What Is GDPR?

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data privacy law, governing how organizations collect, process, and transfer the personal data of EU residents. It requires a valid legal basis, most commonly consent, before personal data can be collected or shared with third parties, including via tracking tags.

GDPR applies based on whose data is being processed, not where the company processing it is based: a US company with EU site visitors is in scope. Its consent requirements are the legal foundation behind CMP banners across the web, and its definition of personal data is notably broad, explicitly including hashed and pseudonymized data (see Anonymization vs. Pseudonymization), which is why hashing an email address before sending it to a tag (see Hashing (Privacy Context)) doesn’t exempt that transmission from GDPR’s requirements.