In short
The General Data Protection Regulation is the European Union’s data protection law, in force since 2018. For marketers it governs the legal basis for processing personal data, the standard consent must meet, the rights data subjects hold over their information, and the rules for transferring data outside the EU. In an advertising context, GDPR is the reason a consent signal must travel with every marketing event that touches EEA users, and the reason hashed identifiers cannot be sent to a platform if the user has not permitted that use. It does not ban first-party data activation; it requires that activation rest on a lawful basis, usually consent, and that the basis be recorded and honored downstream. The compliance requirement and the measurement design are therefore the same problem: a pipeline that carries consent per event and enforces it at each destination satisfies GDPR and preserves the signal from consenting users at the same time.
What it means for an ad stack
Consent must be captured with a valid legal basis, recorded, and enforced everywhere an event travels, including server-side pipelines. Hashing identifiers does not remove GDPR obligations; hashed email is still personal data.
The practical test
If a user withdraws consent, does delivery to every downstream platform stop without manual cleanup? Stacks that pass that test also pass audits.
How does a GDPR-compliant stack still measure?
A retailer running EEA campaigns captures consent through its CMP and passes it with every event via Consent Mode. Events from users who declined ad use are withheld from ad platforms, while consenting users’ events flow through, so the stack stays compliant and still measures.
Reference: EUR-Lex, official GDPR text