve first-party signal in a compliant way, building larger first-party audiences through genuine value exchange, and shifting measurement frameworks toward modelled conversions and incrementality testing rather than last-click attribution. The advertisers who are struggling are those still relying on third-party audience segments and cross-site retargeting pools that regulators have clearly signalled are at risk.
What to do now
The brands best positioned for the next phase of European digital advertising are those that have built first-party data infrastructure, use consent management platforms that default to explicit opt-in, and have tested their measurement frameworks against partial-consent scenarios. The compliance work and the performance marketing work are, increasingly, the same work.