How Does GDPR Affect Meta Ads?

Meta says the GDPR may apply to your business if you collect or use personal data about people in the EU or EEA, wherever your business is based, and that you are responsible for your own compliance. This entry gives what the rule says and what Meta says it does, as checked on 2 Oct 2026. It is not legal advice: check the linked pages and a qualified adviser.

Does GDPR apply to your Meta ads?

Meta’s page says the GDPR is a European privacy law that may apply if you collect or use personal data about people in the EU or EEA, regardless of where your business is based. It says the UK GDPR applies to processing of personal data about individuals in the UK.

The European Commission says the GDPR applies since 25 May 2018 and has been incorporated into the EEA Agreement, so it applies throughout the European Economic Area.

Ask whether any of your ad tools handle data about people in these places, then check the next sections.

What does Meta say you must do?

Meta says that as the business deciding how and why personal data is used, you are a controller and responsible for your own compliance. It names three important obligations:

• Legal basis. You need a valid one for each type of processing. If you rely on consent, Meta says it must be freely given, specific, informed and unambiguous.
• Transparency. You give people certain information when you collect their data, including your identity, the purposes and legal bases, and who you may share it with.
• Data subject rights. Meta lists access, correction, deletion, restriction, portability and objection, and says to have processes to respond.

Write down which legal basis you rely on for each ad tool you use.

What do Meta’s contract terms add?

If you use Meta business tools such as the Meta Pixel or Conversions API, Meta says you must follow the Meta Business Tools Terms. It says this includes:

• clear disclosures and a lawful basis, including consent where applicable, before you send data to Meta;
• making sure people in the EU or EEA give all necessary consents before you use the tools to store or access cookies or other information on their device;
• following the controller addendum, which sets out each side’s responsibilities when you and Meta act as joint controllers under Article 26 of the GDPR.

For custom audiences built from customer lists, Meta says the customer list terms require all necessary rights, permissions and a lawful basis. Check your cookie banner and customer list source against these points.

What does the EDPB say about consent?

The European Data Protection Board’s consent guidelines say pre-ticked opt-in boxes are invalid under the GDPR. They also say silence or inactivity, and merely proceeding with a service, cannot be regarded as an active indication of choice.

The guidelines quote the Article 4(11) definition of consent: any freely given, specific, informed and unambiguous indication of the person’s wishes, by a statement or a clear affirmative action. Compare your own banner with the guidelines.

What differs by place, and what does not?

Differs by place	Stated for all advertisers
Meta says the GDPR may apply to data about people in the EU or EEA, and the UK GDPR to data about individuals in the UK	Meta says you are a controller responsible for your own compliance
Supervision: the Commission says national data protection authorities supervise the law	The obligations Meta lists: legal basis, transparency, rights
For UK users, Meta says it is changing data controllership from Meta Platforms Ireland Limited to Meta Platforms, Inc., with updated terms effective 25 April 2023	Customer lists: Meta says its terms require all necessary rights, permissions and a lawful basis

Read the UK terms update if you advertise to people in the UK.

FAQ

Does GDPR apply if my business is outside the EU?

It can. Meta says the GDPR may apply if you collect or use personal data about people in the EU or EEA, regardless of where your business is based. Whether it applies to you is a legal question: check the linked pages and a qualified adviser.

Does Meta handle GDPR consent for me?

Meta’s page puts that duty on you. It says that if you use its business tools, you must make sure people in the EU or EEA give all necessary consents before the tools store or access cookies on their device. Meta says you are responsible for your own compliance.

Is this page legal advice?

No. Meta’s own page says it is not legal advice and does not cover every GDPR obligation, and recommends consulting a qualified attorney. This entry only reports what the linked pages say, as checked on 2 Oct 2026. Use it to prepare questions for your adviser.