| name | marketing-analytics-dpia |
| title | Assessing Marketing Analytics Privacy |
| description | Guides DPIA for marketing profiling, behavioural targeting, cross-device tracking, and advertising analytics. Covers ePrivacy Directive Art. 5(3) cookie consent, PECR regulations, legitimate interest balancing for direct marketing, and adtech processing chain assessment. Keywords: marketing analytics, DPIA, profiling, behavioural targeting, cross-device tracking, ePrivacy, PECR, adtech, legitimate interest. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/marketing-analytics-dpia |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Assessing Marketing Analytics Privacy
Overview
Marketing analytics processing — including customer profiling, behavioural targeting, cross-device tracking, programmatic advertising, and conversion attribution — triggers multiple DPIA criteria under WP248rev.01: evaluation/scoring (C1), systematic monitoring (C3), matching or combining datasets (C6), and potentially innovative technology (C8). This skill provides a DPIA methodology for marketing analytics processing, integrating GDPR obligations with ePrivacy Directive requirements for cookie-based tracking and PECR compliance for UK-based operations.
Legal Framework
GDPR Provisions for Marketing Analytics
- Art. 5(1)(b) Purpose limitation: Marketing data collected for one purpose cannot be repurposed for incompatible marketing without further lawful basis.
- Art. 6(1)(a) Consent: Required for most marketing profiling; must be freely given, specific, informed, and unambiguous.
- Art. 6(1)(f) Legitimate interest: May apply to direct marketing to existing customers (Recital 47) but requires balancing test for profiling.
- Art. 21(2)-(3) Right to object: Data subjects have an absolute right to object to processing for direct marketing purposes, including profiling related to direct marketing.
- Art. 22 Automated decision-making: Profiling that produces legal or similarly significant effects requires Art. 22(2) exception and Art. 22(3) safeguards.
ePrivacy Directive (2002/58/EC) Art. 5(3)
Storing or accessing information on a user's terminal equipment (cookies, device fingerprinting, local storage) requires:
- Clear and comprehensive information about the purposes
- Consent of the user (interpreted per GDPR standard: freely given, specific, informed, unambiguous)
- Exception: strictly necessary cookies for the service explicitly requested by the user
PECR (UK Privacy and Electronic Communications Regulations 2003)
- Regulation 6: Cookie consent requirements (mirrors ePrivacy Art. 5(3)).
- Regulation 22: Unsolicited marketing communications require prior consent (opt-in) with exception for existing customer soft opt-in.
- ICO enforcement powers under Regulation 31.
Marketing Processing Types and Risk Assessment
Customer Profiling
| Aspect | Assessment |
|---|
| Description | Aggregating customer data to create profiles for segmentation and targeting |
| WP248 criteria |
